Deploy Configuration Profiles – macOS requires several security profiles to be pushed before or alongside the agent to pre-authorize SentinelOne system extensions and permissions. This prevents end-users from being prompted to allow these permissions manually (Installing SentinelOne macOS Agents with MDM tools | Guardz Help Center). The required profiles include:

Note: These configuration profiles (provided by SentinelOne in their documentation) are typically delivered as .mobileconfig files. You can obtain them via the SentinelOne support portal or knowledge base. In Swif, upload each of these profiles as a Custom Policy for macOS. Navigate to Policy Management > Custom Policy, then upload the profile file (or paste its XML) and save it. Assign the profiles to your macOS device groups to deploy them to all managed Macs. After deployment, you can verify on a Mac that the profiles are installed under System Settings > Profiles (they should be listed by the names above).

Install the SentinelOne App – Next, deploy the SentinelOne agent installer to the Macs. You have two options to do this:

Once added and assigned, the SentinelOne pkg will be deployed to the selected Macs automatically. Ensure the devices are online and check Swif for deployment status. After installation, the SentinelOne application should appear in /Applications on the Mac.

Apply the Site Token (Agent Registration) – The final step on macOS is to register the installed agent to your SentinelOne management console using your Site Token. Since the macOS installer itself doesn’t have a command-line parameter, we must provide the token post-installation. We will do this by running the SentinelOne command-line tool sentinelctl on the device to set the token.

Using Swif’s remote command feature, create a command to run on the Macs that have the agent installed. Go to Devices > Commands in Swif (or the equivalent section to run a device command), and create a new command. We recommend scheduling it or running it on a slight delay to ensure the agent installation is complete. Configure the command to Run as Swif admin (an administrator account managed by Swif) so that it has root privileges (Install/Uninstall CrowdStrike Falcon | Help Center | Swif). For the command content, use the following syntax:

Replace "<YourSiteToken>" with the actual token string from your SentinelOne console. This sentinelctl command writes the Site Token to the agent and prompts it to register with the cloud. (Ensure Run script as signed-in user is No so that it runs as root.) Once this command has run, the agent will connect to your SentinelOne console. You can confirm a successful registration by checking the SentinelOne management portal – the Mac device should appear as registered/online in your site. On the Mac itself, the SentinelOne tray icon will indicate it’s online, meaning it’s successfully reporting to the console.

Tip: If you are rolling out SentinelOne to many Macs or new ones over time, consider setting the above registration command to run on a schedule (e.g. daily) for a short period. This way, any device that missed the token application (perhaps because it installed the agent after the command ran) will still get the token applied on the next run. Just remember to stop or remove the scheduled command once all devices are registered. (Also, never share the Site Token publicly—treat it as sensitive credential.)

Install the app – Deploying SentinelOne on Windows via Swif is similar, using the installer from SentinelOne. You have two options to deploy the Windows agent:

After uploading or adding the app, assign it to the target Windows devices or device group in Swif to deploy. The Swif agent will then install SentinelOne on those endpoints. Ensure the devices are online to receive the installation. You might want to set any requirements/conditions (like minimum OS version or architecture) if applicable, but typically the default (Windows 10/11 x64) is fine.

Verification: You would configure a detection rule or script to confirm the agent installed successfully (for example, checking that the SentinelOne folder exists in C:\Program Files or that the SentinelAgent service is present). When deploying via Swif, the platform will similarly check installation status. You can add a Validation Rule in Swif for custom packages – e.g., a file existence check for the path C:\Program Files\SentinelOne – to mark the install as successful. After a successful deployment, give the system some time to report. Within an hour or two of the assignment, you should see SentinelOne installed on the target Windows devices (check the Swif device software inventory or the SentinelOne console for new agent check-ins).

Uninstall the app (if needed) – Removing SentinelOne from a device requires additional steps because the agent is tamper-resistant. By default, SentinelOne agents cannot be uninstalled without a passphrase (uninstall token) or a remote command from the SentinelOne console. This means that simply issuing an uninstall via MDM/Swif will not work unless that passphrase is provided.

Important: Always safeguard the SentinelOne agent passphrase just as you do the site token. Only authorized admins should retrieve and use it. When de-provisioning a device, it’s best practice to uninstall the agent via the console to avoid leaving an orphaned endpoint in your SentinelOne site.