Auto Apps Overview

By Joe Wyatt-Borner

Deploy and update commonly used applications to your Mac fleet with Auto Apps.


Auto Apps are common pre-packaged applications ready to be instantly deployed through the Kandji Web App. Kandji also automatically allows these applications for Privacy Preferences Policy Control & Kernel Extensions. Notifications can be customized by the admin to manage the end-user experience. Additionally, Kandji can manage and enforce updates for these applications. For more information, see our list of available Auto Apps.

Adding an Auto App

  1. Click Library from the left-hand navigation bar.
  2. Click Add New from the right-hand side. Inside the 'Add Library Item' page, scroll down to view and select your desired Auto App. For this example, we used Figma.

  3. Click Add & Configure.


Kandji supports adding the same Auto App to your Library multiple times. This is useful when it's desired to configure differing settings for different Blueprints. For example, you can make an Auto App automatically install on devices in one Blueprint and have it be available in Self Service in another. Labels are used to differentiate multiple copies of the same Auto App. See below for additional information and an example.

Configuring an Auto App

  1. Enter a Label to help differentiate this instance of the Auto App from others in your Library. These labels are not visible to end-users but are displayed throughout the Kandji admin interface. For example, when configuring a Blueprint:
  2. Select a Blueprint from the Assignment dropdown.
  3. Select an option from the Installationdropdown. Your options include:
    • Continuously Enforce.
    • Install-on-demand from Self Service.
  4. Optionally toggle on Self Service availability in addition to the enforcement above.
  5. Select an option from the Version Enforcementdropdown. Your options include:
    • Do not manage updates
    • Automatically enforce new updates
    • Manually enforce a minimum version
  6. If you selected automatically enforce new updates, select an Enforcement Timeframe option. Updates will cache, and your end-users will begin getting prompted to update 5 days prior to the enforcement deadline.
  7. Select an Enforcement Time Zone to determine when to enforce the update.
  8. Select an Enforcement Time to determine the exact time of day to enforce the update; the enforcement will be determined server-side based on the previously selected Enforcement Time Zone
  9. Select whether or not to manage notifications for the Auto App.
    • If Unmanaged, the end-user will have control over the notifications settings for this app.
    • If an Auto App does not support notifications, the following message will be displayed: This application does not support notifications.
  10. Select to either Disallow or Allow notifications.
    • Disallow notifications will prevent the user from turning notifications on for this application.
    • Allow notifications will force notifications on for this application, with customization options available below.
  11. Configure your alert style, as well as any other desired behavior for the notifications.
  12. Optionally Add the item to the Dock during install.
  13. Click Save.


Once notification settings are modified, an updated Configuration Profile will not be redistributed until the next daily MDM check-in. To trigger an immediate check-in, run sudo kandji update-mdm on the client Mac.


For best practices moving from a Custom App to an Auto App, please see this article.


To learn more about Auto App settings, please see this article.

Other Important facts about Kandji Auto Apps

  • All Auto App installers are signed with valid Developer ID certificates issued by Apple under the registered Apple Developer program used by Gatekeeper.

    • These certificates, issued to either Kandji or a third-party vendor, establish a trust relationship that verifies the integrity of the installer.

  • All Auto Apps will automatically install a profile via MDM to allow the application for notifications if they are configured to be managed.
  • If an Auto App will install a profile to allow Kernel Extensions or Privacy Preferences Policy Control services, there will be a warning display in the Kandji Web App.
  • When leveraging update enforcement, end-users will begin receiving update alerts via the Kandji Menu bar icon starting 5 days before the enforcement deadline..

End-User Experience with Auto Apps

Since Auto Apps have the potential to notify end-users of available updates, it is important to understand what the end-user may experience. 

Update Notifications

End-users will receive a banner notification starting 5 days before the enforcement deadline.

App Can't Be Opened: The end-user will receive a banner notification if an update is in progress and they attempt to open the app.


Updating Auto Apps inside the Kandji Menu Bar App

End-users will notice that the Kandji Menu Bar App has a red dot indicating an action is required. This indicator will begin to appear 5 days prior to the Enforcement Deadline.

When clicking on the Kandji Menu Bar App dropdown, end-users will see a list of available updates. Clicking on an update will show the Update Info page. Users can additionally select the Update All button to install all pending updates.

The update will be visible in the Kandji Menu Bar App starting 5 days prior to the enforcement deadline. 


Start UpdatesOnce an end-user clicks the Update All button from the Kandji, they will be presented with a confirmation window to start the updates now. Clicking Start Now will forcibly close all pending apps.

Update Info: Once an end-user clicks the Learn More option from the banner action menu,
or if an end-user clicks an individual update, they will be presented with the update information and the option to start the update immediately.

Install in Progress: After an end-user starts an update via the Kandji Menu Bar App, they will be shown the following Install in Progress window.

Updates Complete: After an end-user starts an update via the Kandji Menu Bar App and that installation completes, they will see the following Installation Complete window.

Kandji will forcibly close an app once the update is initiated by the end-user. Kandji will also prevent the app from being opened during the update.

Enforcement Deadline Reached

Once the Enforcement Deadline is reached, Kandji will silently update the app. If the Application is open, the Kandji Menu Bar App will open, displaying a 5-minute countdown that the apps in question need to be closed. If the apps are not closed by the end of the countdown, Kandji will forcibly close the apps. If the apps are closed prior to the end of the countdown, the updates will start immediately.