NetNXT Logo

How to Deploy the Twingate Client on macOS and Windows Using JumpCloud?

January 12, 2026
2 min read
ByNetNXT

Overview

Deploying Twingate requires two actions:

  1. Installation: Pushing the client software.

  2. Configuration: Pre-filling the Network Name (e.g., netnxt.twingate.com) so users don't have to type it manually.

Part 1: macOS Deployment (The Zero-Touch Method)

For macOS, we use a Configuration Profile (.mobileconfig) to pre-fill the network name and approve the System Extension.

Step 1: Create the Config Profile

Copy the XML below into a file named Twingate_Config.mobileconfig.

  • Replace: YOUR_NETWORK_NAME with your actual subdomain (e.g., just netnxt if your URL is netnxt.twingate.com).

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDescription</key>
            <string>Approves Twingate System Extensions</string>
            <key>PayloadDisplayName</key>
            <string>Twingate System Extensions</string>
            <key>PayloadIdentifier</key>
            <string>com.twingate.macos.sysext</string>
            <key>PayloadType</key>
            <string>com.apple.system.extension.policy</string>
            <key>PayloadUUID</key>
            <string>A1B2C3D4-E5F6-7890-1234-567890ABCDEF</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>AllowedSystemExtensions</key>
            <dict>
                <key>6GX8KVTR9H</key> <array>
                    <string>com.twingate.macos.tunnelprovider</string>
                </array>
            </dict>
        </dict>
        <dict>
            <key>PayloadDescription</key>
            <string>Configures Twingate Network Name</string>
            <key>PayloadDisplayName</key>
            <string>Twingate Settings</string>
            <key>PayloadIdentifier</key>
            <string>com.twingate.macos.settings</string>
            <key>PayloadType</key>
            <string>com.twingate.macos</string>
            <key>PayloadUUID</key>
            <string>B2C3D4E5-F6G7-8901-2345-678901BCDEFG</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>network</key>
            <string>YOUR_NETWORK_NAME</string> </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>NetNXT - Twingate Config</string>
    <key>PayloadIdentifier</key>
    <string>com.netnxt.profile.twingate</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>12345678-1111-2222-3333-444455556666</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Step 2: Upload to JumpCloud

  1. Go to Device Management > Policy Management > (+) > Mac > MDM Custom Profile.

  2. Upload the file.

  3. Bind to your Mac Group.

Step 3: Install the Client (Command)

Use a JumpCloud Command (Run as Root) to install the standalone PKG.

#!/bin/bash
# Download and Install Twingate Standalone Client
PKG_URL="https://binaries.twingate.com/client/macos/latest/Twingate.pkg"
TEMP_PATH="/tmp/Twingate.pkg"

echo "Downloading Twingate..."
curl -L -o "$TEMP_PATH" "$PKG_URL"

echo "Installing..."
installer -pkg "$TEMP_PATH" -target /

rm "$TEMP_PATH"
exit 0

Part 2: Windows Deployment (MSI Arguments)

For Windows, we can pass the Network Name directly to the MSI installer using command-line arguments.

  • Command Name: Install - Twingate Client (Windows)

  • Language: PowerShell

  • Script:

# Configuration
$NetworkName = "netnxt" # Your Twingate Subdomain
$MsiUrl = "https://binaries.twingate.com/client/windows/latest/TwingateWindowsInstaller.msi"
$DownloadPath = "C:\Windows\Temp\Twingate.msi"

# 1. Download
Write-Host "Downloading Twingate MSI..."
Invoke-WebRequest -Uri $MsiUrl -OutFile $DownloadPath

# 2. Install with Parameters
# NETWORK= sets the tenant URL
# /qn = Quiet installation
Write-Host "Installing..."
Start-Process "msiexec.exe" -ArgumentList "/i $DownloadPath NETWORK=$NetworkName /qn /norestart" -Wait

# 3. Cleanup
Remove-Item $DownloadPath -Force
Write-Host "Installation Complete."

FAQ

1) Why is a configuration profile required before installing Twingate on macOS?

macOS blocks network extensions by default. The mobileconfig profile pre-approves Twingate system extensions and sets the network name, preventing user prompts and ensuring seamless zero-touch deployment.

2) How does the Twingate network name get pre-filled for users?

On macOS it’s set via a custom configuration profile, while on Windows it’s passed directly as an MSI argument during installation, eliminating manual tenant entry.

3) Can Twingate be deployed silently using JumpCloud?

Yes. JumpCloud Commands install the PKG on macOS and MSI on Windows silently, allowing users to sign in via SSO without configuration or administrative interaction.

4) How do administrators verify successful Twingate client deployment?

On macOS, confirm the client installs without system extension prompts. On Windows, launch the client and verify it skips network entry and proceeds directly to authentication.

Was this article helpful?