Login Item Profiles

Login Item Profiles

Build a Managed Login Items profile (com.apple.servicemanagement) so approved launch agents, launch daemons and login items run without macOS "Background Items Added" alerts, and users can't turn them off.

Finding the right Team ID, bundle ID or launchd label for every background item is tedious. This tool lists the items installed on your Mac so you can pick them with a click.

The scan covers the Mac running Magic Toolbox. Install the software you want to manage on your own Mac (or a test Mac running Magic Toolbox) first.

The tool walks you through five steps: Connect → Scan → Select → Confirm → Done.

1. Connect

Connecting to Jamf Pro is only needed if you want to upload the finished profile.

• Connect & Check Permissions: signs in and checks Create macOS Configuration Profiles. Click Continue → (or Proceed Anyway →) to start the scan.
• Continue Without Connecting: skips Jamf Pro and goes straight to the scan. You can still save a .mobileconfig or export JSON at the end. To upload later, click Start Over and connect at this step.

2. Scan

Magic Toolbox scans this Mac for launch agents, launch daemons and login items.

Type	Location
Launch Agents	/Library/LaunchAgents, ~/Library/LaunchAgents, and Contents/Library/LaunchAgents inside apps
Launch Daemons	/Library/LaunchDaemons, and Contents/Library/LaunchDaemons inside apps
Login Items	Helper apps in Contents/Library/LoginItems inside apps

Apps are looked for in /Applications and ~/Applications, including one level of folders (such as /Applications/Utilities or a vendor's suite folder). The apps themselves aren't login items: only the background items they contain are listed.

The ~/Library/LaunchAgents and ~/Applications locations are only scanned after you grant home folder access (see below).

How identifiers are found

• Launch agents and daemons: the Label from the plist, and the program from Program, the first item in ProgramArguments, or BundleProgram for agents and daemons inside an app.
• Login items: the bundle ID from the helper's Info.plist.
• Team ID: Magic Toolbox runs /usr/bin/codesign -dvv on the program or helper, a few at a time, and reads the TeamIdentifier line. Only a real 10-character Team ID is used. Unsigned or ad hoc code has none.

3. Select

Items are listed by type (Login Item, Launch Agent, Launch Daemon), each showing its name, Team ID and bundle ID or label.

• Search by name, Team ID or bundle ID, and filter by Type.
• Each type has Select All and Deselect All. Rescan scans the Mac again, and keeps your ticks.
• Home folder access needed: Magic Toolbox is sandboxed, so it can't see items in your home folder until you click Grant Access… and choose your home folder. Choosing a different folder shows an error. Access is remembered for later scans.

Tick an item to allow it. An Identifier menu then appears on its row, offering only the identifiers the item has:

Identifier	Rule type	Covers
Team ID	TeamIdentifier	Everything signed by that developer. The simplest and most robust choice
Bundle ID	BundleIdentifier	One login item
Label	Label	One launchd job (launch agents and daemons)

A new rule uses the Team ID if the item has one, otherwise its Bundle ID (login items) or Label (agents and daemons). Bundle ID and Label rules also include the Team ID when it's known. An item with no Team ID and no bundle ID or label can't be ticked.

If you've built a profile before, your saved rules are matched to the scanned items and ticked for you, with the same identifier.

Click Review Rules when you're ready. The footer shows how many items are selected.

4. Confirm

• Edit the Profile name. It defaults to the name of your saved rule set.
• Each rule shows the item, rule type and value. Every rule is an Allow rule: Apple's Managed Login Items payload only supports allowing items (which users then can't turn off). There's no Deny or Ask.
• Warnings are shown in orange when:
  • a Bundle ID or Label rule is already covered by a Team ID rule for the same developer (redundant, but harmless), or
  • two selected items give the same rule (for example, two helpers from one vendor both set to Team ID). Only one rule is created.

Tick "I've reviewed these rules and any conflicts noted above." and click Save Rules. Back returns to the selection.

5. Done

The summary shows how many Allow rules were saved.

• Upload to Jamf Pro: first click Scan Instance under Scope & Category, then choose a Category and a Scope (All Computers, or a Computer Group). The button stays unavailable until the scan has run and there's at least one rule. The profile is named after the profile name, with your prefix in front if you've set one, and is uploaded unsigned at Computer level. If a profile with that name already exists, you're asked before it's overwritten. See Uploading Profiles.
• Save .mobileconfig…: preview the XML, then Copy XML or Save to File… The suggested file name is the profile name without spaces. If the file can't be saved, an alert says why.
• Export JSON…: a copy of your saved rules, to paste into your own notes or version control.
• Start Over goes back to the Connect step.

The profile contains one com.apple.servicemanagement payload with a Rules array. Each rule has a RuleType (TeamIdentifier, BundleIdentifier or Label), a RuleValue, a Comment (the item name) and, for Bundle ID and Label rules, the TeamIdentifier when it's known. The profile's identifiers are based on its name, so saving it again under the same name updates the profile on devices instead of adding a second one.

Your rules are saved automatically to profiles.json in the app's Application Support folder (MagicToolbox/BackgroundTaskProfiler), and are still there next time you open the app. Saving replaces the previous rules with your latest selection.

• Rules saved by an earlier version that can't be used any more (Deny and Ask rules, rules based on a login item's name, and not set Team IDs) are dropped when the file is loaded, and the tool says so.
• If profiles.json can't be read, it's renamed to profiles.json.corrupt-<date> and a new Default rule set is started. If it can't be moved aside either, changes aren't saved until the file is fixed or removed, so it's never overwritten.

Tips

• Prefer Team ID rules unless you need to allow only part of a vendor's software. They keep working when the vendor renames a helper or adds a new one.
• For launch agents and daemons, use Label to target one launchd job.
• Check your profile on a test Mac: in Terminal, sfltool dumpbtm lists background items and shows whether they're managed.

Permissions: none for the scan and exports. To upload: Create, Read and Update macOS Configuration Profiles, plus Read Categories and Read Computer Groups for the scope and category scan. See Jamf API Permissions.