HowTo import .mobileconfig files without MDM ?

[massoo]

Hello All,

We do not have any external MDM tied to our MAC devices. We use CrowdStrike as antivirus which requires "Full Disk Access" and "Web Preferences" Extensions Enabled. These are granted while we install CrowdStrike manually.

We are trying to import the official CrowdStrike profile in our MAC M1 and later laptops with their OS being macOS Ventura 13.x , as detailed in https://supportportal.crowdstrike.com/s/article/ka16T000000wtMWQAY

The command that we are using to import is :
> open /System/Library/PreferencePanes/Profiles.prefPane ~/Desktop/MAC/Official-CS-Falcon-Profile-no-Kext.mobileconfig
- This opens up the Profiles utility, where user can accept the prompts and install the profile.
- This profile is not signed (meaning its unsigned)

However this fails with error:

Profile installation failed
The profile must originate from a user-approved MDM server

I have also tried to install the profile with self-signed certificate, but the error is same

Is there a way to install / import a profile without an MDM Server ?

Please guide me

 

[bogdanw]

I think com.apple.TCC.configuration-profile-policy can only be used "on Mac computers enrolled in a mobile device management (MDM) solution"
https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol
https://support.apple.com/guide/dep...ences-policy-control-payload-dep38df53c2a/web

 

[massoo]

I think com.apple.TCC.configuration-profile-policy can only be used "on Mac computers enrolled in a mobile device management (MDM) solution"
https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol
https://support.apple.com/guide/dep...ences-policy-control-payload-dep38df53c2a/web

Meaning, we cannot import any .mobileconfig files without enrolling into an MDM Solution ?

 

[bogdanw]

Meaning, we cannot import any .mobileconfig files without enrolling into an MDM Solution ?

No, you can’t install profiles that require enrollment in MDM.
But you can install other .mobileconfig profiles.
Get iMazing Profile Editor https://apps.apple.com/app/imazing-profile-editor/id1487860882
or ProfileCreator https://github.com/ProfileCreator/ProfileCreator

The values that are marked “Supervised only” require MDM enrollment.
Other values can be used by any user/admin.
Example


https://forums.macrumors.com/threads/cannot-disable-system-update.2388058/
https://developer.apple.com/documentation/devicemanagement/restrictions

How to block App Store https://forums.macrumors.com/threads/how-to-block-app-store.2377797/
block Yahoo.com https://forums.macrumors.com/threads/everything-has-failed-to-block-yahoo-com-search.2379256/
disable iCloud Private Relay https://forums.macrumors.com/threads/permanently-disable-icloud-private-relay.2332146/