Hi there, I have an osquery agent that customers use to track MacOs compliance. Usually most users use SSO authentication and the agent is registered/assigned to user email. That’s how we can identify them later. Now I want Global IT admin to be able to silently roll out the agent via MDM (e.g Jamf) and register the agent on behalf of users. But during silent installation, the agent would wait for user to sign in and it might take days to weeks for a large company. As work around, instead I want to pass parameters somewhere, something like registration token for company and email of employee to start monitoring immediately. I am not able to trigger the token based access afterwards, only see a way to save the key and email locally on device but this doesn’t seem normal to me. Has anyone ever worked on similar implementation or knows something? I would love to hear about best practices

There is a very active MacAdmins community that specifically helps with stuff like this. Two people I would suggest reaching out to are Sam Weiss and Oliver Lindsey... They manage a lot of developer support and partnerships. Plus at my time at jamf and after they have been amazingly awesome. But what you should probably look for is a term called AppConfig. It is the standard for most applications on how to configure a distributed app via MDM. That being said. Apple themselves have been starting to move away from suggesting AppConfig. So take some time to watch WWDC this year or catch the notes on it. I will DIE on the hill that apple will finally formally define AppConfigs replacement. ( AppConfig is a shared standard between a few MDM providers ).

@Grigory Emelianov If your agent relies on end user interaction (SSO login) but you need to skip interaction with the end user, then the only way i can see to pair the user to the device would be through an enrichment type integration. For example, if you had a system like an HRIS or IdP that tracks the device SN and user information, then you could correlate the SN coming from the osquery agent to the user information in the external system and then push that user information to your compliance app. That being said, you should check out this documentation: https://fleetdm.com/guides/foreign-vitals-map-idp-users-to-hosts#basic-article. I know its not vanilla osquery, but it might help you in your implementation.

Thank a lot @Kyle Pazandak, really great insights, very deep, I didn't do very deep research on AppConfig, thanks for sharing the doc. This is something I can get started with and will be monitoring for new release. @Dherder cheers - we do have the integration both in IDS and HRIS but honestly, the data source quality is limited by level of organization of users. They don't keep this type of data uptodate in HRIS/IDP. What I saw our competitor does is they suggest users to execute an MDM roll out a package using bash scripts in Jamf for every user. If user want, he can additionally pass in the bash script following:

user_email="name@example.com"

registration_key (assigned to each customer)="u810915aj8aqe9b4d46j00udhbptnbdqbnmbt504zhvfy34gyzhg"

What's not clear to me if they use this data only once to register and start somehow access token based authentication on behalf of user afterwards (seems impossible) or just save it in device somewhere and are using it all the time...

@Grigory Emelianov if you are using fleet to manage osquery, you can checkout https://github.com/fleetdm/fleet/blob/59c857c4e0a249335b66d19552712720d294d21e/docs/Contributing/set-up-custom-end-user-email.md

@Dherder thanks! this would require to build an agent for each users separately. Is there a way to have one signed agent for all users where the identity parameters are passed?