Gnista through MDM,
one profile.

Gnista reads managed preferences in its own domain, sh.gnista.Gnista, delivered by a configuration profile with a com.apple.ManagedClient.preferences payload (in some MDMs called custom settings or a preference file). Settings the profile manages show “Managed by your organisation” in Gnista and can’t be changed there.

Managed settings apply only with a team key. LicenceKey works with any key; with a personal key, Gnista ignores the rest and its Settings say “Central configuration requires a team plan”. When a profile carries both the key and settings, Gnista activates the key first, then applies the settings.

Every key except LicenceKey and DisplayMode counts only when the profile enforces it, under Forced, as in the template. Every key is optional, and keys Gnista doesn’t know are ignored.

EnabledAgents and ApprovalAgents name agents the way Gnista’s helper does:

Copilot in VS Code counts as copilot. Custom agents go by their file’s name. Answering in Gnista works with claude, codex, devin, opencode, qwen, qoder, qoder-cn, codebuddy, workbuddy, droid, kilo, mimocode, zcode, kimi and omp; other names in ApprovalAgents change nothing.

A complete profile with every key. The template is the same, with a comment on each key. Keep the keys you want to manage, put in your key, and give both PayloadUUID values your own (run uuidgen in Terminal).

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadDisplayName</key>
  <string>Gnista</string>
  <key>PayloadDescription</key>
  <string>Gnista's licence key and settings for your team.</string>
  <key>PayloadIdentifier</key>
  <string>sh.gnista.Gnista.profile</string>
  <key>PayloadOrganization</key>
  <string>Your organisation</string>
  <key>PayloadScope</key>
  <string>System</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>00000000-0000-4000-8000-000000000001</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadDisplayName</key>
      <string>Gnista settings</string>
      <key>PayloadIdentifier</key>
      <string>sh.gnista.Gnista.profile.preferences</string>
      <key>PayloadType</key>
      <string>com.apple.ManagedClient.preferences</string>
      <key>PayloadUUID</key>
      <string>00000000-0000-4000-8000-000000000002</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadContent</key>
      <dict>
        <key>sh.gnista.Gnista</key>
        <dict>
          <key>Forced</key>
          <array>
            <dict>
              <key>mcx_preference_settings</key>
              <dict>
                <key>LicenceKey</key>
                <string>GNISTA-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX</string>
                <key>EnabledAgents</key>
                <array>
                  <string>claude</string>
                  <string>codex</string>
                </array>
                <key>ApprovalsAllowed</key>
                <true/>
                <key>ApprovalAgents</key>
                <array>
                  <string>claude</string>
                </array>
                <key>CrashReportsMode</key>
                <string>never</string>
                <key>AutomaticUpdates</key>
                <false/>
                <key>RemoteMachinesAllowed</key>
                <true/>
                <key>RemoteConnection</key>
                <string>relay</string>
              </dict>
            </dict>
          </array>
          <key>Set-Once</key>
          <array>
            <dict>
              <key>mcx_data_timestamp</key>
              <date>2026-10-15T00:00:00Z</date>
              <key>mcx_preference_settings</key>
              <dict>
                <key>DisplayMode</key>
                <string>notch</string>
              </dict>
            </dict>
          </array>
        </dict>
      </dict>
    </dict>
  </array>
</dict>
</plist>

Scope it to the Macs (device level, as in the template), not to users.

1. In Jamf Pro, go to Computers, then Configuration Profiles, and choose Upload. Pick your edited gnista.mobileconfig.
2. Check the General payload: level Computer, distribution method Install Automatically.
3. Scope it to the computers or smart groups that run Gnista, and save.

Rather build it in Jamf? Create a new profile, add Application & Custom Settings, upload a property list of just the keys, and give sh.gnista.Gnista as the preference domain.

1. In Kandji, open the Library and add a Custom Profile.
2. Upload your edited gnista.mobileconfig and make sure it installs on Mac.
3. Assign it to the Blueprints with the Macs that run Gnista, and save.

1. In the Intune admin center, go to Devices, then macOS, then Configuration, and create a new policy.
2. Choose Templates as the profile type, then Custom.
3. Name it, choose the device channel, and upload your edited gnista.mobileconfig.
4. Assign it to the device groups with the Macs that run Gnista, and create it.

Intune’s Preference file template works too: give sh.gnista.Gnista as the preference domain and upload a property list of just the keys.

1. In Mosyle, go to Management, then Custom Profiles, and add a new profile.
2. Upload your edited gnista.mobileconfig.
3. Assign it to the devices or device groups that run Gnista, and save.

The profile shows in System Settings, General, Device Management. Its settings land in the Mac’s managed preferences:

defaults read "/Library/Managed Preferences/sh.gnista.Gnista"

In Gnista, Settings shows the managed settings as “Managed by your organisation”, and Settings ▸ About ▸ Licence shows the team licence. To try a profile before rolling it out, double-click it on a test Mac and install it in System Settings.