> ## Documentation Index > Fetch the complete documentation index at: https://docs.enlazosystems.com/llms.txt > Use this file to discover all available pages before exploring further. # About MDM Deployment > Deploying Proximos, its settings, PPPC profiles, and launch agents via Jamf Pro, Mosyle, Addigy, JumpCloud, Intune, and other MDMs. Proximos is built for MDM-managed environments. The recommended deployment flow is: 1. Open and configure Proximos standalone on an IT admin or test Mac. 2. When all settings are configured and ready, Export the settings plist from **Settings → Export Settings → Export as .plist…** (or as a `.pkg`). 3. Deploy [the app](https://files.enlazosystems.com/Proximos/Proximos.pkg) and settings plist to managed Macs via your MDM. 4. Deploy the System Launch Agent or System Headless Launch Agent PKG from **Settings → Extras** for persistent or headless operation. 5. Deploy the Proximos PPPC Profile from **Settings → Extras → Export Full Profile** or the for full notification and enforcement functionality. **Note**: When a settings .plist file is detected at `/Library/Managed Preferences/com.enlazo.proximos.settings.plist` or `/Library/Preferences/com.enlazo.proximos.settings.plist`, Proximos enters **Managed Mode**. In Managed Mode, users cannot access the Settings or License Manager windows, and the Quit menu option is hidden from the menu bar. Select your MDM platform for step-by-step deployment instructions: Script, PKG, and Configuration Profile deployment for the app, settings, PPPC profile, and launch agents. Custom Command, PKG, and Custom Profile deployment for the app, settings, PPPC profile, and launch agents. Smart Software, Maintenance Item, and Custom Profile deployment for the app, settings, PPPC profile, and launch agents. Command-based deployment for the app, settings, and launch agents, with Custom Configuration Profile for PPPC. PKG/DMG app deployment, Preference File and Custom Configuration Profile settings, and Script-based launch agent deployment. Generic deployment instructions covering all options for any MDM platform — app, settings, PPPC profile, and launch agents. *** ## About the PPPC Profiles Two PPPC profiles are available from **Settings → Extras → Proximos PPPC Profiles**. Both are exported as signed `.mobileconfig` files. ### Full PPPC Profile **Export Full Profile** produces `Proximos PPPC Profile.mobileconfig`. This is the profile to deploy when Proximos is managed via MDM. It contains two payloads: * A **Service Management (Managed Login Items)** payload (`com.apple.servicemanagement`) that authorizes Proximos, Nudge, and their associated launch agents as managed background services. This payload requires MDM to deploy and cannot be user-installed. * A **Notifications** payload (`com.apple.notificationsettings`) that pre-approves notification permissions for Proximos, Nudge, and their notifier components. Upload the `.mobileconfig` to your MDM as a Custom Configuration Profile and scope it to your managed devices. Most MDMs parse and import all payloads automatically. If your MDM uses a manual profile builder instead, see the [Other MDM](/proximos/mdm-other#pppc-profile-key-reference) page for the individual key values. ### Notifications Only Profile **Export Notifications Only Profile** produces `Proximos Notifications Profile.mobileconfig`. This profile contains only the **Notifications** payload — it does not include the Service Management payload, so it does not require MDM to deploy. This profile exists for Macs that are not enrolled in an MDM but still need pre-approved notification permissions for Proximos and Nudge. It can be distributed via AirDrop or a USB thumb drive and double-click installed directly on a Mac by the user or an IT technician without MDM involvement. **If you have an MDM, deploy the Full PPPC Profile instead.** The Full Profile is a superset of the Notifications Only Profile and covers all required permissions. *** ## About the System Launch Agent and System Headless Launch Agent Proximos includes two launch agent types for different deployment approaches. Both can be generated as installable `.pkg` files from **Settings → Extras → System Launch Agents**. ### System Launch Agent (`com.enlazo.proximos`) * **Purpose:** Keeps the Proximos menu bar app running persistently for all users who log in. * **Behavior:** Launches Proximos at login and keeps it active in the menu bar. The app runs on a `StartInterval` of 10 seconds — checking on each wake whether it should perform the daily update check based on the configured daily run time. * **Best for:** Organizations that want Proximos visible in the menu bar as a persistent presence, allowing users to see their update status and manually trigger checks. * **PKG export:** **Settings → Extras → Export Standard .pkg** * **Script deployment:** `Deploy Proximos System Launch Agent.sh` * **Install path:** `/Library/LaunchAgents/com.enlazo.proximos.plist` ### System Headless Launch Agent (`com.enlazo.proximos.headless`) * **Purpose:** Runs a Proximos update check once daily as a background process without keeping the app in the menu bar. * **Behavior:** Invokes `Proximos --check-for-updates` at the `StartCalendarInterval` time derived from the **Daily Run Time** setting configured when the PKG was generated. The process completes and exits. No menu bar icon is shown. * **Best for:** Organizations that want silent daily enforcement without a persistent app presence. * **PKG export:** **Settings → Extras → Export Headless .pkg** * **Script deployment:** `Deploy Proximos System Headless Launch Agent.sh` * **Install path:** `/Library/LaunchAgents/com.enlazo.proximos.headless.plist` ### User Launch Agent (`com.enlazo.proximos`, user-level) * **Purpose:** A third launch agent type, distinct from the two system-level agents above — created not by MDM deployment, but by Proximos itself when the **Enable Proximos Launch Agent** setting (`enableProximosLaunchAgent`) is turned on in the settings plist. * **Behavior:** Installed into `~/Library/LaunchAgents/com.enlazo.proximos.plist` for the currently logged-in user the first time Proximos is opened after the setting is enabled. * **Best for:** Organizations that want persistent menu bar operation but prefer to control it entirely through the settings plist, without deploying a separate system-level PKG via MDM. * **Install path:** `~/Library/LaunchAgents/com.enlazo.proximos.plist` (per user) **Advantages and disadvantages versus the System Launch Agent:** The two approaches differ in two important ways — how they get installed for new users, and who can remove them. * **First-login automation:** The System Launch Agent, once deployed via MDM to `/Library/LaunchAgents/`, automatically launches Proximos for *any* user who logs into the Mac, including brand-new accounts, with no manual step required. The User Launch Agent has no such automation — Proximos must be opened manually by each user at least once before it can write its launch agent into that user's home folder. On a shared Mac with multiple accounts, this means the User Launch Agent setting alone will not cover a new user until they've launched Proximos themselves. * **Tamper resistance:** Because the System Launch Agent lives in `/Library/LaunchAgents/` and is owned by `root:wheel`, a standard (non-admin) user cannot modify or delete it. The User Launch Agent, by contrast, lives inside the user's own home directory and is owned by that user — meaning a non-admin user *can* delete or disable their own User Launch Agent if they choose to, since they have full write access to their own `~/Library/LaunchAgents/` folder. For environments where consistent, tamper-resistant persistence matters most, the System Launch Agent is the stronger choice. The User Launch Agent remains a convenient option for smaller deployments managed primarily through the settings plist rather than a separate MDM package. > You can deploy both system-level agents if you want the daily headless check alongside the persistent menu bar presence. In most environments, one or the other is sufficient. > **Note:** If a System Launch Agent is detected at `/Library/LaunchAgents/com.enlazo.proximos.plist`, the **Enable Proximos Launch Agent** checkbox in Settings → Main Settings is automatically grayed out and locked. The admin-deployed system agent already controls the app lifecycle and the user-level toggle is not editable. ### Launch Agent Conflict Resolution A potential misconfiguration to be aware of: if the **Enable Proximos Launch Agent** setting is turned on in the Proximos settings plist (creating a user-level launch agent at `~/Library/LaunchAgents/com.enlazo.proximos.plist`) and a System Launch Agent is also deployed at `/Library/LaunchAgents/com.enlazo.proximos.plist`, both agents will initially be present. Having two launch agents managing the same application simultaneously is redundant and can cause unpredictable restart behavior. Proximos handles this automatically through the **Proximos Launch Agent Manager**. On each launch, it checks whether a system-level launch agent is present. If one is detected, the Launch Agent Manager removes the user-level launch agent from `~/Library/LaunchAgents/` and defers full control to the system agent. The system-level launch agent always takes priority. To avoid this conflict entirely, the recommended approach is to choose one method and use it consistently across your fleet: * Deploy the **System Launch Agent PKG** via MDM and leave **Enable Proximos Launch Agent** set to `false` in your settings plist. * Or enable **Enable Proximos Launch Agent** in your settings plist for user-managed persistent operation, without deploying the system-level PKG. If you are transitioning from one approach to the other — for example, moving from user-level to system-level launch agents — Proximos Launch Agent Manager will clean up the user-level agent automatically once the system agent is installed. No manual removal is required. ### Disclaimer on User Tampering As described above, a non-admin user can delete or disable their own User Launch Agent, and any user with local administrator rights can remove a System Launch Agent, delete the Proximos application, or edit a non-managed settings plist directly. Proximos includes the protections described throughout this documentation — Managed Mode, the blocked application list, PPPC profiles, and the conflict resolution behavior above — but no software running on a Mac can fully prevent a user with sufficient privileges from tampering with it. If an employee deliberately disables, removes, or otherwise tampers with Proximos, its launch agents, or its configuration files to avoid update compliance, this is a personnel and policy matter rather than a software issue, and is outside of Enlazo Systems' control. We recommend organizations treat deliberate tampering with required compliance software the same way they would treat circumventing any other IT security control — typically as a matter for HR or IT policy enforcement.