> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure ADE with TruU and Company Portal in Jamf

> Enroll new Macs through ADE with TruU and Company Portal, register Platform SSO, then install remaining apps with Jamf Pro macOS Onboarding.

## Overview

A new Mac enrolls through Automated Device Enrollment (ADE) with only TruU and Microsoft Company Portal, registers Platform SSO (PSSO) with Microsoft Entra ID, and only then installs its apps through Jamf Pro's native macOS Onboarding. The result mirrors the Intune "Welcome / Installation status" experience.

<ol />

Back
Next
of

Two Smart Groups do the waiting: **Pre-Stage TruU Device Setup** waits until Company Portal is in inventory, and **Pre-Stage TruU Device Configuration** holds every app until registration is complete.

## Prerequisites

Everything below must exist in Jamf Pro before a Mac is wiped or unboxed. Names are examples; use your own naming convention.

| Item | Where | Value / note |
| - | - | - |
| ADE assignment | Apple Business Manager | Macs assigned to your Jamf Pro MDM server and to the PreStage "Prestage TruU" |
| TruU packages | Jamf → Packages | TruU ADE Tracker, TruU Authenticator |
| Company Portal package | Jamf → Packages | Microsoft Company Portal (provides the Entra SSO extension, bundle ID `com.microsoft.CompanyPortalMac`) |
| Platform SSO profile | Jamf → Configuration Profiles | Microsoft Platform SSO profile for your Entra tenant. See [Enable macOS Platform SSO for Microsoft Entra ID with TruU in Jamf Pro](https://docs.truu.ai/docs/Deploy-Platform-SSO-TruU-JAMF.md) |
| TruU profiles | Jamf → Configuration Profiles | TruU MA Application Configuration, TruU Account Provisioning |
| Installomator script | Settings → Computer management → Scripts | "Installomator - Install App"; Parameter 4 = Installomator label |
| Extension Attribute | Settings → Computer management → Extension attributes | "PSSO Registration Status" (Phase 2) |
| Self Service | Settings → Self Service → macOS Onboarding | Enabled |
| Entra ID | Microsoft tenant | Platform SSO allowed for target users; MFA per conditional access |

## Phase 1: ADE PreStage enrollment with TruU

The PreStage installs only what registration needs: TruU and Company Portal. All other apps are held back until Platform SSO registration is complete.

1. Go to **Computers → PreStage Enrollments → Prestage TruU → Edit**.
2. **General:** confirm the target Macs are assigned (Scope tab) and skip Setup Assistant screens per your standard.
3. **Configuration Profiles:** attach these two:
   * TruU MA Application Configuration
   * TruU Account Provisioning
4. Attach the **Microsoft Platform SSO** profile here as well.
5. **Enrollment Packages:** attach exactly these three:
   * TruU ADE Tracker
   * TruU Authenticator
   * Company Portal
6. Remove any other app packages (browsers, Teams, VPN clients, etc.) from Enrollment Packages. They install from Onboarding policies after registration.
7. Save, reload, and verify the counts: 3 profiles, 3 packages.

## Phase 2: Wait for Company Portal, then register Platform SSO

Two Smart Groups gate the flow: the first waits for Company Portal, the second waits for a completed registration.

### 2a. Smart Group: Pre-Stage TruU Device Setup (waits for Company Portal)

1. **Computers → Smart Computer Groups → New** (or edit your existing PreStage group), name it **Pre-Stage TruU Device Setup**.
2. Criteria: **Enrolled via PreStage** is Prestage TruU **and** **Application Title** is `Company Portal.app`.
3. Save. A Mac joins only after Jamf inventory sees Company Portal installed.

Scope these items to this group:

| Item | Type | Purpose |
| - | - | - |
| Microsoft Platform SSO | Configuration profile | Also attached in the PreStage |
| TruU MA Application Configuration | Configuration profile | Also in the PreStage |

### 2b. User registers Platform SSO

1. Once the Platform SSO profile is active, macOS shows the **Registration Required** notification at login.
2. The user clicks it and signs in with their Entra ID credentials (plus MFA if required).
3. macOS registers the device in Entra ID and enables SSO.

### 2c. Registration check: Extension Attribute + post-registration policy

1. **Extension Attribute "PSSO Registration Status"** (Settings → Computer management → Extension attributes). A script that runs `app-sso platform -s` as the logged-in user at every inventory and reports Registered, Not Registered or No User.
2. **Policy "PSSO - Post-Registration Onboarding"**, triggers Login and Recurring Check-in, scoped to **Pre-Stage TruU Device Setup**. Its script does the same `app-sso` check. While not registered it does nothing; once `registrationCompleted : true`, it runs `jamf recon` and opens Self Service.

### 2d. Smart Group: Pre-Stage TruU Device Configuration

1. Criteria: member of **Pre-Stage TruU Device Setup** **and** **PSSO Registration Status** is `Registered`.
2. All Onboarding policies (Phase 3) are scoped to this group, so no app installs before registration.
3. Exclude **Pre-Stage TruU Device Setup** from any existing app policies scoped to All Computers (for example, a Teams update policy at recurring check-in) so they cannot install apps before registration.

## Phase 3: Installomator script and onboarding app policies

Each app installs from its own policy that runs the Installomator script with an app label, scoped to **Pre-Stage TruU Device Configuration**.

### 3a. Script

This is a custom wrapper script, not a built-in Jamf item. It downloads the open-source [Installomator](https://github.com/Installomator/Installomator) at run time and installs the app named in Parameter 4. If your Jamf Pro already has an Installomator script, use it and skip to 3b.

1. Go to **Settings → Computer management → Scripts → New**.
2. **General** tab: Display Name **Installomator - Install App**.
3. **Script** tab: paste the script below.
4. **Options** tab: Parameter 4 label `Installomator label`; Parameter 5 label `Installomator version (tag or branch, optional)`.
5. Save.

```bash Installomator - Install App theme={null}
#!/bin/bash
# Installomator - Install App (Jamf Pro wrapper)
# Parameter 4: Installomator label, e.g. googlechromepkg
# Parameter 5: Installomator git tag or branch (optional, default: main)

label="$4"
ref="${5:-main}"

if [[ -z "$label" ]]; then
  echo "No Installomator label in Parameter 4"
  exit 1
fi

tmp=$(mktemp -d)
url="https://raw.githubusercontent.com/Installomator/Installomator/${ref}/Installomator.sh"

if ! curl -fsSL "$url" -o "$tmp/Installomator.sh"; then
  echo "Download failed: $url"
  rm -rf "$tmp"
  exit 1
fi

chmod +x "$tmp/Installomator.sh"
"$tmp/Installomator.sh" "$label" DEBUG=0 NOTIFY=silent BLOCKING_PROCESS_ACTION=kill
rc=$?

rm -rf "$tmp"
exit $rc
```

`DEBUG=0` is required: the script on GitHub defaults to debug mode, which downloads but does not install. `NOTIFY=silent` hides Installomator's own pop-ups (Self Service onboarding shows progress), and `BLOCKING_PROCESS_ACTION=kill` closes a running copy of the app so the update can install. For production, set Parameter 5 to a release tag from the [Installomator releases page](https://github.com/Installomator/Installomator/releases) instead of `main`.

### 3b. Policies

For each app row: **Computers → Policies → New**. Execution Frequency **Once per computer**; add the Installomator script with Parameter 4 = the label; Scope = **Pre-Stage TruU Device Configuration**; Self Service = **enabled**.

| Order | Policy | Installomator label |
| - | - | - |
| 1 | Onboarding - Google Chrome | `googlechromepkg` |
| 2 | Onboarding - Microsoft Edge | `microsoftedge` |
| 3 | Onboarding - Microsoft Teams | `microsoftteamsnew` |
| 4 | Onboarding - Tailscale | `tailscale` |
| 5 | Onboarding - Microsoft OneDrive | `microsoftonedrive` |
| 6 | Onboarding - Microsoft Outlook | `microsoftoutlook` |
| 7 | Onboarding - Final Configuration and System Restart | No script: Maintenance → Update Inventory + Restart Options |

> [!NOTE]
>
> Add all other apps required during device setup (for example security agents, VPN clients, or line-of-business apps) as Onboarding policies the same way, and order them before the Final Configuration policy. Installomator has labels for most common apps; for apps without a label, upload the vendor .pkg to **Settings → Packages** and add it to the policy instead of the script. Scope any configuration profiles those apps need (system extensions, Full Disk Access, Wi-Fi) to **Pre-Stage TruU Device Setup** so they arrive before the installer runs.

**Final Configuration restart options:** no user logged in → restart immediately; user logged in → restart after a 5-minute notice. Run it only as the last Self Service onboarding step.

## Phase 4: Self Service macOS Onboarding and final restart

Jamf's native macOS Onboarding gives the user an Intune-style "Welcome / Installation status" screen listing each app as it installs.

1. **Settings → Self Service → macOS Onboarding → Edit**, set to **Enabled**.
2. Add a Welcome screen (company name, logo, short text such as "We're setting up your Mac").
3. Add an **Installation** step and select the Onboarding app policies in order.
4. Add **Onboarding - Final Configuration and System Restart** as the last item.
5. Save.
6. Onboarding starts when the user first opens Self Service. The post-registration policy (Phase 2c) opens Self Service right after registration, so the user lands on the onboarding screen.

## Testing and validation checklist

Wipe a test Mac and confirm each check in order.

1. Setup Assistant shows Remote Management and enrolls into Jamf Pro.
2. Only TruU ADE Tracker, TruU Authenticator and Company Portal install during setup.
3. The computer record shows membership in **Pre-Stage TruU Device Setup** after Company Portal installs.
4. The Microsoft Platform SSO profile installs during enrollment.
5. At first login the Registration Required notification appears; no other apps install.
6. The user signs in with Entra ID + MFA and registration completes.
7. `app-sso platform -s | grep -i registrationCompleted` returns `true`.
8. Extension Attribute **PSSO Registration Status** = Registered; the Mac is in **Pre-Stage TruU Device Configuration**.
9. Self Service opens to the onboarding screen; all app policies complete.
10. The Final Configuration policy updates inventory and restarts (5-minute notice if logged in).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.