SafeToOpen Browser Security

Apple MDMs: Jamf, Kandji, Mosyle, Addigy, SimpleMDM

The same payloads in each Apple MDM, with the menu paths and variables each one offers

Guide 8 of 11 · April 2026

Every Apple MDM delivers the same three things from guide 4 (macOS) and guide 5 (iOS): a configuration profile that force-installs the extension in Chrome and Edge, the four enrolment values, and for Safari the App Store app plus the declarative Safari extension setting and managed app configuration. What differs is where the buttons are and whether the tool can substitute per-user and per-device variables into a profile. When it can, you need no script; when it cannot, the root script from guide 4 section 2 does the job.

MDM	Variables in profiles	Scripts	DDM Safari extension settings	iOS managed app config
Jamf Pro	`$EMAIL`, `$USERNAME`, `$COMPUTERNAME`, `$SERIALNUMBER`, extension attributes	Policies → Scripts	Blueprints	Mobile device app → App Configuration
Kandji	None in custom profiles	Library → Custom Script	Check Library for a Safari extension item	App Store app → Managed App Configuration
Mosyle	`%UserEmail%`, `%DeviceName%`, `%SerialNumber%`	Management → Custom Commands	Check Management → Declarative	Apps → Managed App Configuration
Addigy	`{{user_email}}`, `{{device_name}}` (facts)	Policies → Catalog → Custom Software / Scripts	Check MDM Profiles	Apps → App Configuration
SimpleMDM	`{{device_name}}`, `{{email}}` on some payloads	Scripts	Check Configs	Apps → Managed Configuration

Note Vendor menus move. Where a table cell says “check”, the product had announced or partial support for declarative Safari extension settings at the time of writing; confirm in your tenant. The fallback is always the same: the user turns the extension on once in Safari settings.

1. Jamf Pro#

macOS: profile only, no script#

Computers → Configuration Profiles → New. Level Computer Level. Add an Application & Custom Settings → Upload payload for preference domain com.google.Chrome with a plist containing ExtensionInstallForcelist (array with ekfkopmgnijagfmjgcjkbffcnmggekec;https://clients2.google.com/service/update2/crx). Add a second Upload payload for com.microsoft.Edge with bbgoikmidjfiaaadlgkpdlppilhkjfke;https://edge.microsoft.com/extensionwebstorebase/v1/crx.
Create a second profile, Level User Level, with Application & Custom Settings → Upload for preference domain com.google.Chrome.extensions.ekfkopmgnijagfmjgcjkbffcnmggekec using the plist below, and again for com.microsoft.Edge.extensions.bbgoikmidjfiaaadlgkpdlppilhkjfke. Jamf replaces the variables at install time.
Scope both to your computers. Chrome and Edge apply managed preferences within minutes.

<dict>
  <key>enrol_key</key><string>PASTE-ENROLMENT-KEY</string>
  <key>user_name</key><string>$EMAIL</string>
  <key>asset_name</key><string>$COMPUTERNAME</string>
  <key>domain_name</key><string></string>
</dict>

$EMAIL is the email in the computer’s User and Location inventory. Populate it through LDAP or cloud identity provider lookups, or a PreStage enrollment with account collection. If it can be empty, use $USERNAME instead and set the email domain in the console.

macOS: Safari#

Computers → Mac App Store Apps → add “SafeToOpen Online Security” from your Apps and Books location; distribution Install Automatically, device-based licensing.
Blueprints → new blueprint → Safari Extension Settings → add the extension identifier with State AlwaysOn, Private Browsing AlwaysOn, Allowed Domains * (macOS 15+). Assign to the same computers.

iOS and iPadOS#

Devices → Mobile Device Apps → add “SafeToOpen” (https://apps.apple.com/us/app/safetoopen/id1588042602), Install Automatically, device-based licensing.
On the app → App Configuration → Preferences, paste the plist below. Jamf substitutes $EMAIL and $DEVICENAME.
Blueprints → Safari Extension Settings as above, scoped to the devices (iOS 18+).

<dict>
  <key>enrol_key</key><string>PASTE-ENROLMENT-KEY</string>
  <key>user_name</key><string>$EMAIL</string>
  <key>asset_name</key><string>$DEVICENAME</string>
  <key>domain_name</key><string></string>
</dict>

2. Kandji#

Library → Add Library Item → Custom Profile. Upload the force-install mobileconfig from guide 4 section 1. Assign it to your Blueprints.
Kandji custom profiles cannot substitute per-user values, so add Library → Custom Script with the shell script from guide 4 section 2 (paste your key), Execution frequency: Run daily, Run as root. This writes the four values into the console user’s managed preferences.
Safari (macOS): Library → App Store Apps → “SafeToOpen Online Security”, Install automatically. Enable the extension through Kandji’s Safari extension library item if your tenant shows one; otherwise the user toggles it once in Safari → Settings → Extensions.
iOS: Library → App Store Apps → “SafeToOpen”, Install automatically. In the item, Managed App Configuration → paste the four keys as a plist; Kandji supports $EMAIL, $FULL_NAME and $DEVICE_NAME style variables in that field. Confirm the variable names in the in-product help for your version.

Kandji Blueprints assign everything: put the custom profile, the custom script and both apps in the same Blueprint so a Mac that is wiped and re-enrolled comes back fully configured. For the Safari Mac app add Library → App Store Apps → “SafeToOpen Online Security”.
Kandji reports the script’s last exit code per device under Devices → the Mac → Library items; a non-zero code means the console user could not be determined (nobody logged in yet). It re-runs on the daily schedule.

3. Mosyle#

Management → Profiles → Custom Profile → upload the force-install mobileconfig (guide 4 section 1) and assign.
For the enrolment values, either a second Custom Profile for the two extension preference domains using Mosyle variables (%UserEmail%, %DeviceName%) with the plist in this guide’s introduction, or Management → Custom Commands with the root shell script from guide 4 section 2 set to run at every check-in or daily.
Safari (macOS): Management → Apps → App Store → “SafeToOpen Online Security”, automatic install. Declarative Safari extension settings: Management → Declarative if present in your plan.
iOS: Apps → App Store → “SafeToOpen”, automatic install; Managed App Configuration → the four keys with %UserEmail% and %DeviceName%.

4. Addigy#

Policies → select the policy → Catalog → MDM Profiles → Custom Profile → upload the force-install mobileconfig and add it to the policy.
Catalog → Custom Software → New. Installation script: the root shell script from guide 4 section 2. Condition script: exit non-zero when /Library/Managed Preferences/$(stat -f%Su /dev/console)/com.google.Chrome.extensions.ekfkopmgnijagfmjgcjkbffcnmggekec.plist is missing, so it re-runs for a new user. Addigy facts such as {{device_name}} can be used inside Custom Profiles where per-device values are needed without a script.
Safari (macOS): Catalog → Public Software or Apple App Store apps → “SafeToOpen Online Security”, auto-deploy. iOS: MDM Profiles → App Store app with App Configuration for the four keys.

5. SimpleMDM#

Configs → Profiles → Add → Custom Configuration Profile → upload the force-install mobileconfig. Assign to a device group.
Scripts → Add the root shell script from guide 4 section 2, run on the group, schedule daily for shared Macs.
Apps → App Catalog → add “SafeToOpen” (iOS) and “SafeToOpen Online Security” (macOS) from Apps and Books, deploy to the group. On the iOS app, Managed Configuration → paste the four keys; SimpleMDM substitutes {{device_name}}, and {{email}} where the device record has one.

6. Verify in any Apple MDM#

macOS: defaults read "/Library/Managed Preferences/$(stat -f%Su /dev/console)/com.google.Chrome.extensions.ekfkopmgnijagfmjgcjkbffcnmggekec" prints the four values; chrome://policy shows them under the extension.
iOS: Settings → Safari → Extensions shows SafeToOpen on and managed.
Console → Settings → Unattended enrolment → Enrolled devices lists the device with the person and workspace.