Skip to main content

Deploy with Kandji

Use Kandji to deploy the Willow Scan Agent package and managed configuration profile to macOS devices.

Prerequisites​

  • Kandji admin access with permission to manage Library Items, Blueprints, custom apps, and custom profiles.
  • A pilot Blueprint or device group.
  • The macOS .pkg installer and .mobileconfig profile from the Willow AI Discovery setup flow.

Minimum requirements​

ComponentMinimum requirement
Kandji softwareKandji with Custom Apps and Custom Profiles. Kandji documents supported custom app uploads in Custom Apps Overview and .mobileconfig uploads in Custom Profiles Overview.
Target OSManaged macOS devices. This guide does not apply to Windows or Linux devices.
Willow filesThe macOS .pkg installer and .mobileconfig profile from Willow.
Device stateTarget Macs must be enrolled in Kandji and assigned to the Blueprint used for rollout.

Willow does not publish a separate minimum Kandji version. Use a currently supported Kandji release that can deploy custom apps and custom configuration profiles.

Expected outcome​

Target Macs receive the Willow managed configuration profile, install the Scan Agent package, and appear in AI Discovery after the next scan interval.

For browser-based AI visibility, deploy Willow Guard through a managed Chrome policy separately from the Scan Agent package. See Deploy Willow Guard Browser Extension.

Add the configuration profile​

  1. In Kandji, go to Library and add a Custom Profile Library Item.
  2. Upload the Willow .mobileconfig file.
  3. Name the profile clearly, such as Willow Scan Agent Configuration.
  4. Assign the profile to your pilot Blueprint.
  5. Save the Library Item.

Add the package as a custom app​

  1. In Kandji, go to Library and add a Custom App Library Item.
  2. Upload the Willow .pkg installer or a .zip that contains the package, depending on your Kandji packaging workflow.
  3. Name the app clearly, such as Willow Scan Agent.
  4. Assign it to the same pilot Blueprint as the configuration profile.
  5. Save and deploy the app.

Deploy the configuration profile before or with the package. If the package installs before the profile reaches the Mac, restart the agent after the profile arrives.

Verify on a Mac​

Run these commands on a scoped test Mac:

sudo profiles list -type configuration | grep -i willow
sudo launchctl print system/com.mcp-s-scan.agent
tail -n 50 /var/log/mcp-s-scan/agent-error.log

Then open AI Discovery in Willow and confirm the device appears with a recent last scan time.

Expand rollout​

After the pilot Blueprint reports successfully:

  1. Expand the custom profile assignment.
  2. Expand the custom app assignment.
  3. Monitor Kandji Library Item status and Willow AI Discovery device counts.

Roll back​

To remove the agent from a Mac, deploy this command through Kandji:

sudo /usr/local/bin/mcp-s-scan-uninstall.sh

Remove the configuration profile from the same scope if the device should stop reporting to Willow.

On this page