Configure Versa SASE with JAMF Pro for IOS and MacOS

Create a PLIST File 

Create a file that contains the key-value pairs for your configuration. Use a plain text editor or a dedicated .plist editor to create this file. Save it with a .plist extension (for example, versa_sase_config.plist).

For each configuration parameter, enter a key and corresponding value, as shown in the example below. Replace the variables with values with your actual environment.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>device_id</key>
    <string>$JSSID</string>
    <key>device_name</key>
    <string>$COMPUTERNAME</string>
    <key>user_id</key>
    <string>$EMAIL</string>
    <key>fqdn</key>
    <string><your-portal-fqdn></string>
    <key>enterprise_name</key>
    <string><your-enterprise-name></string>
    <key>managed_device</key>
    <true/>
    <key>default_browser</key>
    <false/>
    <key>is_versa_root_ca_required</key>
    <false/>
    <key>skip_onboarding_screens</key>
    <true/>
    <key>disable_dns_proxy</key>
    <false/>
    <key>log_level</key>
    <string>Verbose</string>
    <key>fail_close_allowed_ips</key>
    <array>
        <string>192.124.249.120/32</string>
    </array>
</dict>
</plist>

For more information about variables used by Jamf Pro, see the Jamf Pro documentation.

Upload the Versa SASE Package

Before you create a policy or configuration profiles, upload the Versa SASE package to Jamf Pro.

1. In Jamf Pro, click Settings > Computer Management > Packages.
   
   
2. Click + New.
3. Click Upload.
4. Enter a display name for the package.
5. Upload the Versa SASE macOS package.
   
   
6. Click Save.

Create a Policy

To install the Versa SASE package on target devices, you must create a policy in Jamf Pro.

1. In Jamf Pro console, navigate to Computers > Policies.
2. Click + New.
3. Under General, configure the following fields:

   Field	Description
   Display name	Enter a descriptive name for the policy
   Trigger	Select the trigger — for example, Login or Recurring Check-in
   Execution frequency	Select the required frequency

   
   
4. In the left menu, select Packages.
5. Click Configure.
6. Click Add in the corresponding row to the Versa SASE package you uploaded.
7. Click Scope.
8. Click + Add, and then select the target devices or groups.
   
   
9. Click Save.

Enable Enrollment

To allow users to enroll their devices, enable user-initiated enrollment in Jamf Pro:

1. In your Jamf Pro Pro console, click Settings > Global > User-Initiated Enrollment.
2. Verify that enrollment is enabled.

Enroll the Device

To enroll your device, open your JAMF enrollment URL, for example, https://versa.jamfcloud.com, and complete the following steps:

1. Open https://<your-jamf-url>/enroll in a browser.
2. Log in with corporate credentials.
3. Click Enroll.
4. Install the MDM profile in System Settings.
5. Click Approve to approve management.

Verify Enrollment

To confirm a device is enrolled, click Computers > Search Inventory and then search for the device. The enrolled macOS device displays in the inventory.

Post-Deployment Behavior (v7.7.0) (MacOS)

After deployment and first launch, the following permissions are automatically approved with MDM:

• Registration
• Notifications
• Network extension
• System extension

The following permissions require manual user approval:

• Allow local networks
• Allow location services

Create a Configuration Profile (IOS)

1. Navigate to Devices > Configuration Profiles > New.
   
   
2. Under the General section, enter information for the following fields:
   
   
    

   Field	Description
   Display Name	Enter a descriptive name.
   Level	Set to Device Level.
   Distribution Method	Select Install Automatically or Make Available in Self Service.

3. Click Save.

Configure Notifications for the Versa SASE Client

1. Navigate to Devices > Notifications > +Add.
2. In the App Name field, enter Versa SASE Client.
3. Select Versa SASE Client. The Bundle ID field populates automatically.
4. Choose whether to Enable or Disable notifications:
   • Enable—Users see the "Allow/Don't Allow Notifications" prompt after installation.
   • Disable—Users do not see this prompt after installation.
      
   
5. Click Save.

   Note: Notification pre-configuration works only on supervised devices.

Configure IOS VPN Profile

Add or modify VPN settings within your configuration profile as follows:

1. Search for VPN in the payload search box.
2. Click the VPN payload to open its settings.
3. Configure the following fields:
   
   

   Field	Description
   Connection Name	Enter the name displayed in VPN settings on the device.
   VPN Type	Select VPN (for DTLS).
   Connection Type	Select SSL.
   Identifier	Enter the following value: com.versa.saseclientcatalyst
   Server	Enter your Versa gateway FQDN. For example, acme.poc.versanow.net.
   Provider Bundle Identifier	Enter the following value: com.versa.saseclientcatalyst

4. Click Save.

Deploy IOS App (App Store or In-House .ipa)

IOS apps must be added from the Mobile Device Apps section in Jamf Pro.

1. Navigate to Mobile Device Apps > New.
   
   
2. Select the app source:
   • App Store App—Search for "Versa SASE Client." Click Add. The app name, version, and bundle identifier are populated automatically.
     
     
   • In-House App—Upload the .ipa file.
3. Set the Distribution Method to Install Automatically / Prompt Users to Install.
   
   
4. Optionally, enable Remove app when MDM profile is removed.
5. Click the Scope tab and select the target devices, groups, or users.
   
   
6. In the App Configuration section, add the following plist XML:
   
   

   <dict>
       <key>device_id</key>
       <string>$UUID</string>
       <key>fqdn</key>
       <string>replace with your portal FQDN</string>
       <key>enterprise_name</key>
       <string>replace with your enterprise name</string>
       <key>user_id</key>
       <string>$EMAIL</string>
       <key>device_name</key>
       <string>$DEVICENAME</string>
       <key>managed_device</key>
       <true/>
       <key>default_browser</key>
       <true/>
       <key>is_versa_root_ca_required</key>
       <true/>
   </dict>

7. Click Save. The application is pushed to the specified users and devices. Users receive an install prompt on their device.
   
   
8. Tap Install.

IOS Enrollment Methods

Before uploading or assigning the application, you must enroll devices in Jamf Pro. The following table describes the available enrollment methods:

Post-Deployment Behavior (v7.7.0) (IOS)

After deployment and launching the app, the following permissions are automatically approved through MDM:

• Registration
• Notifications—This prompt is skipped if Notifications are pre-configured in the configuration profile; applicable only to supervised devices.
• Allow VPN—This prompt is skipped if VPN settings are already defined in the configuration profile.
• Allow Local Networks—This prompt can be avoided if the device name is specified in the plist file (use $DEVICENAME for the device_name key).

The following permission still requires manual user approval:

• Allow Location Services

DTLS Profile Behavior on IOS

In DTLS-based SSL VPN profiles on iPhone and iPad, the On Demand option does not appear. This means users cannot manually enable or disable On Demand from the VPN settings. This is expected behavior for DTLS profiles on iOS.

Key-Value Pairs

The following table lists every key-value pair required for in-house apps that integrate with the Jamf Certificate SDK. All keys are case-sensitive.

Jamf Pro Variable Substitution

Several key values support Jamf Pro's variable substitution feature. When the app configuration is deployed to a device, Jamf Pro automatically replaces each variable token with the real value for that specific device or user. The following variables are commonly used in certificate configurations:

• $MOBILEDEVICEAPPINVITE—App invitation token unique to the device and app.
• $MANAGEMENTID—Device management identifier (Jamf Pro 11.5.1 and later; supports account-driven enrollment).
• $UDID—Device UDID (Jamf Pro 11.5.0 and earlier).
• $SERIALNUMBER—Device serial number.
• $USERNAME—Username of the user assigned to the device in Jamf Pro.
• $DEVICENAME—Name of the device as recorded in Jamf Pro.
• $JAMF_SIGNATURE_com.jamf.config.certificate-request—Cryptographic signature for the certificate request payload.

Device Identifiers

The device key (com.jamf.config.device.udid) accepts two different variable tokens depending on your Jamf Pro version:

• Jamf Pro 11.5.1 and later—Use $MANAGEMENTID. This token supports both account-driven enrollment and device enrollment, making it the preferred identifier going forward.
• Jamf Pro 11.5.0 and earlier—Use $UDID. This token provides the hardware UDID of the device.

Jamf Pro Server URL Identifier

The value for com.jamf.config.jamfpro.url must be the complete URL of your Jamf Pro server. Include all of the following elements:

• Protocol—Always https://.
• Fully Qualified Domain Name (FQDN)—For example, jamfpro.example.com.
• Port—Include the port if your server uses a non-standard port (for example, :8443). Omit the port if your server uses the standard HTTPS port 443.
• Trailing slash—Append a trailing / at the end of the URL.

Example: https://jamfpro.example.com:8443/

Certificate Request Signature

The signature key-value pair provides a security layer that prevents unauthorized modification of the certificate request. The workflow is as follows:

• When the managed app configuration is deployed, Jamf Pro generates a cryptographic signature over the certificate request fields.
• The signature is injected into the app configuration using the variable token $JAMF_SIGNATURE_com.jamf.config.certificate-request.
• When the in-house app submits a certificate request, Jamf Pro verifies the signature before forwarding the request to AD CS.
• If the signature is missing or does not match, Jamf Pro rejects the request and no certificate is issued.