Browser Extension

Safari has no force-install policy, so the Safari extension ships inside a small Mac app, Velatir Safari Extension. Velatir for Desktop installs that app, keeps it current, and sets the ingest key. Your MDM does one thing: it turns the extension on and keeps it on, with the Safari extensions setting that Jamf Pro calls the Manage Safari extensions Blueprint.

Part	With Velatir for Desktop	Without Velatir for Desktop
Install the app and keep it updated	The desktop agent	Your MDM pushes the package
Set the ingest key	The desktop agent	Your MDM pushes a configuration profile
Turn the extension on and keep it on	Your MDM, with the Blueprint	Your MDM, with the Blueprint

Without the Blueprint, the extension stays off until a user turns it on in Safari. Safari is not covered until then.

Requirements

Requirement	Detail
Operating system	macOS 15.4 or later (Apple Silicon, Intel)
Velatir for Desktop	0.26.0 or later, for the automatic install
Enrollment	Supervised Macs. macOS applies Safari extension settings only on supervised Macs.
MDM	Jamf Pro with Blueprints, or any MDM that sends declarative device management (DDM) configurations

To check that a Mac is supervised, run this. It prints DeviceIsSupervised = 1:

/usr/libexec/mdmclient dumpManagementStatus | grep DeviceIsSupervised

1. Install the extension

With Velatir for Desktop

Nothing to upload. While Browser coverage on the Setup page of the Velatir dashboard is Velatir-managed, the default, the agent on each Mac:

Downloads the current Safari release from Velatir and installs it. Before installing, it checks the package’s SHA-256 and that the package is notarized and signed by Velatir ApS (Team ID AA7QLU3S4R).
Writes the ingest key to the extension’s managed preferences, so users are never asked for one.
Checks for a newer release a minute after it starts and every four hours after that. It installs a newer version over the old one and never downgrades.
Leaves an app it did not install alone. If your MDM already pushed the package, keep managing it there.

Browser coverage	Safari
Velatir-managed	Installs the app and the ingest key. Keeps the app updated.
Key-only	Sets the ingest key. Never installs or removes the app.
Off	Removes the app, if the agent installed it.

The agent installs the app. It cannot turn the extension on: only Safari, or your MDM, can do that. Continue with step 2.

With your own MDM

Use this route on Macs without Velatir for Desktop, or when Browser coverage is Key-only.

File	Link
Package	velatir-safari.pkg
Checksum	velatir-safari.pkg.sha256

The package is signed by Velatir ApS (Team ID AA7QLU3S4R) and notarized by Apple. One package covers Apple Silicon and Intel, and it always installs into /Applications. Deploy the package

In Jamf Pro, upload the package under Packages.
Create a policy with the package. Trigger: Recurring Check-in. Frequency: Once per computer. Scope it to your Macs.

Users do not need to open the app: Safari registers the extension as soon as the package is installed. To roll out a new version, replace the package in the policy, then open the policy’s Logs and click Flush All. Macs that already ran the policy install the new version at their next check-in, over the old one. Set the ingest key Copy the profile below and replace vltr_ingest_yourIngestKeyHere with your ingest key, from the Setup page of the Velatir dashboard. Save it as velatir-safari.mobileconfig.

Go to Computers > Configuration Profiles > Upload.
Upload velatir-safari.mobileconfig as it is. Do not edit it in Jamf.
Scope it to the same Macs as the package.

The extension accepts the key only from managed preferences, so users cannot change or remove it.

velatir-safari.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.ManagedClient.preferences</string>
            <key>PayloadIdentifier</key>
            <string>com.velatir.safari-extension.managed-config.preferences</string>
            <key>PayloadUUID</key>
            <string>518798C2-3CFA-43B8-A10C-7A9B6559567C</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadContent</key>
            <dict>
                <key>com.velatir.safari-extension.extension</key>
                <dict>
                    <key>Forced</key>
                    <array>
                        <dict>
                            <key>mcx_preference_settings</key>
                            <dict>
                                <key>apiToken</key>
                                <string>vltr_ingest_yourIngestKeyHere</string>
                            </dict>
                        </dict>
                    </array>
                </dict>
            </dict>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Velatir Safari Extension</string>
    <key>PayloadIdentifier</key>
    <string>com.velatir.safari-extension.managed-config</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>598E04F9-8DE2-4BFD-AAE5-2A845ECC7F9C</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Do not paste this profile into Application & Custom Settings. That payload expects only the settings for one preference domain, and wraps whatever it is given in a second profile. The extension then cannot find apiToken and shows Your organisation’s configuration profile could not be read.To use Application & Custom Settings instead, set Preference Domain to com.velatir.safari-extension.extension and upload a property list with only the key:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>apiToken</key>
    <string>vltr_ingest_yourIngestKeyHere</string>
</dict>
</plist>

2. Keep the extension on

This step is the same on both routes. It is what makes Safari coverage hold: the extension is on, users cannot turn it off, and it has access to every website without a per-site prompt.

In Jamf Pro, go to Blueprints, create a macOS Blueprint, and add Manage Safari extensions.
Add one extension with this identifier, including the space and the parentheses:
com.velatir.safari-extension.extension (AA7QLU3S4R)
Set State to Always On, Private Browsing to Always On, and Allowed Domains to *.
Scope the Blueprint to your Macs and click Deploy. A saved Blueprint does nothing until it is deployed.

The identifier is the extension’s bundle ID followed by Velatir’s Team ID. The Team ID alone, or the app’s bundle ID com.velatir.safari-extension, matches nothing. Safari then leaves the extension unmanaged and reports no error.

On another MDM, send a com.apple.configuration.safari.extensions.settings configuration on the user channel with this payload:

{
  "ManagedExtensions": {
    "com.velatir.safari-extension.extension (AA7QLU3S4R)": {
      "State": "AlwaysOn",
      "PrivateBrowsing": "AlwaysOn",
      "AllowedDomains": ["*"]
    }
  }
}

The Blueprint can arrive before or after the app. Safari applies it as soon as both are on the Mac.

Macs that are not supervised ignore this setting. There, each user turns the extension on once: open Safari > Settings > Extensions, tick Velatir, and choose Always Allow on Every Website. The user can turn it off again.

Verify

On a Mac in scope, once the app and the Blueprint have arrived:

Confirm the app is installed. This prints the version:

/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "/Applications/Velatir Safari Extension.app/Contents/Info.plist"

With Velatir for Desktop, the agent log says what it did. It prints lines such as safari-extension: installed 1.20.2:

grep safari-extension /Library/Logs/Velatir/agent.stdout.log

Confirm the ingest key arrived. The output shows apiToken at the top level:

plutil -p "/Library/Managed Preferences/com.velatir.safari-extension.extension.plist"

Quit Safari (⌘Q) and open it again. In Safari > Settings > Extensions, Velatir is on and its checkbox is greyed out.
Click the Velatir button in the Safari toolbar. The dashboard opens without asking for a key.

Troubleshoot

The agent log says not published for this environment yet: Velatir has not released the Safari extension to your environment. Nothing is wrong on the Mac. The agent installs it on its first check after the release.
The agent log says installed but not by the agent: your MDM, or someone with administrator rights, installed the app. The agent leaves it alone and does not update it. Keep managing it from your MDM, or delete /Applications/Velatir Safari Extension.app and the agent installs the current release within four hours.
The extension shows Your organisation’s configuration profile could not be read: the profile was wrapped twice. Run the plutil command from Verify. If it shows PayloadContent instead of apiToken, delete that profile and upload the .mobileconfig under Configuration Profiles > Upload.
Users can untick Velatir in Safari: the Blueprint has not applied. Confirm it is deployed and scoped to the Mac, that the Mac is supervised, and that the identifier is exactly com.velatir.safari-extension.extension (AA7QLU3S4R). Then quit and reopen Safari.
Safari still offers Uninstall: this is expected. The Blueprint keeps the extension on, but Safari always shows Uninstall. Removing the extension means deleting the app, which needs administrator rights. With Velatir for Desktop, the agent puts the app back within four hours. On the MDM route, scope the package policy to a smart group of Macs where the app is missing, and set the frequency to Ongoing.
The policy succeeds but the version does not change (MDM route): macOS skips the package when the Mac already has a higher version. Delete /Applications/Velatir Safari Extension.app, flush the policy logs for that Mac, and run the policy again.
Collect diagnostics for support: click five times anywhere inside the extension window to open its diagnostics view. Use Copy report and paste the result into your support request.

Known limitations

Until the extension is on, by the Blueprint or by the user, Safari is not covered.
Without Velatir for Desktop, Safari traces carry no directory context, and pasted content is not redacted on the device.

Enterprise deployment

Roll Velatir for Desktop out with Jamf, Intune, or any MDM

Enterprise overview

Browser support, managed config, and other platforms

Getting Started

Platform

Velatir for Desktop

Connectors

Agents

Sessions & Traces

Insights

Reports

Inventory

Developers

For Providers

Security & Privacy

Browser Extension - Safari (macOS)

Requirements

1. Install the extension

With Velatir for Desktop

With your own MDM

2. Keep the extension on

Verify

Troubleshoot

Known limitations

Enterprise deployment

Enterprise overview

​Requirements

​1. Install the extension

​With Velatir for Desktop

​With your own MDM

​2. Keep the extension on

​Verify

​Troubleshoot

​Known limitations

Enterprise deployment

Enterprise overview

Requirements

1. Install the extension

With Velatir for Desktop

With your own MDM

2. Keep the extension on

Verify

Troubleshoot

Known limitations