){kind=logo}
Automox sends an update command to your mobile device management (MDM) platform. But you still need to know whether the Mac installed the update.
Automox Canopy connects Automox to Jamf Pro or Microsoft Intune so macOS update policies run through your MDM. On Apple Silicon Macs, silent OS updates rely on the Bootstrap Token escrowed with the connected MDM. Canopy is in limited beta.
Where the update stopped
Pedro Morales worked on Canopy's backend, including an Automox Worklet™ that calls the connected MDM's API to start an update. Early in development, the team could run a policy but had no way to see what happened next.
"We had no visibility on when it runs or what it said," Pedro says.
So the team built an internal tool that uses the Model Context Protocol (MCP) to read the underlying script logs. And those logs exposed bugs the team hadn't been able to see. The team then brought the same log visibility into its console tooling. Support and Engineering can read what a script logged without separate internal tools.
That visibility mattered fast. Commands were reaching the MDM, but the Macs weren't receiving OS updates. The logs helped explain why. The team traced it to an enrollment issue, corrected it, and checked patch delivery afterward.
Even so, troubleshooting still required checking both the policy logs and the Mac's update state.
Checking access during setup
Facundo Zarate built the connection between Canopy and your MDM environment. Credentials could authenticate but still lack permission to perform the operations Canopy needs.
Facundo added a small, read-only request to the connection check. The MDM's response helps identify missing permissions during setup, before you attempt a patch.
"It would've been simpler to just accept the login and move on, but that would've hidden the real problem," Facundo says. "The customer would hit it weeks later. It's much harder to figure out what went wrong then. Nobody really notices when it works. But it saves someone a pretty frustrating afternoon."
A test environment for MDM workflows
Henry Ponce built the frontend for MDM setup, policy management, and permission flows with the Automox Product team. Those screens needed a way to exercise the backend during development; but running them against a production-like MDM meant risking invalid test data with every single run.
So Henry's team added backend support for a stubbed MDM URL: a test substitute for the real service. That gave the team an isolated sandbox to run the full set of MDM and policy workflows without touching anything real. Confirming actual patch delivery still requires tests against a real MDM and enrolled Macs; the stub speeds up development, it doesn't replace verification.
Henry sums up what that unlocks for customers in the limited beta:
"We delivered a foundational capability that customers can use immediately," he says of Canopy. "That opens the door to future policies."
What you can use today
Your connected MDM delivers the macOS update. The Automox agent continues to handle third-party patching, Windows and Linux patching, and policy automation. Creating a Canopy policy doesn't require you to write or edit a script.
If you already manage Macs through Jamf Pro or Intune, the Canopy documentation covers setup, required permissions, and policy management.
What's next for Canopy
Pedro wants to extend Canopy to platforms where Automox can't install an agent.
"I think the ability for Automox to be agentless is a pretty big deal," Pedro says. "I think our agent is great. But there are many platforms that are managed by an MDM. We can't just write an agent – think iOS or Android, for example. Canopy will make Automox a lot more useful."
"Canopy has amazing potential, and it's only the first of many steps," Pedro says. "This opens the floodgates for customers to creatively request more Worklets."
Support for iOS and Android isn't part of this release. Canopy currently offers macOS update policies through Jamf Pro and Intune.
Sources
Canopy MDM Integration – Setup, macOS policy scope, required permissions, and Apple Silicon requirements
Automox Canopy – Limited beta status, supported MDMs, and plan inclusion
Use secure token, bootstrap token, and volume ownership in deployments – Apple's description of what the Bootstrap Token authorizes on Apple Silicon Macs
Frequently asked questions
No. Canopy adds MDM-based macOS update policies and extends Automox to MDM-enrolled Macs. The agent continues to handle third-party patching, Windows and Linux patching, and policy automation.
Jamf Pro and Microsoft Intune. The documentation lists Jamf School and Jamf Now as unsupported.
The Mac must be enrolled in the connected MDM, with its Bootstrap Token escrowed there. A successful connection test alone doesn't establish that each Mac meets those requirements.
Not for Automate Essentials and Enterprise customers. Canopy is included in those plans at no added cost.
No. This release covers macOS update policies through Jamf Pro and Intune.
)
)
)
)