Automox Canopy
You Run the MDM.Canopy Runs the Patching.
Automox Canopy connects to the MDM you already run and patches what it can't reach, from Apple Silicon Macs to Linux, servers, and 600+ third-party apps.
What is Canopy?
Automox Canopy is an API integration with the MDM you already run: Jamf Pro or Intune. It lets Automox silently patch Apple Silicon Macs using the Bootstrap Token your MDM already holds.
That token is the whole story. Apple gates silent OS updates on Apple Silicon behind it, and only an MDM can hold one. The Automox agent patches nearly everything on a Mac but can't reach that token. No agent-based tool can.
Canopy closes the gap without changing who does what. Automox decides which updates to deploy and when. Your MDM authorizes them. Automox isn't becoming an MDM, and you're not migrating off yours. Apple Silicon Macs patch like everything else in your fleet.
How it works
Connect
Plug into the MDM you already run
Canopy connects to Jamf Pro, Intune, or Apple Business through an API-based integration. No new infrastructure and no migration, included at no added cost for Automate Essentials and Enterprise customers.
Control
Extend policy automation to Apple Silicon Macs
Canopy uses your MDM's escrowed Bootstrap Token to patch Apple Silicon Macs through the same policy automation Automox already runs on the rest of your fleet. Automox never needs MDM authority of its own.
Cover
Keep everything else covered the way Automox always has
Windows, macOS, Linux, and servers stay patched by Automox, along with more than 600 third-party titles your MDM was never built to reach.
Built for confidence, not blind trust
Guided setup for each MDM, with clear status indicators for connected, error, and last sync
Per-Mac visibility into which Macs are ready for silent updates and which need attention
No MDM authority required on the Automox side. Canopy works through the access your MDM already has
What you can do with Canopy
Patch Apple Silicon Macs silently, without chasing manual OS updates
See exactly which Macs are ready for Bootstrap Token patching and which aren't
Keep Windows, Linux, and server patching running the way it always has
Cover more than 600 third-party titles your MDM doesn't touch
Connect Jamf Pro or Intune today, with Apple Business coming soon
See how Canopy works with your MDM
Canopy connects differently depending on the MDM you run.
FAQs
Is Automox becoming an MDM?
No. Automox manages endpoints through an agent. MDM is a different model: agentless management through the MDM protocol, which is what Jamf, Intune, and Apple Business do. Canopy connects Automox to the MDM you already run so it can reach the one thing that requires MDM-protocol authority: the Bootstrap Token for silent OS updates on Apple Silicon.
What is a Bootstrap Token and why does Apple Silicon patching require it?
The Bootstrap Token is a cryptographic key that Apple's MDM protocol uses to authorize silent OS updates on Apple Silicon Macs. Only a tool enrolled as an MDM can escrow and use it – agent-based tools like Automox can't access it independently. Canopy solves this by connecting to your MDM's API to use the Bootstrap Token your MDM already holds, enabling silent OS updates without Automox becoming an MDM.
Does Canopy replace the Automox agent?
No. The Automox agent stays on every device and continues to handle third-party app patching, Windows and Linux patching, and policy automation. Canopy is an additional connector that gives the agent access to Apple Silicon OS patching through your MDM — it doesn't replace or modify how the agent works on everything else.
Why now?
Apple Silicon locked non-MDM tools out of silent OS updates. Canopy closes that specific gap by working through the MDM authority you already have, rather than asking you to adopt a new one.
What does Canopy cost?
Connecting your MDM and patching through it is included in your existing Automox tier. There's no added cost and no procurement conversation required to get started.
I already get OS patching from my MDM. Why do I need Canopy?
Your MDM patches the OS family it manages, and Apple Silicon Macs still require hands-on work for silent updates. Neither Jamf nor Intune covers Linux, and neither covers your Windows or Linux servers or the 600+ third-party titles already installed on your endpoints. Canopy brings all of that together, through the MDM you already run.
Which MDMs does Canopy support?
Canopy connects to Jamf Pro and Intune today, since they're the most widely used.
Do I need to migrate away from my current MDM to use Canopy?
No. Canopy is explicitly designed to work alongside the MDM you already run. There's no migration, no replacement, and no new infrastructure required. It connects to Jamf Pro or Intune through an API integration and is included at no added cost for Automox Automate Essentials and Enterprise customers.
How do I know this will keep working?
Canopy shows per-endpoint status for every connection. If your Bootstrap Token state changes, you'll see it. If a patch fails, you'll see why.
