Skip to main content
Deploy Runlayer hooks to macOS devices managed by Jamf Pro.
This guide requires Jamf Pro. Jamf Now and Jamf School have different script deployment capabilities.

​
Prerequisites

  • Jamf Pro admin access
  • Configured enrollment key from Runlayer (see below)
Enrollment keys allow devices to automatically register with Runlayer and obtain API credentials.Enrollment Keys List
1

Navigate to Enrollment Keys

Go to Settings in the Runlayer dashboard and select the Enrollment Keys tab
2

Create a New Key

Click + Create Enrollment KeyCreate Enrollment Key
3

Configure the Key

  • Name (required): Enter a descriptive name (e.g., “Production MDM”)
  • Description (optional): Add context about the key’s purpose
4

Copy the Key

Copy the generated key (starts with rl_enroll_) and store it securelyEnrollment Key Created
Enrollment keys are shown only once. Store them securely and treat them like passwords.

​
Deployment Steps

1

Generate the Script

Fill in your organization’s settings below to generate a customized deployment script.Jamf-specific configuration tips:
  • ENROLLMENT_USERNAME: Use a Jamf variable or extension attribute that provides the user’s identity. Common variables: $EMAIL, or a custom extension attribute.
  • ENROLLMENT_DEVICE_NAME: Use a Jamf variable or extension attribute that identifies the device. Common variables: $COMPUTERNAME, $SERIALNUMBER, or a custom extension attribute.
2

Upload to Jamf Pro

  • Navigate to Settings > Computer Management > Scripts
  • Click New
  • Enter a display name (e.g., “Runlayer Hooks”)
  • Paste the generated script contents
  • Set Priority to “After” (runs after other policies)
  • Save
3

Create a Policy

  • Navigate to Computers > Policies
  • Click New
  • Configure the policy:
    • General: Name it (e.g., “Deploy Runlayer Hooks”)
    • Scripts: Add your uploaded script
    • Scope: Select target computers or groups
    • Trigger: Choose execution trigger:
      • Recurring Check-in: For periodic execution
      • Login: Run when users log in
      • Enrollment Complete: Run on new device enrollment
    • Frequency: Set to Once per computer for initial deployment
4

Save and Deploy

Save the policy to begin deployment to target devices

​
Verification

1

Check Policy Status

Verify policy execution status in Jamf Pro
2

Verify in Runlayer

Confirm devices appear in Runlayer Analytics
3

Test Interception

Have a user trigger a shadow MCP tool call and verify it appears in audit logs

​
Log Locations

PlatformLog Location
macOS/var/log/runlayer-hooks.log

​
Exit Codes

CodeMeaning
0Success
1General failure (missing config, enrollment failed)
2Network failure
3Installation failure