> For the complete documentation index, see [llms.txt](https://docs.we360.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.we360.ai/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/manageengine-endpoint-central.md).

# ManageEngine Endpoint Central

Deploy the We360.ai MyZen macOS agent with ManageEngine Endpoint Central, including the PKG rename install command for Stealth.

ManageEngine Endpoint Central (formerly Desktop Central) is part of the Zoho ManageEngine suite and supports macOS MDM enrollment, app deployment, and configuration profiles.

**Step 1 — Enroll macOS Devices**

Before deploying apps or profiles, devices must be MDM-enrolled:

1. Log in to **ManageEngine Endpoint Central** (cloud: `endpointcentral.manageengine.com`, or your on-premise URL).
2. Navigate to **MDM > Enrollment > Apple Enrollment**.
3. Ensure your **Apple Push Notification (APNs)** certificate is valid and uploaded.
4. Choose an enrollment method:
   * **Open Enrollment Link** — share a URL with users to self-enroll.
   * **Apple Business Manager (ABM)** — for zero-touch automated enrollment.
   * **Email Invitation** — send enrollment invitations to users.
5. Enrolled devices will appear under **MDM > Inventory > Devices**.

**Step 2 — Deploy PPPC Profile (Before PKG)**

**Option A — Built-in macOS PPPC Policy (recommended):**

ManageEngine Endpoint Central has a native **macOS PPPC Policy** builder under its configuration management:

1. Navigate to **Configuration > macOS PPPC Policy**.
2. Click **Create Collection** (or **Add Configuration**).
3. Fill in:
   * **Collection Name:** e.g., "zen-apps-access-grants" (internal reference)
   * **Description:** "Allow permissions of Accessibility and per browser grants"
   * **Category:** macOS PPPC Policy
   * **Platform:** Mac
4. Under the first app entry, configure the **ZS agent**:
   * **Identifier:** `ai.zs.zs`
   * **Code sign requirement:** `identifier "ai.zs.zs" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "5KPT5U8WVR"`
   * **Static code validation:** No
   * **Allowed permissions:** Accessibility
   * **Other permissions:** User Controlled
5. Add **browser entries** for AppleEvents (URL reading). Click **Add** for each browser:
   * **Google Chrome:**
     * Identifier: `com.google.Chrome`
     * Code sign requirement: `identifier "com.google.Chrome" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV`
     * Static code validation: No
   * **Safari:**
     * Identifier: `com.apple.Safari`
     * Code sign requirement: `identifier "com.apple.Safari" and anchor apple`
     * Static code validation: No
6. Click **Save**.
7. Navigate to **Targets** and select the target scope (Remote Office, custom groups, or individual devices).
8. Click **Deploy** / **Associate**.
9. Check the **Execution Status** — devices should show "Succeeded" after next check-in.

**Option B — Custom profile upload:**

1. Navigate to **Configuration > Profiles & Policies > macOS**.
2. Click **Create Profile** and select **Custom Configuration**.
3. Upload `zs-pppc.mobileconfig`.
4. Click **Save** and associate with target groups/devices.

**Step 3 — Deploy Background Items Profile**

1. Navigate to **MDM > Configuration > Profiles & Policies**.
2. Click **Create Profile** and select **macOS**.
3. Name: e.g., "ZS Background Items".
4. Select **Custom Configuration** as the payload type.
5. Upload `zs-background-items.mobileconfig`.
6. Click **Save**.
7. Associate with the same target groups/devices as the PPPC profile.

**Step 4 — Upload and Deploy the PKG**

{% hint style="danger" %}
**ManageEngine renames uploaded PKG files internally.** The stealth installer's filename contains the encoded license key, so a rename breaks installation. You **must** use a custom installation command that renames the file back to the original before running `installer`. See the installation command below.
{% endhint %}

1. Navigate to **Software Deployment > Packages > Add Package**.
2. Select **Mac** as the platform.
3. Fill in:
   * **Application Name:** e.g., "zs-mac" (internal reference only)
   * **Version:** Current version (e.g., "4.x")
   * **Vendor:** `ai.zs`
   * **Package License Type:** Commercial
   * **Path Type:** "This computer (used across multiple remote offices)"
4. Upload **two files**:
   * The MyZen `.pkg` installer (e.g., `zs.pkg`)
   * The uninstallation script (`remove_myzenv2_Version3.sh`) — download this from the We360.ai admin portal
5. Set the **Installation Command** to rename the file back to its original name before installing:

   ```bash
   mv "./zs.pkg" "./<CUSTOM_INSTALLER_PREFIX>.pkg" && installer -pkg "./<CUSTOM_INSTALLER_PREFIX>.pkg" -target "/"
   ```

   Replace `<CUSTOM_INSTALLER_PREFIX>` with the **exact original filename** of your stealth PKG (without the `.pkg` extension). This is the filename as downloaded from the We360.ai portal.
6. Set the **Uninstallation Command** to:

   ```bash
   /bin/sh remove_myzenv2_Version3.sh
   ```
7. Click **Save**.
8. Navigate to **Software Deployment > Deploy** and create a new deployment configuration.
9. Select the package and target the same groups/devices as your profiles.
10. Deploy.

{% file src="/files/FiA6hwqTgyo7JMJ48Jwn" %}
ManageEngine Endpoint Central — Package configuration reference (PDF)
{% endfile %}

{% file src="/files/HF2nwFjOnS8z8Qv9yYlf" %}
ManageEngine Endpoint Central — PPPC policy configuration reference (PDF)
{% endfile %}

**Step 5 — Verify Deployment**

1. Navigate to **MDM > Inventory > Devices** and select a target device.
2. Check the **Profiles** tab — both PPPC and Background Items profiles should show as **Installed**.
3. Check the **Apps** tab — the MyZen app should show as **Installed**.
4. Ask the end user to **logout/login** or **restart** for the agent to start.
5. Verify the endpoint appears online in the **We360.ai dashboard** at `portal.we360.ai`.

{% hint style="info" %}
**Cloud vs. on-premise:** ManageEngine Endpoint Central supports both cloud and on-premise deployments. The navigation paths above apply to both. Ensure your instance has the **macOS MDM module** enabled (it is a separately licensed module in some editions).
{% endhint %}

{% hint style="warning" %}
**APNs certificate renewal:** Your Apple Push Notification certificate must be renewed annually. If it expires, MDM communication with all macOS/iOS devices will break. Set a calendar reminder 30 days before expiration. Navigate to **MDM > Enrollment > Apple Enrollment > APNs Certificate** to check the expiry date.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.we360.ai/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/manageengine-endpoint-central.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.