MDM profile

Set up rolle for your users with a Jamf or other MDM configuration profile. Preset and lock settings, add Identity Center portals and Entra ID tenants, and turn off self-updates.

A configuration profile for the com.getrolle.app preference domain sets up rolle for your users. The desktop app and the rolle command both read it. To install rolle itself, use rolle.pkg; see Managed Macs.

The profile has four keys. You can use any of them, in one profile or in several:

Jamf Pro

rolle publishes a custom schema for Jamf Pro, so you fill in a form instead of a property list:

1. In a computer configuration profile, add Application & Custom Settings → External Applications → Add.
2. Choose Custom Schema as the source. Enter com.getrolle.app as the preference domain.
3. Paste the schema from https://getrolle.com/mdm/com.getrolle.app.json.
4. Fill in the keys you need. Leave the others Not Configured.

You can also use Application & Custom Settings → Upload with one of the property lists on this page.

Turn off self-updates

rolle updates itself unless you turn that off. When root owns rolle.app, as after rolle.pkg, an update asks for an administrator to approve it. Turn self-updates off when you deliver every version yourself, through your MDM or a patch tool, or when your users cannot approve that prompt.

Set DisableUpdates to true. The app then does not check for updates and hides the Update button. In Settings, the Automatic updates switch is locked and says that your organization manages updates. rolle reads the key only from a configuration profile, so defaults write has no effect.

As a property list:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>DisableUpdates</key>
  <true/>
</dict>
</plist>

For another MDM, use a .mobileconfig with a payload of type com.getrolle.app. Replace the two UUIDs with your own (uuidgen):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  <key>PayloadIdentifier</key>
  <string>com.example.rolle</string>
  <key>PayloadUUID</key>
  <string>00000000-0000-0000-0000-000000000001</string>
  <key>PayloadDisplayName</key>
  <string>rolle</string>
  <key>PayloadScope</key>
  <string>System</string>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.getrolle.app</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadIdentifier</key>
      <string>com.example.rolle.updates</string>
      <key>PayloadUUID</key>
      <string>00000000-0000-0000-0000-000000000002</string>
      <key>DisableUpdates</key>
      <true/>
    </dict>
  </array>
</dict>
</plist>

Settings

Put the settings for your users in a Settings dictionary. rolle applies each value once, the next time the app or the rolle command reads its settings. The user can change it afterwards. When you change a value in the profile, rolle applies the new value again. If you remove a key and add it back later, rolle applies it again.

rolle ignores a key that is not in the table and a value of the wrong type. It clamps a value out of range the same way the settings screen does. Appearance stays with the user. For a login item, use your MDM’s managed login items.

Locked settings

To stop users from changing a setting, list its key in LockedSettings. A locked setting gets the profile’s value every time, the control in Settings is turned off and says that your organization manages the setting, and the CLI cannot change it either. A key in LockedSettings without a value in Settings locks nothing.

rolle checks the proxy and the CA bundle each time a user saves a setting. If a locked ProxyURL is not valid, or a locked CABundle file is missing on a Mac, every save of a setting fails on that Mac until the profile is fixed. Deploy the PEM file before you lock CABundle.

This profile turns off self-updates, sets the region and the role duration, and locks the proxy and the CA bundle:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>DisableUpdates</key>
  <true/>
  <key>Settings</key>
  <dict>
    <key>DefaultRegion</key>
    <string>eu-west-1</string>
    <key>AssumeRoleMinutes</key>
    <integer>240</integer>
    <key>ProxyURL</key>
    <string>http://proxy.example.com:3128</string>
    <key>CABundle</key>
    <string>/Library/Application Support/Example/corp-root.pem</string>
  </dict>
  <key>LockedSettings</key>
  <array>
    <string>ProxyURL</string>
    <string>CABundle</string>
  </array>
</dict>
</plist>

Integrations

Put the IAM Identity Center portals and Entra ID tenants of your organization in an Integrations array. Users then only sign in. rolle adds each one once. Users can rename it, remove it, and add their own integrations next to it. If a user removes one, rolle adds it again only when you change its entry in the profile. If the user has the same portal or tenant already, rolle keeps theirs and adds no copy. When you change the region of a portal, rolle updates the region of the user’s portal.

rolle skips an entry that misses a key that its type needs, that has a value of the wrong type, or whose start URL is not https. Google Cloud is not available: rolle uses the credentials of gcloud.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Integrations</key>
  <array>
    <dict>
      <key>Type</key>
      <string>aws-sso</string>
      <key>Alias</key>
      <string>example</string>
      <key>StartURL</key>
      <string>https://example.awsapps.com/start</string>
      <key>Region</key>
      <string>us-east-1</string>
    </dict>
    <dict>
      <key>Type</key>
      <string>azure</string>
      <key>Alias</key>
      <string>example-azure</string>
      <key>TenantID</key>
      <string>example.onmicrosoft.com</string>
    </dict>
  </array>
</dict>
</plist>

Where rolle reads the profile

rolle reads /Library/Managed Preferences/com.getrolle.app.plist and then the file for the current user in /Library/Managed Preferences/<user>/. The user’s file wins for each key. rolle uses a file only when root owns it and only root can write it. These are the files that macOS writes for installed profiles.