New hires from Windows.
Productive on day one.

What IT gets

• An invoice in the company's name. The checkout by Polar, our merchant of record, asks for the business details and the VAT id, adds the tax that applies and issues the invoice.
• One key, one seat per user account. A Team key activates in up to 10 or 25 user accounts. A seat is one macOS user account on one Mac: each account keeps its own licence and its own 14-day trial, so a shared or lab Mac with three people's accounts takes three seats, and an account that never activated the key shows the trial, then Buy. The Polar customer portal lists each seat under its Mac's computer name, once for each account on that Mac. Settings → Licence → Deactivate this Mac, in that account, frees its seat when a person leaves or a machine is retired. A Mac set up with Migration Assistant from another Mac's account takes a seat of its own: activate it too before retiring the old one.
• Silent activation, for each person. The licence belongs to the user account the command runs in, so run it for every person who uses the Mac: /Applications/Contralto.app/Contents/MacOS/Contralto --license activate CONTRALTO-… "Finance MacBook 12" (the label is optional and defaults to the computer name). In Jamf, a policy on the Login trigger with the execution frequency Once per user per computer; in Intune, a shell script set to run as the signed-in user and assigned to a user group, which Intune applies to every user who logs in to the Mac. A policy that runs as root, as Jamf's do, puts launchctl asuser "$uid" sudo -u "$user" in front; run as root the command refuses, because the licence belongs to the person's account. In an account that already holds a seat on the key, the command only confirms it. --license status prints the account's state; --license deactivate frees its seat.
• The managed-permissions profile below, so the one permission the app needs is granted before the person opens it.
• Priority support at the address above, with a named contact and an answer the same working day.

Managed permissions (PPPC)

Contralto needs one permission, Accessibility, and macOS lets an MDM grant it with a Privacy Preferences Policy Control payload. The profile is a signed statement about our code: it names the bundle id app.contralto.mac and the Developer ID certificate the app is signed with, so it matches every release we ship and nothing else.

The profile is published with the first signed release: it names the certificate the app is signed with, which does not exist yet.

What it contains, and what it does not:

• Accessibility: allowed for app.contralto.mac. The keyboard shortcuts, the window switcher, snapping and the clipboard panel work from the first launch; Setup shows step 1 as done.
• Screen Recording: left to the user. Apple reserves this permission for the person at the Mac; no profile can grant it. The payload uses AllowStandardUserToSetSystemService, so a standard user can switch it on for the Alt+Tab previews without an administrator. Without it the switcher shows app icons, which is fine for most teams.
• The helper: pre-approved as a managed background item (a com.apple.servicemanagement rule for our team id). The rule approves the helper but does not install it; the app does that, once per Mac, from the script that deploys it, as the logged-in user: /Applications/Contralto.app/Contents/MacOS/Contralto --helper install prints Installed and approved. From then on Login Items shows no prompt, and in administrator accounts the firewall and Touch-ID-for-sudo settings ask for no password. The helper acts for administrators only: in a standard account, and on any Mac until it is installed, those two settings ask for an administrator's name and password. Where people work in standard accounts, turn the firewall on with your MDM's own Firewall payload (com.apple.security.firewall) instead; Touch ID for sudo matters only to accounts that may use sudo, by default the administrators.

PPPC payloads are honoured only on Macs enrolled in MDM (user-approved enrollment or Automated Device Enrollment) and deployed at device scope. They do not install the app.

Jamf Pro

1. Computers → Content Management → Configuration Profiles → Upload → choose the .mobileconfig. Jamf shows the Privacy Preferences Policy Control and Managed Login Items payloads it contains; leave them as they are.
2. Scope it to the computers or the smart group that gets Contralto. Distribution method: Install Automatically.
3. Deploy the app with a policy (Package the .dmg's app into a .pkg with Composer or Jamf Admin, or use a script that copies it into /Applications) and, in the same policy, a script that installs the helper as the logged-in user (the helper command above).
4. Activate the licence with a second policy: a script with the activation command above, trigger Login, execution frequency Once per user per computer, so every person who logs in to the Mac takes a seat for their own account.
5. Verify on one Mac: System Settings → Privacy & Security → Accessibility lists Contralto as on and greyed out, Login Items & Extensions shows the helper as managed, and --helper status prints Installed and approved.

Microsoft Intune

1. Devices → macOS → Configuration → Create → New policy → Templates → Custom. Upload the .mobileconfig; deployment channel Device channel.
2. Assign it to the device group that gets Contralto.
3. Deploy the app as a macOS app of type DMG (Apps → macOS → Add → macOS app (DMG)) with the bundle id app.contralto.mac and the version from the download page, then a shell script (Devices → macOS → Shell scripts) that runs the helper install command as the signed-in user.
4. Activate the licence with a second shell script: the activation command above, Run script as signed-in user set to Yes, assigned to the user group, so every person who logs in to the Mac takes a seat for their own account.
5. Verify on one Mac as above.

Questions teams ask

Does the app send anything out?

No analytics, no account. The licence key is confirmed with Polar every 7 days; updates are checked against our feed once a day if allowed, and downloaded from this site when the person accepts one, or in the background to install at quit if they chose automatic updates in the updater's window; app installs from the Apps screen download from the makers' servers. The privacy policy lists every request and what it carries.

Can we turn parts of it off for everyone?

Every behaviour has its own switch and the choices live in the app's preferences domain (app.contralto.mac), so a managed preference or a script can preset them; write to us for the key list. They are starting values, not a lock: the person can still change any switch in the app, and a value a profile forces takes effect again only the next time the app opens. Terminals and remote desktops keep the real Ctrl by default, and the exclusion list takes any bundle id.

What happens at offboarding?

Restore every system setting puts the Mac back exactly, Deactivate this Mac (or --license deactivate in the offboarding script, as that user) frees the account's seat and removes its key (on a shared Mac, in every account that activated the key, or free those seats in the customer portal), Settings → Admin helper → Remove (or --helper remove in the offboarding script, as the logged-in user) unregisters the helper, and dragging the app to the Trash removes it. After Restore and Remove, nothing stays at the system level; without Restore, the settings it changed stay as they are, including screenshots going to the clipboard instead of a file.