Deploy with MDM

Business and Enterprise include help deploying MacVisor through your MDM: email support with your MDM's name and what you're setting up. This page covers what you can set up ahead of time, the steps for Jamf Pro, Kandji and Intune, and what users still do themselves.

Before you start

Downloads:

• macvisor-background-items.mobileconfig
• macvisor-full-disk-access.mobileconfig
• macvisor-updates.mobileconfig
• macvisor-activate-license.sh
• macvisor-inventory-version.sh
• macvisor-inventory-license.sh

The profiles are unsigned. Upload them to your MDM as custom configuration profiles, scoped to the Macs (device or system level, not a user), and let it sign and deliver them.

Install the app

MacVisor is notarized by Apple and signed with the Developer ID of ScaleNinja Software LLP (team VXNWQ9H93X). Each version is published in two forms holding the same MacVisor.app:

Replace <version> with a version from the changelog, such as 27.2.0. What to give your MDM:

For Jamf Pro, package the app with Jamf's Composer: install MacVisor on a Mac you package on, drag MacVisor.app from /Applications into Composer's sidebar, check that the path shows /Applications/MacVisor.app, and build it as a PKG.

Approve background items

MacVisor runs a background service for each user and a network helper for the whole Mac, both registered from inside the app. Without approval, each user is asked to turn MacVisor on in System Settings → General → Login Items & Extensions, and the network helper needs an administrator's password.

macvisor-background-items.mobileconfig approves them ahead of time. It's a Managed Login Items payload (com.apple.servicemanagement) with one rule:

With it in place, the first launch registers both without asking the user or an administrator, and users can't turn them off in System Settings while the profile is installed.

Full Disk Access (optional)

Without Full Disk Access, macOS asks before a VM uses a folder in Desktop, Documents or Downloads, or a disk on another volume, and asks again for the VM runner. See Install for what each permission is for.

macvisor-full-disk-access.mobileconfig grants it with a Privacy Preferences Policy Control payload (com.apple.TCC.configuration-profile-policy, service SystemPolicyAllFiles) to the two parts of MacVisor that open those files:

Each entry carries MacVisor's code requirement (signed by ScaleNinja Software LLP, team VXNWQ9H93X, with a Developer ID certificate), so the grant applies only to genuine MacVisor builds and survives updates. Skip this profile if you'd rather users answer each prompt themselves.

Activate the license

Users can paste the key into Settings → License, or your MDM can activate it with macvisor-activate-license.sh.

MacVisor holds its license for the whole Mac in its network helper, and the mvz command reaches it through the background service of the user logged in at the Mac. So the script, run by your MDM as root, runs mvz license activate as that user, with the key on standard input. Before that it checks mvz license: if the Mac already has this key, it says so and changes nothing.

• The key, in this order: LICENSE_KEY at the top of the script (for Kandji and Intune, which pass no parameters), Jamf Pro's parameter 4, MACVISOR_LICENSE_KEY in the environment, or the first argument. Anyone who can read the script in your MDM can read the key.
• When: at login and on a recurring check-in. Until MacVisor has been opened on the Mac, so that its background service is registered, the script exits with status 4. With nobody logged in, it exits with status 1. Your MDM runs it again later, and once the Mac has the key the script just confirms it.
• Who can release it: an administrator, or the account that activated the license. When the script activates as a standard user, that user can deactivate the license on that Mac; other standard users can't.
• The licensing server: MacVisor checks the license with keys.scaleninja.com every few days, and a Mac keeps working for 30 days without reaching it. See Activation and checks.

mvz license on the Mac, or Settings → License, shows the edition, the masked key and the last check.

Updates and versions

MacVisor checks for updates once a day and, unless a user turns on automatic updates, lets them choose when to install. macvisor-updates.mobileconfig sets two managed preferences in the com.scaleninja.macvisor domain:

To keep Macs on one version, install the profile and deploy the version you chose, from its DMG or ZIP above. To move them on, deploy the next version the same way. Users can still choose Check for Updates…, but installing an update over an app your MDM installed asks for an administrator's password, so standard users stay on your version.

Before replacing the app, have users shut their VMs down rather than suspend them: see Updates.

Secure by default

What a new install does before anyone changes a setting:

• AI agents: each VM is closed to agents until a user opens it, at View or Control, and no agent can open one itself. See AI agents and MCP.
• Shared folders: none of the user's folders is shared with a VM until they choose one.
• Clipboard: shared both ways, but the Mac's clipboard goes to a VM only while its window is active, and what's copied in a VM reaches the Mac only when the user leaves its window. Users can turn it off for each VM. See Clipboard.
• Port forwards: a VM's own forwards listen only on this Mac (127.0.0.1 and ::1).
• USB devices: a device goes to a VM only when a user attaches it.
• No analytics: MacVisor sends no analytics, crash reports or usage data. A problem report leaves the Mac only when the user sends it. See the privacy policy.

These are defaults that users can change. Settings an administrator can lock through your MDM are on our roadmap.

Step by step

Jamf Pro

1. App: build a package with Composer (see Install the app), add it to Packages, and install it with a policy.
2. Profiles: in Configuration Profiles, Upload each .mobileconfig and scope it to the Macs.
3. License: add macvisor-activate-license.sh under Scripts, with parameter 4 labelled "License key". In a policy that runs it, put the key in parameter 4, trigger it at Login and Recurring Check-in, and set the frequency to Ongoing.
4. Inventory: add each inventory script as an Extension Attribute with the Script input type, as it is.

Kandji

1. App: add a Custom App, choose the ZIP type, upload MacVisor-<version>.zip, and set the unzip location to /Applications.
2. Profiles: add a Custom Profile for each .mobileconfig.
3. License: add a Custom Script with macvisor-activate-license.sh, with your key in LICENSE_KEY, set to run repeatedly, such as daily.

Microsoft Intune

1. App: add a macOS app (DMG), upload MacVisor-<version>.dmg, and give com.scaleninja.macvisor as the app's bundle ID. Set Ignore app version to Yes, unless you keep Macs on one version.
2. Profiles: create a macOS configuration profile from the Custom template for each .mobileconfig, on the device channel.
3. License: add a macOS shell script with macvisor-activate-license.sh and your key in LICENSE_KEY. Set Run script as signed-in user to No, the frequency to daily, and a few retries.
4. Inventory: add each inventory script as a macOS custom attribute of type String, with FORMAT=plain at its top.

Check it worked

• Profiles: System Settings → General → Device Management lists them, as does sudo profiles show -type configuration.
• Background items: sudo sfltool dumpbtm lists MacVisor and its items, with identifiers ending in com.scaleninja.macvisor.service and com.scaleninja.macvisor.adminhelper, team VXNWQ9H93X, and a disposition of enabled, allowed. In MacVisor, Assistant → Setup Assistant… shows Allow in the Background as done.
• Full Disk Access: the Setup Assistant shows it as done once a VM has started, because the background service and the VM runner each check it for themselves.
• License: mvz license, run as the user.
• Updates: defaults read "/Library/Managed Preferences/com.scaleninja.macvisor" shows SUEnableAutomaticChecks = 0.

Inventory

Two scripts report MacVisor in your MDM's inventory. Both print a Jamf Pro <result>; set FORMAT=plain at the top for an Intune custom attribute.

In the license line, the tier is one-time for Pro, subscription for Business and Enterprise, or trial. The lease date is how long the Mac keeps working without reaching the licensing server.

Network access

If your Macs reach the internet through a proxy or a firewall with an allow-list, MacVisor needs these hosts:

The VMs themselves reach the internet through the Mac, and need what any computer running their system does: Linux VMs their distribution's package repositories (and download.docker.com for Docker on Rocky Linux, AlmaLinux, Oracle Linux and CentOS Stream), macOS and Windows VMs Apple's and Microsoft's services.

AI sandboxes, if you use them, also reach the coding agent's installer (claude.ai, opencode.ai, aider.chat or github.com), your model provider's API through MacVisor's gateway on the Mac (api.anthropic.com, api.openai.com or openrouter.ai), and huggingface.co when a user downloads a local model. See AI sandboxes.

Standard users

MacVisor works for standard (non-administrator) accounts. With the profiles above:

• Installing: your MDM installs the app; nobody needs an administrator's password for the background items.
• Everyday use: making and running VMs, snapshots, custom networks and their firewall rules don't need an administrator.
• Administrator only: creating or deleting VLAN interfaces, and installing updates over the app your MDM installed.
• The license: the account that activated it, and administrators, can deactivate it. See Activate the license.

What users still do

• Local Network. macOS asks twice the first time MacVisor reaches a VM's address, once for the app and once for the VM runner. MDM has no setting for it. Users allow both. See Local Network.
• Microphone, the first time a VM set to use the Mac's microphone records from it. Every new Windows VM is, until its microphone is turned off in VM Settings → Sound.
• USB devices passed to a VM, which macOS may ask the user to allow.
• Their first VM, unless you create VMs for them with mvz from a script run as the user.

Removing MacVisor

1. On each Mac, as an administrator, choose Assistant → Uninstall MacVisor…. It removes the app, the background service, the network helper and its firewall rules, the command links and MacVisor's support files, and deactivates the license if the Mac is online. VMs and templates stay. See Uninstall.
2. In your MDM, remove the profiles and the app's deployment, so it isn't installed again.

Removing only the app leaves the background items and support files in place, and the license assigned to the Mac. For a removal you can script, email support.

License admin and support

Business and Enterprise include license admin by support: email support@scaleninja.com from the address on the order, with the key's last four characters, to:

• move the key between Macs beyond the usual limit of 3 moves in 30 days,
• get the list of Macs the key is active on,
• add Macs during the year.

Business support answers by email, with a first reply within 2 business days (IST), and no SLA. Enterprise support follows your agreement. See Pricing and licensing.