Addigy includes built-in MDM functionality and strongly recommends using it alongside the Addigy Agent for the best experience. However, if your organization is already using a third-party MDM provider, you can still install and run the Addigy Agent — you'll just need to handle a few configurations manually that Addigy's MDM would otherwise handle automatically.
What Addigy MDM Handles Automatically
When you enroll a device into Addigy's MDM, Addigy automatically approves the necessary system permissions (PPPC profiles) for the Addigy Agent and its integrations to function properly. If you're using a third-party MDM, you'll need to deploy these permission profiles yourself to ensure the agent is fully functional.
Additionally, the following Addigy features are only available through an MDM solution. If you are not using Addigy's MDM, these will need to be managed through your third-party MDM provider or will be unavailable:
- MDM Commands: Remote Lock, Remote Wipe, Restart Device, Shutdown Device, Rotate FileVault Key, Enable/Disable Lost Mode, Lost Mode Location, Set Wallpaper via MDM, Clear Device Passcode, Clear Restrictions Passcode, List Provisioning Profiles, Refresh Cellular Plans, Request/Stop AirPlay, and any new MDM commands added via the API or UI
- Device Settings: All configurations found under Catalog > Device Settings
- Automated Device Enrollment (ADE)
- Apple Apps (Apps & Books)
How to Deploy Addigy's PPPC Profiles via a Third-Party MDM
To ensure the Addigy Agent functions correctly on managed devices, you'll need to download Addigy's default PPPC profile and deploy it through your MDM provider before or alongside installing the agent.
- In Addigy, navigate to the Add Devices page.
- Expand the Install the Agent-Only section.
- Click Download Profile to download the
.mobileconfigfile. - Upload and deploy the profile to your devices via your third-party MDM solution.
Note: This profile grants the minimum necessary system permissions for the Addigy Agent to operate without triggering end-user permission prompts. It should be deployed to all devices that will run the Addigy Agent.
Frequently Asked Questions
Can I use Addigy without enrolling devices into Addigy's MDM?
Yes. The Addigy Agent can run on devices managed by a third-party MDM. However, several Addigy features — including MDM commands, Device Settings, Automated Device Enrollment, and Apple Apps — require an MDM solution and will not be available through Addigy alone in this setup.
Do I need to build my own PPPC profile, or can I use Addigy's?
You can use Addigy's pre-built default PPPC profile, available for download from the Add Devices page. If your organization has specific security requirements, you can also build a custom PPPC profile — the downloaded profile can serve as a reference for the required permissions.
What happens if I don't deploy the PPPC profile?
Without the PPPC profile, macOS will prompt end users to manually approve system permissions for the Addigy Agent. This can interrupt agent functionality and create a poor experience for end users. Deploying the profile silently grants these permissions in advance.
Error when importing through a different MDM vendor: "the key 'CodeRequirement' has an invalid value. (NSPOSIXErrorDomain): 22"
Addigy leverages an MDM setting that is sometimes refused by other MDM vendors because it is not within Apple's own developer documentation. However, the MDM key is fully functional, and we use it to allow the Remote Desktop permission for our Splashtop implementation.
If you are encountering this or a similar error when attempting to import Addigy's default MDM profiles, try removing this key from the payload. To do so, follow these steps:
- Open the downloaded .mobileconfig file in iMazing Profile Editor
- Go to the Privacy Preferences Policy Control tab, and scroll all the way to the bottom
- Remove the only option from the Remote Desktop section by clicking it, then selecting the minus button
- Save the profile, then try importing into your MDM provider again
If import errors persist, there may be logic in the third-party MDM that is taking issue with otherwise valid keys. In any case, please reach out to our support team if errors continue, and we can try to diagnose whether there may be any other problematic settings being flagged.