Installing using MDM

Create two Trusted Certificate profiles, each scoped to MAC-Quilr-Pilot:

• Root CA → quilr-root-ca.crt
• Intermediate CA → quilr-ea-intermediate-ca.crt

The PPPC profile pre-approves kTCCServiceSystemPolicyAllFiles and kTCCServiceAppManagement with no user prompt.

Apps → Add → macOS app (PKG), upload quilr-endpoint-agent-installer.pkg. In the Pre-install script section, inject the tenant config:

#!/bin/bash
TENANT="<TENANT-ID>"
printf '{"tenant_id":"%s","discover_skip":false}\n' "$TENANT" > /tmp/quilr-endpoint-agent.json
exit 0

Assign to the same device group; confirm under Apps → Device install status.

1. Computers → Configuration Profiles → New
2. Name “Quilr CA — Trust Chain,” category Certificates, level Computer Level
3. Add two Certificate payloads — upload root and intermediate
4. Disable “Allow export from keychain” for the root
5. Scope to your target group and save

security find-certificate -a /Library/Keychains/System.keychain | grep -i quilr

Upload each .mobileconfig as a separate profile (Upload, Install Automatically, Computer Level), scoped to the same group:

• quilr-endpoint-agent_FullDiskAccess.mobileconfig → “Quilr Endpoint Agent — PPPC” (grants SystemPolicyAllFiles + SystemPolicyAppBundles to /Applications/QuilrAIProxy.app)
• quilr-endpoint-agent-nw-extension.mobileconfig → “Quilr Endpoint Agent — Network Extension”

profiles list | grep -i quilr   # expect 3 entries total

Pre-install script

Settings → Computer Management → Scripts → New, name “Quilr — Write tenant config (pre-install)”:

#!/bin/bash
TENANT="<TENANT-ID>"
printf '{"tenant_id":"%s","discover_skip":false}\n' "$TENANT" > /tmp/quilr-endpoint-agent.json
exit 0

Package & policy

1. Settings → Computer Management → Packages → New → upload quilr-endpoint-agent-installer.pkg (category “Endpoint Security,” priority 10)
2. Computers → Policies → New → “Install Quilr Endpoint Agent”
3. Triggers: Recurring Check-in + Enrollment Complete; frequency Once per computer
4. Packages tab: add installer, action = Install; attach the pre-install script with Priority = Before
5. Scope to the same group; save

Library → Add Library Item → Certificate ×2: “Quilr Root CA” (quilr-root-ca.crt) and “Quilr Intermediate CA” (quilr-ea-intermediate-ca.crt). Disable “Allow export from keychain.” Confirm both show Status: Installed before proceeding.

Library → Add Library Item → Custom Profile ×2 using the PPPC and Network Extension .mobileconfig files. The PPPC profile grants kTCCServiceSystemPolicyAllFiles and kTCCServiceAppManagement (macOS 14+). Wait until both show “Installed.”

Library → Add Library Item → Custom App, name “Quilr Endpoint Agent,” upload the PKG. Paste the pre-install script:

#!/bin/bash
TENANT="<TENANT-ID>"   # from Quilr support
printf '{"tenant_id":"%s","discover_skip":false}\n' "$TENANT" \
  > /tmp/quilr-endpoint-agent.json
exit 0

Audit script (exit 0 = healthy)

#!/bin/bash
APP="/Applications/QuilrAIProxy.app"
PLIST="/Library/LaunchDaemons/ai.quilr.sentinel.plist"
EXPECTED_VERSION="2026.05.08"

[ -d "$APP" ]   || { echo "missing: $APP"; exit 1; }
[ -f "$PLIST" ] || { echo "missing: $PLIST"; exit 1; }
INSTALLED=$(defaults read "$APP/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null)
[ "$INSTALLED" = "$EXPECTED_VERSION" ] || { echo "version drift"; exit 1; }
launchctl print system/ai.quilr.sentinel >/dev/null 2>&1 || { echo "daemon not loaded"; exit 1; }
exit 0

Post-install script (optional)

#!/bin/bash
sleep 2
launchctl print system/ai.quilr.sentinel >/dev/null 2>&1 || {
  echo "post-install: daemon not loaded — kickstarting"
  sudo launchctl kickstart -k system/ai.quilr.sentinel
}
exit 0

Assign the Custom App to your Blueprint; monitor per-device progress under Library Item → Status.

Download quilr-endpoint-agent-win-install-bundle.zip and copy the files to a location Endpoint Central can reach — a UNC share (e.g. \\EPC-SERVER\SoftwareRepository\Quilr\) or the admin workstation for HTTP upload.

Software Deployment → Package Creation → Packages → Add Package → Windows. Name “Quilr Endpoint Agent,” type “MSI/MSP.” Locate the installable from the shared folder or local computer.

The MSI writes the CAs automatically. To pre-stage them: Configurations → Add Configuration → Computer → Custom Script, name “Quilr CA Trust,” associate both .crt files:

certutil -addstore -f Root "%~dp0quilr-root-ca.crt"
certutil -addstore -f CA   "%~dp0quilr-ea-intermediate-ca.crt"

Target WIN-Quilr-Pilot and deploy.

Configurations → Add Configuration → Computer → Install MSI/EXE Software, name “Quilr Endpoint Agent — Install.”

• Package Type: MSI · MSI Package Name: “Quilr Endpoint Agent”
• Operation Type: Install Completely · Install as: System User
• Allow user interaction: No (silent)
• Installation Option: “During or After Startup” · Reboot Policy: “Do not reboot”
• Target: WIN-Quilr-Pilot → Deploy

Because the agent excludes msedge.exe and chrome.exe, deploy the extension via Registry configurations. Obtain the exact extension IDs/URLs from Quilr support.

Verify in edge://extensions / chrome://extensions: extension present, enabled, “Installed by your organization.”