diff --git a/docs/semgrep-guardian/enterprise-deployment.mdx b/docs/semgrep-guardian/enterprise-deployment.mdx index 4604ed5aed..6acd9bb49e 100644 --- a/docs/semgrep-guardian/enterprise-deployment.mdx +++ b/docs/semgrep-guardian/enterprise-deployment.mdx @@ -193,6 +193,99 @@ These are community-maintained templates and may be unsupported or incorrect. Yo + + + Deploy a custom OS setting by uploading a configuration profile. + + + + Save the following as `semgrep-guardian.mobileconfig`, then replace the placeholder values: set `PayloadIdentifier` and `PayloadOrganization` to match your organization, and generate a fresh `PayloadUUID` for both the profile and the payload it contains. + + + ```xml semgrep-guardian.mobileconfig + + + + + PayloadDisplayName + Claude Code – Semgrep Guardian Plugin Settings + PayloadDescription + Enforces the Semgrep Guardian plugin enable/disable policy. + PayloadIdentifier + com.yourorg.com + PayloadOrganization + yourorg + PayloadScope + System + PayloadType + Configuration + PayloadUUID + DA9306A3-D913-47D0-95D9-0594D39CFE76 + PayloadVersion + 1 + PayloadContent + + + PayloadDisplayName + Claude Code Marketplace Settings + PayloadIdentifier + B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F + PayloadType + com.apple.ManagedClient.preferences + PayloadUUID + B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F + PayloadVersion + 1 + PayloadContent + + com.anthropic.claudecode + + Forced + + + mcx_preference_settings + + + enabledPlugins + + semgrep@claude-plugins-official + + + + + + + + + + + + ``` + + + + In the FleetDM UI, go to **Controls > OS settings > Configuration profiles**, select the team you want to target in the team dropdown, then click **Add profile** and upload `semgrep-guardian.mobileconfig`. FleetDM signs the profile for you. + + + Set the profile's targets to the hosts or labels that should receive Guardian. FleetDM applies the profile to all macOS hosts in the selected team unless you scope it by label. + + + FleetDM reports each host as **Verified**, **Verifying**, **Pending**, or **Failed**. Confirm your target hosts reach **Verified** before rolling out more widely. + + + + If you manage FleetDM with GitOps instead of the UI, add the profile under the `controls` key in your team YAML: + + ```yaml + controls: + apple_settings: + configuration_profiles: + - path: ../lib/macos/profiles/semgrep-guardian.mobileconfig + ``` + + Use `labels_include_any`, `labels_include_all`, or `labels_exclude_any` alongside `path` to scope the profile by label. If you later replace the uploaded file, the replacement must keep the same `PayloadIdentifier` and `PayloadDisplayName`. For more information, see FleetDM's [Configuration profiles](https://fleetdm.com/guides/custom-os-settings) guide. + + Deployment recommendations: