Pre-install XFA with Jamf Pro
Deploy two things: the XFA package, and a configuration profile carrying your enrollment token. XFA reads the token when it starts and enrolls the signed-in user. There is no script. Pre-installation is an Enterprise feature.
XFA is made to be self-installed by the team you want to secure. They install it themselves after an invitation through Awareness, or at a login protected by Enforcement. For most organizations that is the whole rollout.
1. Upload the package
Download XFA.pkg and add it under Settings > Computer Management > Packages.
One package covers Apple Silicon and Intel Macs.
2. Upload the configuration profile
Open Integrations > Pre-install XFA through MDM > Jamf Pro in the XFA dashboard and download the configuration profile. It already contains your organization's enrollment token.
In Jamf Pro, go to Computers > Configuration Profiles, choose Upload, and select the file. Scope it to the same Macs that will receive the package.
Building the profile by hand instead
Create a profile with an Application & Custom Settings payload, using an external application with the preference domain com.xfa.desktop:
<dict>
<key>EnrollmentToken</key>
<string>TOKEN-FROM-XFA-DASHBOARD</string>
</dict>
EnrollmentToken is the key XFA reads. Email is an optional second key, for when the signed-in account's directory record does not carry the right address.
3. Create the policy
Create a computer policy with a Packages payload containing XFA.pkg.
| Setting | Value |
|---|---|
| Trigger | Login |
| Execution frequency | Once per computer |
| Scope | The Macs that should run XFA |
Login, not Recurring Check-In. Jamf runs check-in policies from a LaunchDaemon as root, which does not wait for anyone to be signed in, and XFA is installed for the person using the Mac. Its installer hands the application to whoever is at the console, so a package that lands on a Mac at the login window has no one to hand it to, and the result is an application owned by root that the user cannot run or update. The Login trigger means there is always someone there. Once per computer keeps it to a single install rather than one per sign-in.
Once per computer installs XFA a single time and then leaves it alone, which is what you want: XFA keeps itself up to date after that. Do not change the policy to Ongoing and scope it with a smart group that keys on the installed XFA version. Once XFA self-updates, its version no longer matches the packaged one, the Mac re-enters that group, and Jamf reinstalls the older packaged version on top of the newer one, on every check. If you want Jamf to reinstall XFA when someone removes it, scope with a smart group that keys on whether XFA is present at all, never on a version.
Deploy the profile before or with the package. If the package arrives first, XFA enrolls as soon as the profile lands and it next starts.
4. Verify
After Jamf reports the policy as completed, confirm that:
- the XFA icon appears in the signed-in user's menu bar; and
- the Mac appears for that user on the XFA Devices page.
If the Mac does not appear, read why from /tmp/xfa/xfa-enrollment.log on the device.
Deploy the token as a file instead of a profile
XFA also reads the token from /Library/Application Support/XFA/enrollment-token. Deploy that file with a policy if a profile does not suit your setup: it must be owned by root and not writable by anyone else, which is what a Jamf policy writes by default. The profile takes precedence.
Remove XFA
Remove the configuration profile first, or the Mac enrolls again from it the next time XFA starts. Then run xfa unenroll --organization-id <organization-id> as the signed-in user to remove the affiliation, and delete XFA.app if you want XFA gone as well. Leave it installed when the Mac still belongs to another organization: xfa enrollment-status answers that, with exit code 0 when an affiliation remains.
Complete removal
There is no xfa uninstall on macOS yet (the command is Linux-only), so a full teardown is manual. Deleting XFA.app alone leaves several items behind. To remove everything, quit XFA, then as the signed-in user:
launchctl bootout gui/$UID ~/Library/LaunchAgents/com.xfa.desktop.plist
sudo rm -rf /Applications/XFA.app
sudo rm -f /usr/local/bin/xfa
rm -f ~/Library/LaunchAgents/com.xfa.desktop.plist
sudo pkgutil --forget com.xfa.desktop
sudo rm -rf "/Library/Application Support/XFA"
That removes the application, the xfa symlink, the LaunchAgent (label com.xfa.desktop), the package receipt, and, for managed installs, /Library/Application Support/XFA/enrollment-token. Finally, delete the xfa item from the login Keychain in Keychain Access.