Deploying SentinelOne Profiles for Mac

In my previous post, I walked you through deploying SentinelOne on Mac devices using Kandji. Now I’ll highlight the profiles that you’ll require for the devices to make sure everything is running smoothly.

Most of these profiles are directly from S1 documentation. The one I had the most difficulty finding was to allow all notifications so that is a custom one created by me using the iMazing Profile Editor. Let’s jump in!

Why Configuration Profiles Matter

Before installing SentinelOne, you need to deploy five essential configuration profiles to each Mac device:

S1 - Service Management
S1 - Full Disk Access
S1 - Network Filtering
S1 - Network Monitoring
S1 - Notifications

These profiles grant SentinelOne the permissions it needs to monitor and protect your devices effectively. Skipping this step will most likely lead to issues down the road. For instance, if you don’t have the Network Filtering and Monitoring profiles installed prior to installing the SentinelOne PKG, you’ll most likely run into connectivity issues on the device.

Creating the Configuration Profiles

Below are the XML contents for each profile. You’ll need to save each one as a .mobileconfig file and upload it to Kandji. I recommend just copying and pasting the information into the TextEdit app on your Mac.

S1 - Service Management.mobileconfig

This profile manages components that run at startup, ensuring SentinelOne’s services are not removed.

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3
<plist version="1">
4
<dict>
5
    <key>PayloadDescription</key>
6
    <string>Manage components that run at start up</string>
7
    <key>PayloadDisplayName</key>
8
    <string>S1 - Service Management</string>
9
    <key>PayloadIdentifier</key>
10
    <string>2B752EEE-3A7D-4995-94C2-41532A4479E4</string>
11
    <key>PayloadOrganization</key>
12
    <string>Sentinel Labs, Inc.</string>
13
    <key>PayloadRemovalDisallowed</key>
14
    <true/>
15
    <key>PayloadScope</key>
16
    <string>System</string>
17
    <key>PayloadType</key>
18
    <string>Configuration</string>
19
    <key>PayloadUUID</key>
20
    <string>8F211DB0-7065-4A0D-8738-7277C7CDD384</string>
21
    <key>PayloadVersion</key>
22
    <integer>1</integer>
23
    <key>PayloadContent</key>
24
    <array>
25
        <dict>
26
            <key>PayloadType</key>
27
            <string>com.apple.servicemanagement</string>
28
            <key>PayloadIdentifier</key>
29
            <string>com.apple.servicemanagement.E01FDD5D-6953-4F89-AE9C-98EC6AF31483</string>
30
            <key>PayloadUUID</key>
31
            <string>E01FDD5D-6953-4F89-AE9C-98EC6AF31483</string>
32
            <key>Rules</key>
33
            <array>
34
                <dict>
35
                    <key>RuleType</key>
36
                    <string>LabelPrefix</string>
37
                    <key>RuleValue</key>
38
                    <string>com.sentinelone.</string>
39
                    <key>Comment</key>
40
                    <string>Prevent removal of SentinelOne Launch Agents and Launch Daemons</string>
41
                </dict>
42
                <dict>
43
                    <key>RuleType</key>
44
                    <string>BundleIdentifierPrefix</string>
45
                    <key>RuleValue</key>
46
                    <string>com.sentinelone.</string>
47
                    <key>Comment</key>
48
                    <string>Prevent removal of SentinelOne Launch Agents and Launch Daemons</string>
49
                </dict>
50
            </array>
51
        </dict>
52
    </array>
53
</dict>
54
</plist>

S1 - Full Disk Access.mobileconfig

This profile grants SentinelOne full disk access.

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3
<plist version="1.0">
4
<dict>
5
    <key>PayloadContent</key>
6
    <array>
7
        <dict>
8
            <key>PayloadDescription</key>
9
            <string></string>
10
            <key>PayloadDisplayName</key>
11
            <string>Privacy Preferences Policy Control</string>
12
            <key>PayloadIdentifier</key>
13
            <string>236FFBB3-159D-4A5F-B146-AAA7BBA11FF0</string>
14
            <key>PayloadOrganization</key>
15
            <string>Your Company</string>
16
            <key>PayloadType</key>
17
            <string>com.apple.TCC.configuration-profile-policy</string>
18
            <key>PayloadUUID</key>
19
            <string>236FFBB3-159D-4A5F-B146-AAA7BBA11FF0</string>
20
            <key>PayloadVersion</key>
21
            <integer>1</integer>
22
            <key>Services</key>
23
            <dict>
24
                <key>SystemPolicyAllFiles</key>
25
                <array>
26
                    <!-- SentinelOne Daemon -->
27
                    <dict>
28
                        <key>Allowed</key>
29
                        <integer>1</integer>
30
                        <key>CodeRequirement</key>
31
                        <string>anchor apple generic and identifier "com.sentinelone.sentineld" and (certificate leaf[field.1.2.840.113635.100.6.1.9] exists or certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
32
                        <key>Identifier</key>
33
                        <string>com.sentinelone.sentineld</string>
34
                        <key>IdentifierType</key>
35
                        <string>bundleID</string>
36
                        <key>StaticCode</key>
37
                        <integer>0</integer>
38
                    </dict>
39
                    <!-- SentinelOne Helper -->
40
                    <dict>
41
                        <key>Allowed</key>
42
                        <integer>1</integer>
43
                        <key>CodeRequirement</key>
44
                        <string>anchor apple generic and identifier "com.sentinelone.sentineld-helper" and (certificate leaf[field.1.2.840.113635.100.6.1.9] exists or certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
45
                        <key>Identifier</key>
46
                        <string>com.sentinelone.sentineld-helper</string>
47
                        <key>IdentifierType</key>
48
                        <string>bundleID</string>
49
                        <key>StaticCode</key>
50
                        <integer>0</integer>
51
                    </dict>
52
                    <!-- SentinelOne Shell -->
53
                    <dict>
54
                        <key>Allowed</key>
55
                        <integer>1</integer>
56
                        <key>CodeRequirement</key>
57
                        <string>anchor apple generic and identifier "com.sentinelone.sentineld-shell" and (certificate leaf[field.1.2.840.113635.100.6.1.9] exists or certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
58
                        <key>Identifier</key>
59
                        <string>com.sentinelone.sentineld-shell</string>
60
                        <key>IdentifierType</key>
61
                        <string>bundleID</string>
62
                        <key>StaticCode</key>
63
                        <integer>0</integer>
64
                    </dict>
65
                </array>
66
            </dict>
67
        </dict>
68
    </array>
69
    <key>PayloadDescription</key>
70
    <string>Provides access to all disk to SentinelOne processes</string>
71
    <key>PayloadDisplayName</key>
72
    <string>S1 - Full Disk Access</string>
73
    <key>PayloadIdentifier</key>
74
    <string>0F7D9FAD-1257-402C-A942-354723513881</string>
75
    <key>PayloadOrganization</key>
76
    <string>Sentinel Labs, Inc.</string>
77
    <key>PayloadRemovalDisallowed</key>
78
    <true/>
79
    <key>PayloadScope</key>
80
    <string>System</string>
81
    <key>PayloadType</key>
82
    <string>Configuration</string>
83
    <key>PayloadUUID</key>
84
    <string>5961E10D-A589-4A7E-9790-8F1C55511014</string>
85
    <key>PayloadVersion</key>
86
    <integer>1</integer>
87
</dict>
88
</plist>

S1 - Network Filtering.mobileconfig

This profile authorizes automatic validation of SentinelOne network filtering.

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3
<plist version="1.0">
4
<dict>
5
    <key>PayloadContent</key>
6
    <array>
7
        <dict>
8
            <key>FilterDataProviderBundleIdentifier</key>
9
            <string>com.sentinelone.network-monitoring</string>
10
            <key>FilterDataProviderDesignatedRequirement</key>
11
            <string>identifier "com.sentinelone.network-monitoring" and anchor apple generic and (certificate leaf[field.1.2.840.113635.100.6.1.9] exists or certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
12
            <key>FilterGrade</key>
13
            <string>firewall</string>
14
            <key>FilterPackets</key>
15
            <false/>
16
            <key>FilterSockets</key>
17
            <true/>
18
            <key>FilterType</key>
19
            <string>Plugin</string>
20
            <key>PayloadDisplayName</key>
21
            <string>Web Content Filter Payload</string>
22
            <key>PayloadIdentifier</key>
23
            <string>14DDD990-E2D8-4DD1-8CC6-72FEFB5F252B</string>
24
            <key>PayloadOrganization</key>
25
            <string>Sentinel Labs, Inc.</string>
26
            <key>PayloadType</key>
27
            <string>com.apple.webcontent-filter</string>
28
            <key>PayloadUUID</key>
29
            <string>14DDD990-E2D8-4DD1-8CC6-72FEFB5F252B</string>
30
            <key>PayloadVersion</key>
31
            <integer>1</integer>
32
            <key>PluginBundleID</key>
33
            <string>com.sentinelone.extensions-wrapper</string>
34
            <key>UserDefinedName</key>
35
            <string>SentinelOne Extensions</string>
36
        </dict>
37
    </array>
38
    <key>PayloadDescription</key>
39
    <string>Authorizes SentinelOne Network Filter automatic validation.</string>
40
    <key>PayloadDisplayName</key>
41
    <string>S1 - Network Filtering</string>
42
    <key>PayloadIdentifier</key>
43
    <string>7889BE15-9387-4CDD-B2D7-D57B65EDA1E5</string>
44
    <key>PayloadOrganization</key>
45
    <string>Sentinel Labs, Inc.</string>
46
    <key>PayloadRemovalDisallowed</key>
47
    <true/>
48
    <key>PayloadScope</key>
49
    <string>System</string>
50
    <key>PayloadType</key>
51
    <string>Configuration</string>
52
    <key>PayloadUUID</key>
53
    <string>2C480E0F-AA21-420F-8BC8-0E1AC975BC51</string>
54
    <key>PayloadVersion</key>
55
    <integer>1</integer>
56
</dict>
57
</plist>

S1 - Network Monitoring.mobileconfig

This profile enables automatic loading of SentinelOne’s system extension for network monitoring.

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3
<plist version="1.0">
4
<dict>
5
    <key>PayloadContent</key>
6
    <array>
7
        <dict>
8
            <key>AllowUserOverrides</key>
9
            <true/>
10
            <key>AllowedSystemExtensions</key>
11
            <dict>
12
                <key>4AYE5J54KN</key>
13
                <array>
14
                    <string>com.sentinelone.network-monitoring</string>
15
                </array>
16
            </dict>
17
            <key>PayloadDescription</key>
18
            <string></string>
19
            <key>PayloadDisplayName</key>
20
            <string>System Extensions</string>
21
            <key>PayloadIdentifier</key>
22
            <string>1BDD5153-6C81-4E0F-B409-1C321FF5E251</string>
23
            <key>PayloadOrganization</key>
24
            <string>Sentinel Labs, Inc.</string>
25
            <key>PayloadType</key>
26
            <string>com.apple.system-extension-policy</string>
27
            <key>PayloadUUID</key>
28
            <string>1BDD5153-6C81-4E0F-B409-1C321FF5E251</string>
29
            <key>PayloadVersion</key>
30
            <integer>1</integer>
31
        </dict>
32
    </array>
33
    <key>PayloadDescription</key>
34
    <string>Enables automatic loading of SentinelOne System Extension.</string>
35
    <key>PayloadDisplayName</key>
36
    <string>S1 - Network Monitoring</string>
37
    <key>PayloadIdentifier</key>
38
    <string>C957C35F-004C-4CF4-B075-9CAE5739081B</string>
39
    <key>PayloadOrganization</key>
40
    <string>Sentinel Labs, Inc.</string>
41
    <key>PayloadRemovalDisallowed</key>
42
    <true/>
43
    <key>PayloadScope</key>
44
    <string>System</string>
45
    <key>PayloadType</key>
46
    <string>Configuration</string>
47
    <key>PayloadUUID</key>
48
    <string>67BEF468-52BF-4DC9-96E2-2CCF1FEA127E</string>
49
    <key>PayloadVersion</key>
50
    <integer>1</integer>
51
</dict>
52
</plist>

S1 - Notifications.mobileconfig

Lastly, this profile forces acceptance of all notifications from the SentinelOne agent.

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3
<plist version="1.0">
4
<dict>
5
    <key>PayloadDisplayName</key>
6
    <string>S1 - Notifications</string>
7
    <key>PayloadDescription</key>
8
    <string>Forces notifications for SentinelOne Agent</string>
9
    <key>PayloadIdentifier</key>
10
    <string>S1-Notification-Profile.AC0826C1-CBE8-4FD1-9FD3-2E8963CEF670</string>
11
    <key>PayloadOrganization</key>
12
    <string>Sentinel Labs, Inc.</string>
13
    <key>PayloadScope</key>
14
    <string>System</string>
15
    <key>PayloadType</key>
16
    <string>Configuration</string>
17
    <key>PayloadUUID</key>
18
    <string>4C1C0E79-8E7F-4443-8245-89C10A615E6D</string>
19
    <key>PayloadVersion</key>
20
    <integer>1</integer>
21
    <key>PayloadEnabled</key>
22
    <true/>
23
    <key>TargetDeviceType</key>
24
    <integer>5</integer>
25
    <key>PayloadContent</key>
26
    <array>
27
        <dict>
28
            <key>PayloadDisplayName</key>
29
            <string>Notifications</string>
30
            <key>PayloadIdentifier</key>
31
            <string>com.apple.notificationsettings.406D4B22-BE3A-4361-8C7B-B8ECE25BC8D6</string>
32
            <key>PayloadType</key>
33
            <string>com.apple.notificationsettings</string>
34
            <key>PayloadUUID</key>
35
            <string>2EA2BDB3-83CE-40DB-B3DF-33BD0094F0DF</string>
36
            <key>PayloadVersion</key>
37
            <integer>1</integer>
38
            <key>NotificationSettings</key>
39
            <array>
40
                <dict>
41
                    <key>AlertType</key>
42
                    <integer>1</integer>
43
                    <key>BadgesEnabled</key>
44
                    <true/>
45
                    <key>BundleIdentifier</key>
46
                    <string>com.sentinelone.SentinelAgent</string>
47
                    <key>CriticalAlertEnabled</key>
48
                    <true/>
49
                    <key>GroupingType</key>
50
                    <integer>0</integer>
51
                    <key>NotificationsEnabled</key>
52
                    <true/>
53
                    <key>ShowInCarPlay</key>
54
                    <false/>
55
                    <key>ShowInLockScreen</key>
56
                    <true/>
57
                    <key>ShowInNotificationCenter</key>
58
                    <true/>
59
                    <key>SoundsEnabled</key>
60
                    <true/>
61
                </dict>
62
            </array>
63
        </dict>
64
    </array>
65
</dict>
66
</plist>

Uploading Profiles to Kandji

Here’s how to get these profiles into Kandji:

Create the .mobileconfig Files: -Copy each XML content into a plain text editor like TextEdit on your Mac.
- Save the file with the exact name provided, ending with .mobileconfig (e.g., S1 - Service Management.mobileconfig).
Upload to Kandji:
- Log in to your Kandji dashboard.
- Navigate to Library > Add New > Configuration Profile.
- Upload each .mobileconfig file.
Assign Profiles to Devices:
- Add the profiles to the relevant Blueprints or Assignment Maps.
- Ensure these profiles are deployed before installing SentinelOne.

Important Notes

Profiles Must Be Installed First: The audit script from my previous post checks for these profiles. If they’re not installed, the SentinelOne installation won’t proceed.
Reboot Required: After installing SentinelOne and the profiles, it’s highly recommended that users restart their Macs. If you don’t do this you’ll most likely run into an error in the S1 dashboard that shows that S1 isn’t fully installed.
All-In-One Script: There’s a combined script on GitHub from Kandji, but it’s a little outdated and Kandji no longer has it publicly available. I haven’t tested it but if you’d rather have a single profile handle this you can give it a try. I personally recommend using the profiles and scripts provided here for the most reliable results.

Wrapping Up

I hope I was able to help you out a little on getting S1 properly deployed for your Mac fleet. As always, if you have suggestions or improvements, feel free to share them. Collaboration is key in our field, and together we can find better ways to manage our Mac environments.

Make sure you Subscribe to my Substack to get the latest updates from me.