Home Device Management Enrolling macOS Devices with KyberGate Agent

Enrolling macOS Devices with KyberGate Agent

Last updated on Aug 18, 2026

Enrolling macOS Devices with KyberGate Agent

Deploy KyberGate on Macs using the KyberGate Agent installer package. The agent enrolls the device, points its traffic at the KyberGate proxy, and reports activity to your dashboard.

Current version: 3.4.0. The package is signed and notarized by Apple, so it installs without Gatekeeper warnings.

Before You Begin

  • macOS 13 (Ventura) or later
  • Your Organization ID — find it in Settings → Workspace → Setup, or on Devices → Add Device, where it is pre-filled into each platform's steps
  • Administrator access on the Mac, or an MDM that can push packages and configuration profiles

There is no KyberGate app in the Mac App Store. The agent is distributed only as a signed .pkg from your dashboard. If you searched the App Store and found nothing, that is expected.

What You Download

Both files come from Dashboard → Downloads → macOS:

File What it does Required?
KyberGate Agent .pkg Installs the agent, enrolls the device, sets the proxy (PAC) and DNS Yes
Configuration profile .mobileconfig Supplies the Organization ID and installs the KyberGate root certificate Yes for MDM

The downloaded package is named for your organization (KyberGate-Agent-<your-org-id>.pkg). Do not rename it — the installer reads your Organization ID from the filename as one of its enrollment sources. Renaming does not break Apple's signature, but it can cost the installer its most reliable enrollment hint.

Method 1: Jamf Pro (Recommended for Fleets)

This is the supported zero-touch path. Deploy the profile first, then the package.

Step 1 — Upload the configuration profile

  1. Download the .mobileconfig from Dashboard → Downloads → macOS
  2. In Jamf Pro, go to Computers → Configuration Profiles → New
  3. Choose Upload and select the downloaded .mobileconfig
  4. Scope it to your Mac group and save

This profile carries two payloads: your Organization ID as a managed preference, and the KyberGate root certificate.

Step 2 — Upload and deploy the package

  1. Upload the .pkg to Jamf Admin or Settings → Computer Management → Packages
  2. Create a policy with a Packages payload containing the KyberGate Agent
  3. Scope it to the same Mac group and set your trigger

Step 3 — Verify

Devices appear in your dashboard under Devices within a few minutes of installing.

Why order matters

The installer looks for your Organization ID in several places, and the profile's managed preference is the most reliable one. If the profile lands first, enrollment is unambiguous. If the package lands first it will still enroll — it also reads the Organization ID from its own filename and from any previous install — but deploying the profile first avoids depending on that fallback.

No password prompts under MDM

Trusting a certificate in the System keychain normally raises a Touch ID or administrator password dialog — even for processes running as root, because keychain trust is gated by an authorization right rather than by file permissions. During an MDM deployment nobody is at the keyboard to answer it.

KyberGate handles this for you. The installer detects an unattended MDM install and does not attempt the keychain write; the certificate is delivered by the configuration profile instead, which installs silently. Agent 3.4.0 applies the same rule inside the app itself, so no dialog appears when a user later logs in.

This is why the configuration profile is mandatory rather than optional. It is the only channel that can install the certificate without a prompt. Deploy the package alone and HTTPS sites will show certificate errors.

Method 2: Other MDMs (Mosyle, Kandji, Intune)

The same two files work anywhere that can push a .pkg and a .mobileconfig:

  • Mosyle: Management → Install macOS Application for the package; upload the profile under Custom Profile
  • Kandji: add a Custom App library item for the package and a Custom Profile for the .mobileconfig
  • Intune: add the package as a macOS app (PKG) and the profile as a Custom template

Deploy the profile first, as above.

Unattended detection is strongest on Jamf Pro. On other platforms, if a user is logged in during installation, it is possible for a certificate prompt to appear. Test on one device before a fleet rollout, and confirm the profile installed first.

Method 3: Single Mac, Hands-On

For a one-off install where you are sitting at the machine:

  1. Download the .pkg from Dashboard → Downloads → macOS
  2. Double-click it and follow the installer
  3. Approve the certificate prompt if one appears — this is expected when a human is present

You can also install from Terminal:

curl -sL https://kybergate.com/install/YOUR_ORG_ID | sudo bash

Replace YOUR_ORG_ID with your Organization ID. This script downloads the current signed package, enrolls the device, installs the certificate, and configures the proxy.

What the Agent Does

  • Enrolls the Mac and reports it to your dashboard
  • Points web traffic at the KyberGate proxy using your organization's PAC file, which is what makes filtering happen
  • Sets KyberGate DNS resolvers
  • Trusts the KyberGate root certificate so HTTPS can be inspected
  • Sends heartbeat and activity data
  • Runs as a Launch Agent and starts at login

Verifying the Install

Check all three. The first two can look correct while filtering is entirely inactive.

1. The device appears in your dashboard under Devices, within about five minutes.

2. The proxy is actually configured — this is the step people skip:

networksetup -getautoproxyurl "Wi-Fi"

You should see a proxy.kybergate.com PAC URL with Enabled: Yes. If this is empty, the device is enrolled and heartbeating but no traffic is being filtered.

3. Filtering works. Visit a site in a category you block. You should see the KyberGate block page rather than a certificate error.

An enrolled device is not necessarily a filtered device. Heartbeat and enrollment status only prove the agent is talking to us. The PAC check above is what proves traffic is being inspected. Always confirm it on your first device before rolling out.

Troubleshooting

Device does not appear in the dashboard The agent has no Organization ID. Confirm the configuration profile is installed (System Settings → General → Device Management), or set it directly:

sudo defaults write /Library/Preferences/com.kybersystems.KyberGateAgent-macOS kybergate_orgId "YOUR_ORG_ID"

Then relaunch KyberGate Agent.

Certificate errors on HTTPS sites The root certificate is not trusted. Under MDM this means the configuration profile did not install — deploy it before the package. Verify in Keychain Access → System → Certificates.

Device enrolled but nothing is filtered The PAC URL is missing. Run the networksetup -getautoproxyurl check above. This is the single most common cause of "KyberGate says it is working but students reach blocked sites."

A password prompt appeared during MDM deployment The configuration profile was missing or arrived after the package. Deploy the profile first and ensure agent 3.4.0 or later.

Menu bar icon is greyed out The agent has no Organization ID — see the first item above.

Related Articles