Deploying Switchboard
Team seats, managed preferences, offline licences and the permissions a managed Mac still needs.
The current build requires macOS 26. Install the signed release at /Applications/Switchboard.app; its engine and helpers are embedded. Verify the .pkg signature and notarization before deploying. A developer build is not a signed business release.
Your MDM #
In Jamf Pro, upload the .pkg as a package and assign an installation policy or PreStage. Put managed keys in a computer configuration profile for com.payablesdesk.switchboard; use a separate PPPC payload.
In Kandji, use a Custom App item for the .pkg and a Custom Profile for managed settings. Verify the assigned Blueprint includes both before enrolling a pilot Mac.
In Mosyle, use the macOS application installation policy for the .pkg and a custom configuration profile for settings and PPPC. Confirm assignments with a test user.
In Intune, add a macOS line-of-business .pkg app and assign it to the target group. Use Settings Catalog where supported or a custom mobileconfig for the app's managed preferences; do not confuse the app's bundle ID with the engine's PPPC ID.
The full deployment guide and example profiles list the keys. These console workflows need acceptance testing against your MDM's current version.
Preferences and licences #
Both processes read the app domain com.payablesdesk.switchboard. Team keys (SkipWelcome, LicenceFile, AIAPIKey, UpdateChannel, TeamLibraryURL) work with any team licence. The rest are Business keys, including AgentApprovalFloor, AgentExposeNewMacros, AgentExtensionToolsAllowed and AuditLogDirectory; on a Team licence they are ignored and Settings › Account lists them. SkipWelcome does not grant permissions. AIAllowed, RelayAllowed, iCloudSyncAllowed, SharingAllowed, ShellStepsAllowed and MCPAllowed control their named features; ExtensionAllowlist restricts extensions.
Use UpdateChannel=none when IT deploys updates. stable and beta select public feeds. A managed AIAPIKey is readable in the profile by users who can inspect it; use a secure per-device delivery process and never place a real key in an example profile.
An owner/admin downloads a signed team file from Account > Team. Deliver base64 of the complete file as LicenceFile, or import it in Settings > Account. The file ends 30 days after the paid period and must be replaced on renewal. It cannot be revoked remotely.
Sign-in and permissions #
Online people use their own email or company sign-in. SSO is in Team; SCIM and "SSO required" are in Business; the SSO guide covers provider setup and the owner fallback.
The engine bundle ID is com.payablesdesk.switchboard.engine. PPPC requirements must match the actual signed release. Accessibility can be granted by a suitable profile; protected permissions such as Screen Recording may still require a user's consent. Follow the permission prompts for the macros your team uses.
During offboarding remove the managed/imported licence file on offline Macs. Keep the customer's library unless data deletion is explicitly authorized.