> For the complete documentation index, see [llms.txt](https://docs.we360.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.we360.ai/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/macos-mdm.md).

# MDM Overview

Deploy We360.ai macOS agent via MDM — Jamf, Mosyle, Kandji, Hexnode, Addigy, SimpleMDM, ManageEngine, and Microsoft Intune setup for mass endpoint monitoring.

The MyZen macOS installer is distributed as a standard `.pkg` file, which can be deployed through any MDM that supports macOS package distribution. This guide covers deployment steps, PPPC configuration profiles, and background items management for each supported MDM platform.

## App and Team Identifiers

{% hint style="info" %}
**Apple Developer Team ID:** `5KPT5U8WVR` (Zenstack Private Limited)

**Bundle Identifiers:**
{% endhint %}

| Variant  | Bundle ID          | Install Path                |
| -------- | ------------------ | --------------------------- |
| Standard | `ai.we360.MyZenV2` | `/Applications/MyZenV2.app` |
| Stealth  | `ai.zs.zs`         | `/usr/local/zs/zs.app`      |

{% hint style="info" %}
**Code Requirement (Stealth):**

{% code overflow="wrap" fullWidth="true" %}

```
identifier "ai.zs.zs" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "5KPT5U8WVR"
```

{% endcode %}

To extract the code requirement yourself, run on a Mac with the app installed:

```bash
codesign -dr - /usr/local/zs/zs.app    # Stealth
codesign -dr - /Applications/MyZenV2.app # Standard
```

{% endhint %}

## Important Points for Stealth App Install

{% hint style="danger" %}
**Preserve the organization-specific Stealth installer filename.** Its name is tied to your organization's license. Don't give a portal download or prepared installer a different name, and don't allow duplicate-download suffixes such as `(1)` or `(2)`. A generic public download must first receive your organization's filename or configuration through [Stealth installer preparation](https://github.com/zenstack-we360/documentation/tree/main/docs-we360-ai/it-ops/deployment/agent-deployment-hub/download-links.md#important-notes-for-stealth-installer-downloads).
{% endhint %}

{% hint style="info" %}
**MDM changed the PKG filename?** Check `PACKAGE_PATH` in `/tmp/zs-postinstall.log` against the original portal filename. If the names differ and tenant setup is missing, [provide the tenant configuration before the PKG installation](/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/filename-independent-config.md). This is a probable workaround for filename-related setup failures, not a general fix for all MDM issues.
{% endhint %}

## Stealth License Key Insertion Methods

The stealth agent needs your organization's license key at install time. There are four supported ways to provide it — pick the one your deployment tool can deliver:

| Method                        | How                                                                                                                                                                                                                                                                        | When to use                                                                                                   |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| **PKG filename** (default)    | Install the PKG with its original portal filename: `<license-key>.pkg`. The installer reads its own filename.                                                                                                                                                              | Portal downloads and any MDM that preserves the PKG filename.                                                 |
| **Environment variable**      | Run the installer with `ZS_KEY_CONFIG_BASE64_ENCODED` set to the license key (the same Base64 string as the installer filename, without `.pkg`). This takes the **highest precedence** — it wins over any filename or stale config on the machine.                         | Scripted installs where the PKG is downloaded under a generic name (Intune shell scripts, custom automation). |
| **Config file drop**          | Run the [JSON configuration script](/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/filename-independent-config.md) as root before installing the PKG. It writes `/Library/Preferences/zs.json` without relying on the deployed PKG filename. | MDMs that rename uploads and can run an ordered root script before package installation.                      |
| **Config file path variable** | Set `ZS_KEY_CONFIG=<path>` to point at a stealth config JSON stored at a custom location.                                                                                                                                                                                  | Advanced/custom provisioning only.                                                                            |

```bash
# Environment-variable method — no rename needed:
sudo ZS_KEY_CONFIG_BASE64_ENCODED='<license-key>' installer -pkg /tmp/zs-installer.pkg -target /
```

{% hint style="info" %}
`<license-key>` is always the Base64-encoded string that forms your stealth installer's filename as downloaded from the We360.ai portal (everything before `.pkg`). The environment-variable methods require a recent agent installer (v4.15 or later).
{% endhint %}

{% hint style="info" %}
**Restart may be required after MDM install.** When installing via MDM, by default our installer tries to start the apps immediately via `launchctl`. This should not fail unless there's some MDM or OS level controls blocking this.\
A **logout/login** or **system restart** may be required to circumvent such scenarios.
{% endhint %}

## macOS Permissions

MyZen requires several macOS privacy permissions. How they are granted depends on whether you use an MDM with PPPC support.

**With MDM (PPPC profile):**

* **Accessibility** — can be pre-approved via a PPPC configuration profile.
* **Browser URL Reading (AppleEvents/Automation)** — can be pre-approved via PPPC per browser. If not granted via PPPC, the user will be prompted to allow browser URL access the first time a browser is used.
* **Screen Recording** **(Optional)** — **cannot** be approved via any MDM. Apple does not allow Screen Recording to be granted programmatically. The end user must approve this manually.

**Without MDM:**

* All permissions will prompt the user at first use.

{% hint style="info" %}
**After granting Screen Recording permission**, the user must perform a **logout/login** or **restart the MyZen/zs app** for the permission to take effect.
{% endhint %}

## Configuration Profiles

Three `.mobileconfig` profiles are provided for MDM deployment. Deploy these **before** installing the agent PKG.

| Profile                     | Filename                                                                                                                                                              | Purpose                                                                                                                     |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| PPPC (Privacy Preferences)  | [`zs-pppc.mobileconfig`](https://github.com/zenstack-we360/documentation/tree/main/docs-we360-ai/it-ops/.gitbook/assets/zs-pppc.mobileconfig)                         | Pre-approves Accessibility, simplifies Screen Recording prompt, and grants browser Automation (AppleEvents) for URL reading |
| Background Items            | [`zs-background-items.mobileconfig`](https://github.com/zenstack-we360/documentation/tree/main/docs-we360-ai/it-ops/.gitbook/assets/zs-background-items.mobileconfig) | Suppresses "Background Items Added" notification and prevents users from disabling ZS services (macOS 13+)                  |
| Screen Capture (standalone) | [`zs-screen-capture.mobileconfig`](https://github.com/zenstack-we360/documentation/tree/main/docs-we360-ai/it-ops/.gitbook/assets/zs-screen-capture.mobileconfig)     | Standalone Screen Recording PPPC entry — use if you deploy screen capture permissions separately                            |

{% file src="/files/F4wj3GekG0pLPIyijl85" %}
PPPC profile — Accessibility and browser AppleEvents (URL reading)
{% endfile %}

{% file src="/files/vQWSnrWOCoVtSsKUhgVl" %}
Background Items profile — suppresses the macOS 13+ "Background Items Added" notification
{% endfile %}

{% file src="/files/PNdI6tJPySYtfgGLQ5Bh" %}
Screen Capture profile — standalone Screen Recording PPPC entry
{% endfile %}

{% hint style="warning" %}
**PPPC profiles must be delivered via MDM.** Manually installed `.mobileconfig` files (double-clicked by users) **cannot** grant TCC permissions — macOS may ignore TCC payloads from user-installed profiles for security reasons.
{% endhint %}

### Background Items (macOS 13+)

Starting with macOS 13 Ventura, macOS shows a "Background Items Added" notification when an application installs LaunchAgents or LaunchDaemons. Users can disable these from **System Settings > General > Login Items & Extensions**. The background items profile prevents this.

**Managed background items for MyZen:**

| Mode     | Launch Agent Label | Updater Daemon Label       |
| -------- | ------------------ | -------------------------- |
| Standard | `ai.we360.MyZenV2` | `ai.we360.MyZenV2-updater` |
| Stealth  | `ai.zs.zs`         | `ai.zs.zs-updater`         |

The provided profile uses a `TeamIdentifier` rule (`5KPT5U8WVR`) which covers all current and future LaunchAgents/Daemons signed by Zenstack.

### Install Locations

MDM administrators may need these paths for configuration profiles, detection rules, or post-install scripts.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Item</th><th>Standard App Path</th><th>Stealth App Path</th></tr></thead><tbody><tr><td>Application</td><td><code>/Applications/MyZenV2.app</code></td><td><code>/usr/local/zs/zs.app</code></td></tr><tr><td>Launch Agent</td><td><code>/Library/LaunchAgents/ai.we360.MyZenV2.plist</code></td><td><code>/Library/LaunchAgents/ai.zs.zs.plist</code></td></tr><tr><td>Updater Daemon</td><td><code>/Library/LaunchDaemons/ai.we360.MyZenV2-updater.plist</code></td><td><code>/Library/LaunchDaemons/ai.zs.zs-updater.plist</code></td></tr><tr><td>Config file</td><td><code>-</code></td><td><code>/Library/Preferences/zs.json</code></td></tr><tr><td>Install logs</td><td><code>/tmp/MyZenV2-*.log</code></td><td><code>/tmp/zs-*.log</code></td></tr></tbody></table>

## General Deployment Sequence

Regardless of which MDM you use, follow this order:

1. **Deploy the PPPC profile** (`zs-pppc.mobileconfig`) to target devices.
2. **Deploy the Background Items profile** (`zs-background-items.mobileconfig`) to target devices.
3. **Upload and deploy** the MyZen `.pkg` installer.
4. **Instruct end users** to grant Screen Recording permission when prompted, then logout/login.
5. **Verify** the agent appears online in the We360.ai dashboard.

> **Note:** The PKG is signed by Zenstack Private Limited (Team ID `5KPT5U8WVR`). You may need to add this to your allowed developers list.

***

## MDM Platform Guides

Step-by-step deployment instructions for each supported MDM platform live on their own pages. Every guide covers PKG upload, PPPC profile deployment, background items, and verification, plus any platform-specific caveats (for example, PKG filename handling for Stealth). Follow the [General Deployment Sequence](#general-deployment-sequence) above, then open the guide for your platform.

<table data-view="cards"><thead><tr><th>Platform</th><th>Notes</th><th data-card-target data-type="content-ref">Open</th></tr></thead><tbody><tr><td><strong>Jamf Pro</strong></td><td>Full PPPC builder and managed background items. Preserves the PKG filename.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/jamf-pro.md">Jamf Pro</a></td></tr><tr><td><strong>Jamf Now</strong></td><td>Blueprints and custom profiles (Plus plan). May rename the PKG — Stealth caveat.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/jamf-now.md">Jamf Now</a></td></tr><tr><td><strong>Addigy</strong></td><td>Agent-based software installs plus MDM profiles. Preserves the PKG filename.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/addigy.md">Addigy</a></td></tr><tr><td><strong>Mosyle Business</strong></td><td>Enterprise App path with native privacy-preferences builder.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/mosyle-business.md">Mosyle Business</a></td></tr><tr><td><strong>Kandji</strong></td><td>Custom App with audit script and native PPPC builder.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/kandji.md">Kandji</a></td></tr><tr><td><strong>Hexnode UEM</strong></td><td>Enterprise App and policy-based PPPC and background items.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/hexnode-uem.md">Hexnode UEM</a></td></tr><tr><td><strong>SimpleMDM</strong></td><td>Custom App and profiles via static Device Groups.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/simplemdm.md">SimpleMDM</a></td></tr><tr><td><strong>ManageEngine Endpoint Central</strong></td><td>Enrollment, PPPC policy, and a rename install command for the Stealth PKG.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/manageengine-endpoint-central.md">ManageEngine Endpoint Central</a></td></tr><tr><td><strong>Microsoft Intune (macOS)</strong></td><td>MDM profiles plus the management agent. Shell-script method recommended for Stealth.</td><td><a href="/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/microsoft-intune-macos.md">Microsoft Intune (macOS)</a></td></tr></tbody></table>

***

## Platform Comparison

| Feature                          | Jamf Pro | Jamf Now           | Addigy | Mosyle | Kandji | Hexnode | SimpleMDM | ManageEngine       | Intune                 |
| -------------------------------- | -------- | ------------------ | ------ | ------ | ------ | ------- | --------- | ------------------ | ---------------------- |
| PKG upload                       | Yes      | Yes (Plus)         | Yes    | Yes    | Yes    | Yes     | Yes       | Yes                | Yes (macOS app PKG)    |
| Preserves PKG filename           | Yes      | Verify             | Yes    | Yes    | Yes    | Yes     | Yes       | Yes                | Verify                 |
| Native PPPC builder              | Yes      | No                 | Yes    | Yes    | Yes    | Yes     | Yes       | Yes                | Yes (Settings catalog) |
| Custom .mobileconfig upload      | Yes      | Yes (Plus)         | Yes    | Yes    | Yes    | Yes     | Yes       | Yes                | Yes                    |
| Background Items Management      | Yes      | Via custom profile | Yes    | Yes    | Yes    | Yes     | Yes       | Via custom profile | Yes (Settings catalog) |
| Smart Groups / conditional logic | Yes      | No                 | Yes    | Yes    | Yes    | Yes     | No        | Yes                | Yes (dynamic groups)   |
| Uninstall via app assignment     | Yes      | Yes                | Yes    | Yes    | Yes    | Yes     | Yes       | Yes                | No (shell script)      |

***

## Supported Browsers for AppleEvents (URL Reading)

The PPPC profile (`zs-pppc.mobileconfig`) includes AppleEvents entries for the following browsers. This allows MyZen to read the active browser URL without triggering an Automation permission prompt for the user.

```
==================================================
       Browser Bundle ID & Codesign Report
==================================================

App:        Google Chrome
Bundle ID:  com.google.Chrome
Team ID:    EQHXZ8M8AV

App:        Safari
Bundle ID:  com.apple.Safari
Signing:    Apple system-signed

App:        Microsoft Edge
Bundle ID:  com.microsoft.edgemac
Team ID:    UBF8T346G9

App:        Firefox
Bundle ID:  org.mozilla.firefox
Team ID:    43AQ936H96

App:        Brave Browser
Bundle ID:  com.brave.Browser
Team ID:    KL8N8XSYF4

App:        Arc
Bundle ID:  company.thebrowser.Browser
Team ID:    S6N382Y83G

App:        Vivaldi
Bundle ID:  com.vivaldi.Vivaldi
Team ID:    4XF3XNRN6Y

App:        Opera / Opera GX
Bundle ID:  com.operasoftware.Opera / com.operasoftware.OperaGX
Signing:    Certificate leaf hash

App:        DuckDuckGo
Bundle ID:  com.duckduckgo.macos.browser
Team ID:    HKE973VLUW

App:        Chromium
Bundle ID:  org.chromium.Chromium
Signing:    Developer ID (no Team ID constraint)

App:        Orion (Kagi)
Bundle ID:  com.kagi.kagimacOS
Team ID:    TFVG979488

App:        Dia
Bundle ID:  company.thebrowser.dia
Team ID:    S6N382Y83G

App:        Aloha
Bundle ID:  com.alohabrowser.alohabrowser
Team ID:    DBVBNXAA55

==================================================
```

{% hint style="info" %}
If a browser used in your organization is not listed above, you can add an additional `AppleEvents` entry to the PPPC profile using the browser's bundle ID and code requirement. Run `codesign -dr - /Applications/BrowserName.app` to obtain the values.
{% endhint %}

***

## PPPC Profile Contents

Below is the full content of the `zs-pppc.mobileconfig` file for reference:

<details>

<summary>zs-pppc.mobileconfig (click to expand)</summary>

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDescription</key>
            <string>Configures Privacy Preferences for the ZS agent and supported browsers.</string>
            <key>PayloadDisplayName</key>
            <string>ZS Privacy Preferences</string>
            <key>PayloadIdentifier</key>
            <string>ai.zs.pppc</string>
            <key>PayloadOrganization</key>
            <string>Zenstack Private Limited</string>
            <key>PayloadType</key>
            <string>com.apple.TCC.configuration-profile-policy</string>
            <key>PayloadUUID</key>
            <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>Services</key>
            <dict>
                <key>Accessibility</key>
                <array>
                    <dict>
                        <key>Authorization</key>
                        <string>Allow</string>
                        <key>Identifier</key>
                        <string>ai.zs.zs</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                        <key>CodeRequirement</key>
                        <string>identifier "ai.zs.zs" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "5KPT5U8WVR"</string>
                    </dict>
                </array>
                <key>ScreenCapture</key>
                <array>
                    <dict>
                        <key>Authorization</key>
                        <string>AllowStandardUserToSetSystemService</string>
                        <key>Identifier</key>
                        <string>ai.zs.zs</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                        <key>CodeRequirement</key>
                        <string>identifier "ai.zs.zs" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "5KPT5U8WVR"</string>
                    </dict>
                </array>
                <key>AppleEvents</key>
                <array>
                    <!-- Entries for Chrome, Safari, Edge, Firefox, Brave, Arc, Vivaldi, Opera, DuckDuckGo, Chromium, Orion, Dia, Aloha -->
                    <!-- See the full file for all browser entries -->
                </array>
            </dict>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>ZS — Privacy Preferences</string>
    <key>PayloadIdentifier</key>
    <string>ai.zs.profile.pppc</string>
    <key>PayloadOrganization</key>
    <string>Zenstack Private Limited</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>F1E2D3C4-B5A6-9870-FEDC-BA0987654321</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>
```

</details>

<details>

<summary>zs-background-items.mobileconfig (click to expand)</summary>

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.servicemanagement</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadIdentifier</key>
            <string>ai.zs.servicemanagement</string>
            <key>PayloadUUID</key>
            <string>B2C3D4E5-F6A7-8901-BCDE-F12345678901</string>
            <key>PayloadDisplayName</key>
            <string>ZS — Managed Background Items</string>
            <key>Rules</key>
            <array>
                <dict>
                    <key>RuleType</key>
                    <string>TeamIdentifier</string>
                    <key>RuleValue</key>
                    <string>5KPT5U8WVR</string>
                    <key>Comment</key>
                    <string>Allow all ZS app background items</string>
                </dict>
            </array>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>ZS — Background Items Management</string>
    <key>PayloadIdentifier</key>
    <string>ai.zs.profile.servicemanagement</string>
    <key>PayloadOrganization</key>
    <string>Zenstack Private Limited</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>C3D4E5F6-A7B8-9012-CDEF-123456789012</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>
```

</details>

<details>

<summary>zs-screen-capture.mobileconfig (click to expand)</summary>

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDescription</key>
            <string>Screen Capture PPPC entry for the ZS agent.</string>
            <key>PayloadDisplayName</key>
            <string>ZS — Screen Recording Permission</string>
            <key>PayloadIdentifier</key>
            <string>ai.zs.pppc.screencapture</string>
            <key>PayloadOrganization</key>
            <string>Zenstack Private Limited</string>
            <key>PayloadType</key>
            <string>com.apple.TCC.configuration-profile-policy</string>
            <key>PayloadUUID</key>
            <string>D4E5F6A7-B8C9-0123-DEFA-234567890123</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>Services</key>
            <dict>
                <key>ScreenCapture</key>
                <array>
                    <dict>
                        <key>Authorization</key>
                        <string>AllowStandardUserToSetSystemService</string>
                        <key>Identifier</key>
                        <string>ai.zs.zs</string>
                        <key>IdentifierType</key>
                        <string>bundleID</string>
                        <key>CodeRequirement</key>
                        <string>identifier "ai.zs.zs" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "5KPT5U8WVR"</string>
                    </dict>
                </array>
            </dict>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>ZS — Screen Recording</string>
    <key>PayloadIdentifier</key>
    <string>ai.zs.profile.pppc.screencapture</string>
    <key>PayloadOrganization</key>
    <string>Zenstack Private Limited</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>E5F6A7B8-C9D0-1234-EFAB-345678901234</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>
```

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.we360.ai/deployment-and-it-ops/deploy/agent-deployment-hub/mass-deployment/macos-mdm/macos-mdm.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.