MDM Configuration Guide

Rosetta Check reads managed preferences from the com.neiljohn.rosettacheck preference domain using Apple's standard UserDefaults managed configuration mechanism. Deploy a .mobileconfig profile through your MDM solution to centrally control app behaviour.

When a key is set via a configuration profile, it overrides the user's local setting and the corresponding toggle in the app's Settings window is locked with a 🔒 icon. The app uses objectIsForced(forKey:) to detect managed keys — no special entitlements are required.

Download a complete, working .mobileconfig file with all available keys. Edit it to include only the keys you want to manage — keys omitted from the profile remain under user control.

When Rosetta Check is pushed to a Mac via MDM, macOS installs the app bundle but does not launch it. Until the user opens the app for the first time, none of the managed behaviours kick in — no background monitoring, no scan on launch, no auto-export, and crucially no login item registration. On a fleet where users may never click the app icon, this means the deployment effectively does nothing until they do.

The script below performs that first launch silently in the user's session. Once it has run, the app is registered as a login item via SMAppService (locked on by the configuration profile), the first scan completes, and from the next login onwards the app starts automatically — no user interaction required.

#!/bin/zsh
APP="/Applications/RosettaCheck.app"
BIN="$APP/Contents/MacOS/RosettaCheck"

# Wait for the Dock so we never launch during Setup Assistant (cap 30 min).
elapsed=0
while ! /usr/bin/pgrep -x Dock > /dev/null; do
    (( elapsed >= 1800 )) && { echo "Timed out waiting for Dock" >&2; exit 1; }
    sleep 5; (( elapsed += 5 ))
done

# Already running? Nothing to do.
/usr/bin/pgrep -f "$BIN" > /dev/null && exit 0

# Wait up to 5 minutes for the App Store install to land.
elapsed=0
while [[ ! -d "$APP" ]]; do
    (( elapsed >= 300 )) && { echo "Timed out waiting for $APP" >&2; exit 1; }
    sleep 5; (( elapsed += 5 ))
done

# Launch WITHOUT stealing focus: AppleScript 'launch' (not 'activate'),
# falling back to open --background --hide.
/usr/bin/osascript -e 'tell application "RosettaCheck" to launch' \
    || /usr/bin/open --background --hide "$APP"

# Verify it actually stayed up — open/launch return 0 even if the app
# crashes on launch (the silent-failure mode from v1.0).
sleep 3
if /usr/bin/pgrep -f "$BIN" > /dev/null; then
    echo "RosettaCheck is running. Done."
    exit 0
else
    echo "RosettaCheck did not stay running — check the unified log." >&2
    exit 1
fi

Shown condensed. The downloadable v1.2 script adds unified logging (search the macOS unified log for the rosettacheck-launcher tag) and fuller diagnostics.

Preference Domain

Every key supported by Rosetta Check's managed configuration. All keys are optional — include only those you want to control centrally.

See every Intel app across your Mac fleet on a single dashboard — without giving us a name, an email, or a single piece of identifying information about your organisation. We generate a random ID, you push it to your Macs via MDM, and you get a private URL that lists which apps are still Intel-only and which Macs are reporting them.

Use it to drive an Apple Silicon migration, prove readiness ahead of macOS 28 dropping Rosetta, or just get visibility into the long tail of legacy software across your estate.

• The URL is the secret. Anyone with the dashboard URL can see the data. Treat it like a password.
• Not recoverable. If you lose the URL we cannot help you find it — there is nothing tying it to you.

Starting with macOS 26.4, Apple shows a pop-up dialog each time an Intel app is launched, warning the user that Rosetta will be removed. This can be suppressed via an MDM Restrictions policy using the com.apple.applicationaccess payload. See Apple's device management schema for the full specification.

Deploy a Restrictions profile in your MDM with the following key:

<key>allowRosettaUsageAwareness</key>
<false/>

Rosetta Check detects this setting and displays the current status in the Settings window under "Rosetta Transition". The downloadable example profile includes a commented-out section for this restriction.

On a managed Mac, open Rosetta Check → Settings. Managed settings display a 🔒 lock icon and cannot be changed by the user. A "Management" banner appears when any keys are being managed.

You can also verify from Terminal:

# Check if any keys are managed
defaults read com.neiljohn.rosettacheck

# Check a specific key
defaults read com.neiljohn.rosettacheck autoExportEnabled

Supported MDM Solutions

Any MDM that can deploy custom macOS configuration profiles is supported. Links point to each vendor's documentation for deploying custom profiles.

Requirements

• macOS 13 (Ventura) or later
• Apple Silicon Mac
• Rosetta Check v1.20+ installed from the Mac App Store
• MDM solution capable of deploying custom configuration profiles