Fleet deployment
Deploy on macOS
Package and roll out the Tenvyr agent to managed macOS hosts.
Use a signed, notarized installer package distributed by MDM. Treat macOS hosts as their own qualification group even when the command-line agent is the same.
Recommended MDM sequence
- Deploy the verified Tenvyr package.
- Install the launch daemon and root-owned configuration.
- Keep the daemon unloaded until enrollment.
- Deliver a unique, short-lived host token through a device-specific protected workflow.
- Run one-time enrollment as root.
- Remove token material and load the launch daemon.
- Confirm heartbeat, reported host keys, and a real SSH connection.
Validate the platform
Before each macOS version enters a rollout wave, test:
- Remote Login and OpenSSH configuration validation;
- launchd start, restart, and boot behavior;
- root ownership and permissions on state files;
- package upgrade and uninstall behavior;
- FileVault and MDM recovery access; and
- any security product that monitors or blocks SSH configuration changes.
Do not assume a Linux path or service name applies to macOS. Use the paths and launch daemon label included in the signed macOS package.
Rollback
Your MDM rollback should unload the Tenvyr daemon, restore the previously validated SSH configuration, validate it, and reload the SSH service. Preserve audit records and the host identity until the incident owner decides whether the host will be re-enrolled or removed.