---
updatedAt: 2026-09-24T17:25:29.000Z
agentTools:
  projectIndex: https://docs.stairwell.com/llms.txt
---

# Install (JAMF)

Deploy the macOS forwarder with Jamf Pro. Three configuration profiles, a smart group that gates on all three, then the package -- in that order.

The macOS forwarder collects files from Intel and Apple Silicon Macs, but it will not install into a vacuum: macOS has to be told, by configuration profile, to permit the system extension and grant full disk access. Jamf's job here is to guarantee those profiles land *before* the package does.

That ordering is the whole design of this page. You build three configuration profiles, then a smart computer group whose membership requires all three, then point the install policy at that group. A machine cannot receive the package until it already has the profiles, so the failure mode where the installer runs early and fails cannot happen.

You will need a [Stairwell environment ID](https://docs.stairwell.com/docs/environments) and a [forwarder authentication token](https://docs.stairwell.com/docs/create-revoke-auth-tokens) before you start.

> 🚧 Do not start with your crown jewels
>
> The forwarder's first act is a full-disk **backscan**, which is I/O-heavy for a few hours and then subsides. Treat your first several installs as sacrificial: they upload the most unique files, and every later install is cheaper because Stairwell already knows what the earlier ones sent. See [Forwarder Performance Tuning](https://docs.stairwell.com/docs/performance-tuning).

***

## 1. Create Configuration Policies

### 1A. Create System Extension Policy

* Log into Jamf Pro

* Under Computers :arrow\_right: Content Management, Select `Configuration Profiles`

* Select `+ New`

* Under Options :arrow\_right: General
  * Name: `Stairwell Forwarder System Extension Policy`
  * Level: `Computer Level`
  * Distribution Method: `Install Automatically`

* Under Options :arrow\_right: System Extensions, Select `Configure`

* Check the box for `Allow users to approve system extensions`

* Under Allowed Team IDs and System Extensions
  * Display Name: `Stairwell System Extension Policy`
  * System Extension Types: `Allowed System Extensions`
  * Team Identifier: `677UQVFGY8`

* Under Allowed System Extensions, Select `+ Add`
  * Type in: `com.stairwell.Inception.ProcessMonitor`
  * Select `Save`

* Under Options :arrow\_right: Scope :arrow\_right: Selected Deployment Targets, Select `+ Add`
  * Select the desired computer, user, group, etc
  * Select `Add`

* Select :floppy\_disk: `Save`

> 📘 Optional System Extension Type
>
> Instead of selecting "Allowed System Extensions", you can select "Allow Team Identifiers" and skip the Allows System Extension setup. This is a less restrictive setting.

### 1B. Create Privacy Policy

* Under Content Management, Select `Configuration Profiles`

* Select `+ New` in top right

* Under Options :arrow\_right: General
  * Name: `Stairwell Forwarder Privacy Policy`
  * Level: `Computer Level`
  * Distribution Method: `Install Automatically`

* Under Options :arrow\_right: Privacy Preferences Policy Control, Select `Configure`
  * Identifier: `com.stairwell.Inception.ProcessMonitor`
  * Identifier Type: `Bundle ID`
  * Code Requirement: `anchor apple generic and identifier "com.stairwell.Inception.ProcessMonitor" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "677UQVFGY8")`

* Under APP OR SERVICE, Select `+ Add`
  * Select `SystemPolicyAllFiles`
  * Select `Allow`
  * Select `Save`

* Under Options :arrow\_right: Scope :arrow\_right: Selected Deployment Targets, Select `+ Add`
  * Select the desired computer, user, group, etc
  * Select `Add`

* Select :floppy\_disk: `Save`

### 1C. Create Application Settings Policy

* Under Content Management, Select `Configuration Profiles`

* Select `+ New` in top right

* Under Options :arrow\_right: General
  * Name: `Stairwell Forwarder Settings Policy`
  * Level: `Computer Level`
  * Distribution Method: `Install Automatically`

* Under Options :arrow\_right: Applications & Custom Settings :arrow\_right: External Applications, Select `+ Add`
  * Source: `Custom Schema`
  * Preference Domain: `com.stairwell.Inception.ProcessMonitor`
  * Select `+ Add schema` under Custom Schema
  ```
  {  
    "description": "Preference settings for Stairwell Forwarder",  
    "title": "Stairwell Forwarder",  
    "properties": {  
      "EnvId": {  
        "title": "Environment ID",  
        "description": "Stairwell Environment ID",  
        "property_order": 5,  
        "type": "string"  
        },  
      "RegistrationToken": {  
        "title": "Registration Token",  
        "description": "Token used to register assets",  
        "property_order": 10,  
        "type": "string"  
      },  
      "Debug": {  
        "title": "Debug Logging",  
        "description": "Enables debug logging. Defaults to false",  
        "property_order": 75,  
        "type": "boolean"  
      }  
    }  
  }
  ```
  * Environment ID: `Environment ID`
  * Registration Token: `File Forwarder Token`
  * Debug Logging: `false`

* Under Options :arrow\_right: Scope :arrow\_right: Selected Deployment Targets, Select `+ Add`
  * Select the desired computer, user, group, etc
  * Select `Add`

* Select :floppy\_disk: `Save`

> 📘 Fleets where MAC addresses are not stable
>
> By default a Mac identifies itself to Stairwell by computer name plus primary MAC address. If your machines change MAC -- or are imaged from a template that already had the forwarder installed -- add a `STAIRWELL_REGISTRATION_KEY` string property to the custom schema above and set it per machine to something stable and unique, such as the hardware serial. Read [Asset Identifiers](https://docs.stairwell.com/docs/asset-identifiers) first: it is read only at first registration, so it has to be right before the rollout, not after.

***

## 2. Create Smart Computer Group

* Under Computers :arrow\_right: Groups, Select `Smart Computer Groups`

* Select `+ New`

* Under Computer Group
  * Display Name: `Stairwell Forwarder Profiles`

* Under Criteria, Select `+ Add`

* Select `Show Advanced Criteria`

* Find `Profile Name` and Select `Choose` (repeat this 2 more times)

* Under Criteria
  * Operator: `Has`
  * Value: `Stairwell Forwarder System Extension Policy`
  * AND/OR: `and`
  * Operator: `Has`
  * Value: `Stairwell Forwarder Privacy Policy`
  * AND/OR: `and`
  * Operator: `Has`
  * Value: `Stairwell Forwarder Settings Policy`

* Select :floppy\_disk: `Save`

***

## 3. Create Application Package

* [Download the current macOS forwarder package](https://docs.stairwell.com/docs/macos-forwarder-downloads)

* Under Settings :arrow\_right: Computer Management, Select `Packages`

* Select `+ New`

* Under General :arrow\_right: Filename, Select `Choose File`

* Select the downloaded package

* Select :floppy\_disk: `Save`

> 📘 Upload failed: undefined error
>
> If you encounter this error, please check the Cloud Services Connection.

***

## 4. Create New Policy

* Under Computers :arrow\_right: Content Management, Select `Policies`

* Select `+ New`

* Under Options :arrow\_right: General
  * Display Name: `Stairwell Forwarder`
  * Enabled: :ballot\_box\_with\_check:
  * Trigger: `Recurring Check-in`

* Under Options :arrow\_right: Packages
  * Select `Configure`
  * Find the package created in Step 3, Select `Add`
  * Distribution Point: `Each computer's default distribution point`
  * Action: `Install`

* Under Scope :arrow\_right: Targets :arrow\_right: Selected Deployment Targets
  * Select `+ Add`
  * Select `Computer Groups`
  * Find the group created in Step 2, Select `Add`

* Select :floppy\_disk: `Save`

> 📘 Additional Notes
>
> 1. If the profile payloads from the steps above are incorrect or not present before the installer runs, the installation will fail and require remediation.
> 2. Once the above configuration profiles, smart groups, packages, and policies are created, Jamf Pro will automatically install the package on the machines which have the required profiles.

***

## 5. Confirm Installation

* Navigate to [app.stairwell.com](https://app.stairwell.com) and log in
* Select `Assets`
* Select the newly created asset name(s) to confirm files are arriving
* Check the count under **All Objects**

Ingestion takes a few minutes to become visible. An asset that appears and then stays at zero objects is usually the Privacy Preferences profile: without `SystemPolicyAllFiles`, the forwarder runs, reports in, and sees only what macOS lets any unprivileged process see. That reads as a successful deployment right up until someone asks why coverage is thin. See [macOS Troubleshooting](https://docs.stairwell.com/docs/macos-troubleshooting).

Do all of this against a pilot machine or two before you widen the scope.

## What should I read next?

* [macOS Forwarder downloads](https://docs.stairwell.com/docs/macos-forwarder-downloads), for the current package and its release notes.
* [Anti-Tamper on macOS](https://docs.stairwell.com/docs/anti-tamper-macos), before you try to remove or replace a forwarder.
* [Install (Generic MDM)](https://docs.stairwell.com/docs/install-mac-with-mdm), if some of your Macs are managed elsewhere.

# Sibling pages

* [Install (Generic MDM)](https://docs.stairwell.com/docs/install-mac-with-mdm.md)
* [Install (Kandji)](https://docs.stairwell.com/docs/install-mac-with-kandji.md)
* [Install on macOS](https://docs.stairwell.com/docs/install-mac-manually.md)