macOS - Tray Notification - Customize Trusted Message

What the macOS tray notification branding Worklet does

This Automox Worklet™ sets the branding text that the Automox agent displays in its tray notifications on macOS endpoints. The Worklet drives the agent's own command-line interface to apply the change, so the footer text updates without restarting the agent or signing the user out. The result is an organization-specific footer on every notification the agent surfaces, from patch reminders to FixNow actions.

The Worklet checks for the agent tray at /Library/Application Support/Automox/agent-ui.app or /Library/Application Support/Automox/agent-ui before attempting any change. When the tray is present, it executes /usr/local/bin/amagent notifications set_branding_message --message "<your text>" to install the new footer string. The amagent CLI accepts up to 75 characters of branding text and rejects longer strings with a non-zero exit.

The default footer reads "Managed by your IT Administrators," which is a generic placeholder. Replace it with your company name, the IT team that owns the fleet, a help desk URL, or a Slack channel reference so end users immediately know who is behind the notification. Set the BRANDING_TEXT variable at the top of remediation.sh to the string you want to deploy.

Why enforce a branded tray notification footer

macOS users learn to be wary of unexpected system notifications. A tray notification that reads "Managed by your IT Administrators" gives no signal whether the prompt came from corporate IT, a managed service provider, an MDM, or a phishing imitation. Users dismiss the notification, open a help desk ticket to confirm it is legitimate, or ignore the patch window the agent was trying to open.

A branded footer labels every Automox notification with a string the user already recognizes – their organization, their help desk, or their support channel. The agent notification footer can reset in two predictable ways: a fresh amagent install ships the stock string, and an agent upgrade can overwrite the configured value on certain release tracks. Running this Worklet on a schedule re-applies the branding string on every endpoint that has the tray installed, so freshly imaged MacBooks, reinstalled agents, and new-hire laptops pick up the configured footer on the next policy run.

How macOS tray notification branding works

1. Evaluation phase: The Worklet tests for the presence of the Automox agent tray by checking two install paths, /Library/Application Support/Automox/agent-ui.app (the app bundle layout) and /Library/Application Support/Automox/agent-ui (the older binary layout). If either path exists, the endpoint is flagged for remediation with exit code 1. If neither path exists, the agent tray is not installed, notification branding is not applicable, and the Worklet exits 0 without remediation.

2. Remediation phase: The remediation script reads the BRANDING_TEXT variable, then verifies the amagent CLI at /usr/local/bin/amagent. It calls amagent notifications set_branding_message --message "<branding text>" and inspects the return status. A successful call prints "Successfully set branding text: <branding text>" and exits 0. A failure (missing executable, command error, oversized string) writes the exit code to stderr and exits non-zero so the failure surfaces in the Automox console activity log instead of going silent.

macOS tray branding requirements

• macOS endpoint with the Automox agent installed and running

• Automox agent tray installed at /Library/Application Support/Automox/agent-ui.app or /Library/Application Support/Automox/agent-ui

• amagent command-line tool present at /usr/local/bin/amagent (installed automatically with the Automox agent)

• Root or sudo privileges for the Automox agent context (the default agent run context already meets this)

• Branding text of 75 characters or fewer; the amagent CLI rejects longer strings with a non-zero exit

• Edit the BRANDING_TEXT variable at the top of remediation.sh before scheduling the policy; the default string "Managed by your IT Administrators" is a placeholder, not a production value

Expected tray notification state after remediation

After a successful run, every notification the Automox agent surfaces on the endpoint shows the new footer string. The change applies to patch prompts, restart requests, FixNow status messages, and other agent-driven system notifications. The amagent CLI writes the branding string into the agent's stored configuration, so the footer survives endpoint reboots and agent restarts. Subsequent policy runs re-apply the same value on any endpoint that still has the tray installed, which keeps the footer aligned even after an agent upgrade or reinstall.

Validate the change in two ways. First, review the Automox activity log for the Worklet run and confirm the line "Successfully configured agent branding text: '<your text>'" with exit code 0. Second, on a pilot endpoint, trigger an agent notification by issuing a FixNow action or by waiting for the next scheduled patch prompt, then visually confirm that the new footer appears in the macOS Notification Center entry. If a future agent update resets the value, the next scheduled policy run re-applies the configured branding.