Deploy LibreOffice on macOS Fleets via MDM Profiles

Deploying LibreOffice across a fleet of macOS devices requires combining Mobile Device Management (MDM) deployment commands with custom Apple configuration profiles (.mobileconfig). This guide explains how to package LibreOffice for silent installation, configure privacy and security permissions via Privacy Preferences Policy Control (PPPC) profiles, and manage enterprise settings to ensure a seamless, non-disruptive deployment across all managed Mac endpoints.

Step 1: Prepare the LibreOffice Installer

LibreOffice provides standard disk images (.dmg) directly from its official site, but automated MDM distribution requires an Apple installer package (.pkg).

1. Download the latest stable LibreOffice release architecture for your fleet (Apple Silicon/ARM64 or Intel/x86_64).
2. Convert the .dmg into a standard .pkg using packaging tools such as pkgbuild, Jamf Composer, or AutoPkg.
3. Sign the .pkg with a recognized Apple Developer ID Installer certificate to ensure Gatekeeper accepts the payload without manual user intervention.

Step 2: Configure PPPC (TCC) Configuration Profile

Modern versions of macOS require user permission for applications to access sensitive folders such as Documents, Downloads, and Desktop. To prevent prompt fatigue and ensure background operations succeed, deploy a Privacy Preferences Policy Control (PPPC) configuration profile.

Create a .mobileconfig file containing a com.apple.TCC.configuration-profile-policy payload with the following values:

• Identifier: org.libreoffice.script
• Identifier Type: bundleID
• Code Requirement: Run codesign -dr - /Applications/LibreOffice.app in Terminal to extract the designated requirement string.
• Services Allowed:
  • SystemPolicyDocumentsFolder (Allow)
  • SystemPolicyDesktopFolder (Allow)
  • SystemPolicyDownloadsFolder (Allow)

Deploy this configuration profile to your target device groups before or alongside the software installation.

Step 3: Manage Enterprise Preferences with Custom Settings

To standardize settings across your fleet—such as disabling automatic update checks, setting default file formats (e.g., OOXML vs. ODF), and opting out of telemetry—create a custom plist configuration profile under the domain org.libreoffice.script.

An example configuration payload structure:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>org.libreoffice.script</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadIdentifier</key>
            <string>com.company.libreoffice.settings</string>
            <key>PayloadUUID</key>
            <string>YOUR-GENERATED-UUID-HERE</string>
            <key>PayloadEnabled</key>
            <true/>
            <!-- Custom enterprise settings -->
            <key>ooSetupShowIntro</key>
            <false/>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>LibreOffice Fleet Settings</string>
    <key>PayloadIdentifier</key>
    <string>com.company.libreoffice</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>YOUR-MAIN-PROFILE-UUID</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Step 4: Deploy via Your MDM Solution

1. Upload the PKG: Add the signed LibreOffice .pkg to your MDM server (such as Jamf Pro, Microsoft Intune, Kandji, or SimpleMDM).
2. Upload Configuration Profiles: Add the PPPC profile and the custom settings profile to your MDM repository.
3. Scope and Assign: Assign both the installer package and configuration profiles to target device groups or dynamic smart groups.
4. Trigger Installation: Deploy using the MDM vendor’s standard install command (InstallEnterpriseApplication via the Apple MDM protocol).

Step 5: Verification and Fleet Testing

Verify the deployment on a test Mac by performing the following checks:

1. Confirm profile installation under System Settings > Privacy & Security > Profiles.
2. Verify that /Applications/LibreOffice.app is present and functional.
3. Open LibreOffice to ensure no Gatekeeper warnings or permission prompts appear for managed directories.