Deploying Screenproof to a managed fleet

Screenproof is a governed macOS screenshot app. Everything an admin controls is delivered through standard MDM: one signed PKG and a handful of configuration profiles.

The management surface

Screenproof reads policy from managed preferences in its own domain, app.screenproof, delivered as a com.apple.ManagedClient.preferences payload — the same custom-settings mechanism every macOS MDM supports.

• Every key is optional. Screenproof runs with safe defaults from install; profiles tighten policy on top. An empty profile is a valid deployment.
• Managed wins per key. Users can configure several keys themselves in Settings; any key your profile forces overrides the user's value and renders locked in Settings ("Managed by your organization"). Remove the key from the profile and the user's own value applies again.
• Blocklists and PII patterns are union keys. BlockedBundleIDs and PIIPatterns merge managed and user lists: users can always add their own blocks and detectors on top of the profile's, but can never remove or weaken profile-enforced entries.

Full key reference: schema.json. Or build a profile interactively with the Profile Creator.

Deployment order

Order matters — PKG first, then profiles:

1. PKG — installs /Applications/Screenproof.app and a per-user LaunchAgent (app.screenproof.agent, starts at each user's next login). Download: https://updates.screenproof.app/Screenproof-latest.pkg. Signed Developer ID Installer (Team S65X5KY399), notarized.
2. Managed preferences profile — your org's policy in the app.screenproof domain (blocklist, PII patterns, watermark, export destinations, license, updates).
3. Restrictions profile (optional) — allowScreenShot=false disables native screenshots fleet-wide; Screenproof keeps working. See Screen Recording & native capture.
4. PPPC deny profile (optional) — denies the Screen Recording TCC service to other named capture apps. Note: no profile can pre-grant Screen Recording to Screenproof — users approve it once. Same page as above.

Console guides

• MosylePKG + custom profile — the tenant these steps were validated on.
• Jamf ProConfiguration Profiles + package policy.
• KandjiCustom Profile + Custom App.
• IntuneCustom template profile + line-of-business PKG.
• AddigyMDM Profiles + Custom Software.

Topics

• Screen Recording permissionWhat MDM can and cannot do about TCC, and how to make Screenproof the only sanctioned capture path.
• Custom PII patternsWrite, test, and deploy your own regex detectors — with copy-paste examples.
• Fleet licensingDeliver the license in-profile with LicenseKey.
• UpdatesSparkle upgrades: silent, prompted, or pinned.
• Profile CreatorBuild a managed-preferences .mobileconfig in the browser.