Install and Configure Automox Agent for Apple Silicon Devices
Apple Silicon devices
A subset of Assets, a general term denoting anything that runs the Automox Agent and is registered with the system. require additional configuration to install macOS updates.
If enabled, the Automox agent Lightweight client application, which is installed on managed devices. creates a new local service account to install macOS patches A software security or stability update.. This service account is created on Apple Silicon devices only; Intel devices do not require this account and are excluded.
One-time Action Required
For Apple Silicon devices, Automox creates a local account that needs to be granted secure token rights by an existing secure token enabled account.
Apple restricts patching of macOS updates that require a restart on Apple Silicon devices to administrator accounts that have secure token access. Other features, such as third-party software updates and custom policies Represents a set of logic statements that define the desired target state of a device, the allowed remediation schedule, and configuration parameters around how that remediation should take place., should continue to work as expected without the Automox service account.
There are three ways to grant Automox service account secure token access, beginning with the Agent 35 release. You can use the command line option, the user prompt option, or the worklet option. These are described here.
Command Line Option
To create the Automox service account and grant it secure token access, run this command on the device (Apple Silicon devices only):
sudo /usr/local/bin/amagent --adminuser 'admin_username' --adminpass 'admin_password'Replace admin_username and admin_password with an existing user account that has administrator privileges and secure token access.
An exit code of 0 indicates the command completed successfully. You can find the full list of exit codes in the Command Line Responses table.
You can now install all macOS updates using the agent. The Automox console Our web-based management dashboard, available at https://console.automox.com. updates to show the device is fully compatible after the next device scan.
This is a one-time action. If the Automox service is deleted, you must run this command again.
If needed, you can use the following command to check the secure token status of the Automox service account:
sudo sysadminctl -secureTokenStatus _automoxserviceaccountCommand Line Responses
| Exit Code | Standard Error | Notes |
|---|---|---|
| 0 | N/A | The command completed successfully and is enabled for macOS system patching. |
| 1 | Given account password invalid, or other error with underlying call | An incorrect password was entered to the --adminpass flag, or the sysadminctl call failed |
| 2 | Given account not found | The local account provided does not exist on this device. |
| 3 | Given account is not properly credentialed | The account provided does not have admin privileges and secure token access. |
| 4 | Handling for any "Unknown" error. The Automox service account may not exist, retry command. If issue persists, contact Automox support. | Internal error within the agent. |
| 5 | Automox service account is disabled. SecureToken cannot be granted. | The Automox service account is disabled. |
User Prompt Option
The user prompt is disabled by default. To enable the prompt, run this command on the device (Apple Silicon devices only):
sudo /usr/local/bin/amagent --automox-service-account enable
sudo /usr/local/bin/amagent --automox-user-prompt enable This enables the local user prompt.
Automox recently switched from using an Automox-branded prompt to the native macOS password prompt. Using the native macOS prompt improves security. This prevents the administrator password from being cached by a local process and ensures it receives special handling by macOS.
The next time the device is scanned (configurable in the Automox Console), the agent creates the service account. If the local user has administrator privileges and secure token access, the agent prompts them to enter their password.
This is a one-time action. After you enter your password, the Automox service account is granted secure token access to install current and future macOS patches.
You can now install all macOS updates using the agent. The Automox console updates to show the device is fully compatible after the next device scan.
- To disable the user prompt, run the following command:
sudo /usr/local/bin/amagent --automox-user-prompt disable- To disable the creation of an Automox managed service account, run the following command:
sudo /usr/local/bin/amagent --automox-service-account disableWorklet Option
Use the Enable Apple Silicon Patching worklet to configure the service account and generate a secure token on Mac devices. To check the status of the service account and secure token, use the M1 Secure Token Check worklet. These worklets are available in the Worklet Catalog.
Automox Service Account Details
The Automox service account is only used on Apple Silicon Mac devices. However, the account is not created by default.
Account Name
The Automox service account is created with the following name:
- Short name: _automoxserviceaccount
- Long name: Automox Service Account
This account is visible on the pre-boot screen and in the user accounts table. Apple does not allow FileVault accounts to be hidden on the initial login screen.
Account Password
When the Automox agent creates the account, the agent also generates a password for the account.
The randomly generated password is a minimum of 32 characters long, including alphanumeric characters and special characters.
Password Security
The service account password is randomly generated and is unique to that device. No two devices have the same password.
Automox encrypts the password and stores it locally on the device. No credentials are stored in the Automox cloud; the password never leaves the device.
Password Rotation
Automox rotates the password after every software update and also when the password is used.
A random password is generated for each device.
For additional help, please submit a support request through the customer portal.
Apple Silicon Onboarding
When Apple Silicon Mac devices are not properly configured, a banner appears in the console.
- This solution is not for organizations that do not give their end users administrator rights.
- You must not already have a worklet with the same name as the one automatically generated through the onboarding process.
If you choose to manually configure devices, this article guides you, and you must follow the instructions according to your preferred method. See One-time Action Required.
