Create a Jamf Policy for Prisma Access Agent Deployment

1. (Prerequisite) Create a Smart Computer Group that identifies those users who have the Prisma Access Agent configuration profile installed on their devices.

   As a best practice, use the Profile Identifier as the match criteria for the Smart Computer Group. You can obtain the identifier from a macOS device that already has the configuration profile installed, such as a test device.

   1. Select ComputersSearch Inventory.
   2. Search for the computer that has the Prisma Access Agent profile installed.
   3. Select the computer name and select InventoryProfiles.
   4. Find the Prisma Access Agent profile from the list of profiles, and copy the corresponding profile identifier.
   5. Create the Smart Computer Group.
   6. For the Criteria, select Profile Identifier, and paste the profile identifier that you copied. For example:

   7. Save your settings.
2. Upload the Prisma Access Agent package to Jamf Pro for deployment to the managed macOS devices in your organization.

   1. If you have not done so, download the Prisma Access Agent installation package (.pkg) and configuration file (config.json) from ConfigurationEndpoint Management in Strata Cloud Manager.
   2. (Optional) Update the Prisma Access Agent deployment configuration in the config.json file.

      For example, you can update the deployment configuration to enable pre-logon support or disable the GlobalProtect app (if installed on the endpoint) during the installation of the Prisma Access Agent.
   3. Put the .pkg and config.json files into a folder and give the folder a meaningful name (such as the name of the .pkg). Zip up the folder.
   4. In Jamf Pro, select SettingsComputer ManagementPackages.

   5. Click New.
   6. Specify the General settings for the package.

      1. Enter a Display Name for the package.
      2. Click Choose File, select the package that you zipped up, and click Open.

   7. Save your settings.
3. Create a policy for deploying the Prisma Access Agent by selecting ComputersPoliciesNew.
4. In the General payload, configure the basic settings for the policy:

   1. Enter a Display Name for the policy and make sure that the policy is Enabled.
   2. (Optional) Select a Category to add the policy to.
   3. Specify Trigger events that will initiate the policy, such as Recurring Check-in.
   4. Select the Execution Frequency, such as Once per computer.

5. Configure the Packages payload for your new policy.

   1. Select PackagesConfigure.
   2. Scroll down the list of packages and Add the Prisma Access Agent zip package that you uploaded.
   3. Select a Distribution Point.
   4. Select the Install action.

6. (Optional) Configure the Maintenance payload.

   1. Select MaintenanceConfigure.
   2. Select Update Inventory.

7. Set the scope of the policy to the Smart Computer Group that you created in step 1 to target those users who have the Prisma Access Agent profile installed on their devices.
8. Save the policy.

   When the macOS endpoints in the Smart Computer Group check in with Jamf Pro and meet the trigger in the policy, the policy will run and deploy the Prisma Access Agent to the endpoints along with Endpoint DLP.