deploy claude code policy with jamf, intune or kandji

Who Does What

An Enrollment Script

With no terminal and a key in the environment, failproofai config applies rather than asking, and exits 1 if anything it was asked to do did not happen, including the root-once daemon install, which uses sudo -n and never prompts for a password. Label the machine after config, not during. Do not use failproofai config --connect for a first install: it enrolls the machine without installing the daemon or hooks, leaving a machine that appears in the console but enforces nothing. Never print the key; keep shell tracing off.

For the hardened setup, where the daemon runs as a separate OS user and agents have no sudo, talk to us: the steps depend on your OS mix and MDM.

#!/bin/bash
# Runs as root from Jamf, Intune (macOS shell script) or Kandji. Adjust for your Node install.
set -euo pipefail
CONSOLE_USER=$(stat -f%Su /dev/console)
[ "$CONSOLE_USER" = "root" ] && { echo "no console user"; exit 0; }
FAILPROOFAI_CLOUD_TOKEN="$(/usr/local/bin/fetch-secret failproof-machine-key)"   # your secret delivery
export FAILPROOFAI_CLOUD_TOKEN

npm install -g failproofai
# failproofai config installs the failproofaid service as root via "sudo -n":
# the console user needs passwordless sudo for that step, or it exits 1.
# Grant it only for the install and remove it on exit, so agents never keep sudo.
printf '%s ALL=(root) NOPASSWD: ALL
' "$CONSOLE_USER" > /etc/sudoers.d/failproof-install
chmod 440 /etc/sudoers.d/failproof-install
trap 'rm -f /etc/sudoers.d/failproof-install' EXIT
sudo -H -u "$CONSOLE_USER" --preserve-env=FAILPROOFAI_CLOUD_TOKEN failproofai config
sudo -H -u "$CONSOLE_USER" failproofai policies add FailproofAI/policies
sudo -H -u "$CONSOLE_USER" failproofai config --machine-label "$(scutil --get ComputerName)"
sudo -H -u "$CONSOLE_USER" failproofai config --status

Delivering Claude Code Managed Settings

• Jamf or Kandji (macOS): a custom settings payload for the com.anthropic.claudecode domain, or a file at /Library/Application Support/ClaudeCode/managed-settings.json.
• Intune (Windows): a JSON string value named Settings under HKLM\SOFTWARE\Policies\ClaudeCode, or the file at C:\Program Files\ClaudeCode\managed-settings.json.
• Linux: /etc/claude-code/managed-settings.json via your config management.
• Anthropic publishes starter templates for Jamf, Iru (formerly Kandji), Intune and Group Policy in its MDM examples repository.
• Claude Code reads MDM policy at startup and checks for changes every 30 minutes.

Handle Drift and Local Admins

Anthropic’s docs note that a developer who is an administrator on the machine can edit the managed source itself, which is why MDM tooling redeploys the file or profile on a schedule. The same applies to the policy client. Run the enrollment script on a recurring schedule, and rely on the console’s coverage view (last check-in, machines missing a policy) rather than the exit code of failproofai config --status, whose exit codes are not documented.

Intune Specifics for macOS Scripts

• macOS shell scripts need macOS 12 or later and the Intune management agent.
• Scripts run as root by default; choose “run as signed-in user” only where needed.
• The agent checks in every 8 hours and stops a script after 60 minutes, so allow for delay before a new machine appears.