As mentioned before, we recommend you to deploy the licensing/PPPC profile first, and follow it up with the Parallels Desktop for Mac app from your MDM's app catalog.

This chapter uses Jamf Pro for demonstration purposes. If you use a different device management solution, check their respective guide on distributing profiles and using built-in app catalogs.

Deploying configuration profiles in Jamf Pro

To add your pre-made configuration profile to Jamf Pro and distribute it to your users' Macs, from the main Dashboard, go to Computers > Content Management > Configuration Profiles and click the Upload button in the top-right corner, selecting the .mobileconfig file with the configuration profile made in the previous chapter.

This will open the profile for editing, where you will be able to switch to the Scope tab and select the target machines or specific user groups.

Refer to your MDM solution's guide for syncing user groups with your identity profider.

Deploying Parallels Desktop for Mac from Jamf Pro app catalog

To deploy Parallels Desktop for Mac using Jamf Pro's built-in app catalog, from the main Dashboard, go to Computers > Content Management > Mac Apps and click the + New button in the top-right corner. Select Jamf App Catalog as source and choose Parallels Desktop 20.1 or newer for deployment.

During the setup, you can choose a group of computers that the app will be deployed to. You can set up groups under Computers > Groups.

Instead of preparing deployment packages, many modern MDM solutions allow you to deploy known apps via their built-in app catalogs.

This method, however, requires you to accompany the pre-existing Parallels Desktop installation package with a configuration profile containing a specific license key or an instruction to activate the app via Single Sign-On.

Some of the MDM solutions don't have the feature to prepare such configuration profiles on the spot, so the next easiest way to achieve that is to use iMazing's Profile Editor app.

A configuration profile with licensing information will persist on target Macs and help you keep your users' copies of Parallels Desktop for Mac activated even through a complete reinstallation (if you include a licensing key in it) or force an SSO sign-in window to pop up at the restart (if you set SSO as the default activation method in the profile). Having an pre-installed licensing profile (preferably protected from removal) will prevent a user from activating their copy of Parallels Desktop for Mac with another key.

In macOS, you may control various aspects of the operating system and particular apps' behavior by installing or remotely deploying the so-called configuration profiles: files that contain specific instructions written in specified syntax. Such files have a .mobileconfig extension. They can be created or edited manually or in special software and distributed along with the app using your preferred device management solution. In this manual, we rely on iMazing Profile Editor.

Follow these steps to create a profile that will control the Parallels Desktop activation method and (optionally) set the privacy preferences for it in advance so that your users won't have to click Allow on multiple system access requests when they first launch the app:

1. Download and install iMazing Profile Editor from their website or Mac App Store.

2. Launch the app.

3. While in the General domain, set the following values at your discretion:

   1. Payload Display Name: what your profile will be named.

   2. Payload Organization: put your company's name here.

   3. Payload Description: what your profile controls.

   4. Prevent users from removing this profile: we recommend that you activate this option.

   5. Payload Scope: whether the profile should apply to the whole Mac, no matter what user signs in, or just the particular user.

   6. Target Device Type: Mac.
4. Scroll down the left-side bar until you find the item called Parallels Desktop for Mac. Select it and click the + Add Configuration Payload button. This will add the Parallels Desktop activation method payload to your profile.
5. Under Activation Experience, select SSO for the sign-in experience of per-user licensing or License Key for per-device licensing. In the latter case, providing the license key to activate Parallels Desktop is mandatory.
6. Optionally, scroll down the left-side bar to find the payload called Privacy Preferences Policy Control, add it to the configuration profile, and set it up as you see fit, following these guidelines from Apple. At the very minimum, we recommend that you enable Parallels Desktop's access to Desktop, Documents, and Downloads folders.

   Note: For the purposes of PPPC settings, Parallels Desktop for Mac and any of its virtual machines share the same bundle ID, which is com.parallels.desktop.console. The Identifier Type should be set to Bundle ID, Authorization to Allow, and Allowed to 1.

7. Use File -> Save As to save the newly created profile for further distribution. You may choose to sign the profile; if so, make sure the certificate with which you sign is also present on all target Macs.