Build
Generate deployment-ready artifacts from your compliance baseline.
Scripts, configuration profiles, DDM declarations, and more with a single build operation.
What Does Build Do?
When you click Build, MACE takes all your enabled compliance rules and generates files you can actually deploy to your Macs. Think of it like compiling code: you've configured your rules, now MACE creates the deliverables.
These deliverables fall into several categories:
Scripts
Shell scripts that run on Macs to check compliance status and fix non-compliant settings. Your MDM runs these scripts and reports results back.
Configuration Profiles
XML files that configure Mac settings automatically. Your MDM pushes these to devices and macOS applies the settings. No scripts needed.
DDM Declarations
Apple's modern management format. The device enforces settings autonomously instead of waiting for MDM commands.
Supporting Files
CSV exports, audit plists, and baseline files for documentation, tracking, and compatibility with other tools.
Why You Need All Three
A complete security baseline requires a combination of scripts, configuration profiles, and DDM. No single method can enforce everything.
Why not just use one?
Scripts alone won't work because some settings can only be enforced by macOS through profiles. A script can enable the firewall, but a user could disable it afterward. A profile locks it so they can't.
Profiles alone won't work because Apple doesn't provide profile payloads for every security setting. Many settings (like checking SIP status or audit configurations) have no profile equivalent and must be checked via script.
DDM alone won't work because it's newer (macOS 13+), not all MDMs fully support it, and not all settings have DDM declarations yet.
The solution: MACE generates all three from the same rule set. Each rule knows whether it needs a script, a profile, DDM, or a combination. When you build, MACE creates the right output for each rule automatically.
Understanding the Output Types
Scripts vs Profiles: What's the Difference?
This is one of the most important concepts to understand:
🔍 Scripts Check & Fix
Scripts run commands on the Mac. They can read current settings, compare against expected values, and execute fixes. Scripts are flexible but require the MDM to trigger them.
Example: A script runs defaults read to check if the firewall is enabled, then runs socketfilterfw --setglobalstate on to enable it if not.
⚙️ Profiles Configure
Profiles declare settings that macOS enforces automatically. Once installed, the Mac maintains those settings. Users often can't change them.
Example: A profile declares askForPassword = true for the screensaver. macOS enforces this setting and grays out the checkbox in System Settings.
When to use which?
- Profiles are preferred when available because they're enforced by macOS itself
- Scripts are needed when there's no profile payload for that setting, or when you need to check/report compliance status
- Most deployments use both: profiles to enforce settings, scripts to audit and fix what profiles can't handle
Why Multiple Profile Formats?
Different MDM solutions expect different file formats:
| 📱 | .mobileconfig | Standard Apple format. Works with any MDM and can be installed manually. |
| 🟢 | .plist (Jamf) | Jamf Pro's Custom Settings payload expects this format for preference domains. |
| 🔵 | .xml (Intune) | Microsoft Intune uses a specific XML schema for custom macOS settings. |
Build Pipeline
When you click Build, MACE processes your rules through these phases:
Build Options
The Build Hub organizes outputs into three main columns — Scripts, Profiles, and Audit & Reporting — plus Additional Outputs for extra export formats and Personalized Branding. Compliance rules can be enforced via shell scripts, configuration profiles, or DDM, so you choose the output formats that match your deployment workflow.
Scripts
Audit & remediate macOS security settings.
Master toggle for script generation. Creates zsh shell scripts that check and remediate security settings on macOS devices.
Adds the check/audit commands. These verify whether each setting is compliant, report pass/fail status, and log failures to /Library/Logs.
Adds the fix commands. These apply the correct settings to bring non-compliant settings into compliance when a check fails.
Controls how the script behaves when run, by setting FORCED_MODE in the script:
None (Empty): read the mode at runtime (command-line argument or Jamf $4).
--check: audit only.
--fix: remediate only.
--cfc: check, fix, then check again.
Combined: One script containing all rules. Easier to manage and run everything at once.
Individual: Separate script per rule. Useful when you need to deploy specific checks to your MDM.
Switches the Scripts column into Offline Script mode, which generates an installer that drops a LaunchDaemon and your compliance script onto the Mac. The script then runs automatically on a schedule you configure — no MDM check-in required for each run.
When to use: Devices that aren't always online, environments where you want continuous compliance without waiting for MDM check-ins, or when you want to ship one installer and have it self-maintain.
What gets generated: An installer script, an uninstaller script, and a suppression profile. Push the installer once from your MDM; the daemon handles future runs independently.
Standard vs Offline Script
Standard scripts run when your MDM triggers them. Each execution depends on a policy or check-in.
Offline Script installs a LaunchDaemon. The Mac runs the script on your chosen interval whether or not it's online or has checked in.
Profiles
Configuration profiles for deploying security settings via MDM.
Master toggle for profile generation. Creates .mobileconfig files for deploying security settings via MDM (Jamf, Intune, etc.).
Choose how profiles are packaged:
Combined Mobileconfig: a single .mobileconfig with all settings (supported by most MDM vendors).
Individual Mobileconfigs: separate files grouped by PayloadType for granular control.
Jamf Plist / Intune Plist: formats tailored to Jamf Pro's Custom Settings and Intune's custom profile format.
Most MDMs sign profiles automatically when deployed, but can modify them first. Pre-signing with a certificate from your Keychain locks the profile and shows it as "Verified" when installed.
Audit & Reporting
Audit exemptions and MDM compliance reporting.
Exempt rules from audit and remediation scripts. The compliance script reads these preferences to skip rules you've marked as exempt. Deploy via MDM or ~/Library/Preferences. The Output Format can be a mobileconfig (for MDM) or a plist.
Reports failed rules to your MDM for Smart Groups and dashboards. Generates extension-attribute scripts for Jamf, Iru, Intune, WS1, Addigy, and Fleet.
Additional Outputs
Extra export formats for documentation, scanning, and legacy workflows.
Declarative Device Management declarations. Apple's modern management format where the device enforces settings autonomously. Requires macOS 13+ and MDM support.
A YAML baseline compatible with the original mSCP Python scripts. Use this if you need to work with mSCP's generate_guidance.py or other mSCP tools.
Spreadsheet export of all rules — rule IDs, titles, check/fix commands, and framework references (NIST, DISA, CIS). Great for documentation, auditor reviews, or importing into other systems.
A Tenable/Nessus .audit file for vulnerability scanning. Use this if your organization uses Tenable for compliance tracking.
A JSON vendor manifest describing the generated artifacts — useful for automation and tooling that ingests the build output.
Personalized Branding
Customize author attribution and branding in generated files.
Your name and organization appear in generated files including script headers, profile metadata, and documentation. Helps identify who created this baseline.
Removes MACE attribution from generated files if your organization prefers unbranded outputs.
Output Directory Structure
After building, you'll find these files organized in your project's build/ folder:
build/
├── {baseline}_compliance.sh # Main compliance script
├── {baseline}.mobileconfig # Combined configuration profile
├── org.{baseline}.audit.plist # Audit preferences (for exemptions)
├── org.{baseline}.audit.mobileconfig # Audit prefs as profile (for MDM)
├── {baseline}.csv # Spreadsheet export
├── {baseline}.yaml # mSCP-compatible baseline
├── README.md # Deployment instructions
├── scripts/ # Individual scripts (if enabled)
├── mobileconfigs/ # Individual profiles (if enabled)
├── plists/ # Jamf plist files (if enabled)
├── intune/ # Intune XML files (if enabled)
├── signed/ # Signed profiles (if enabled)
└── declarative/ # DDM declarations (if enabled)
├── activations/
├── assets/
└── configurations/
Build Engines
mSCP Build Engine
Integration with the original mSCP Python scripts for organizations that need compatibility with existing workflows.
- Standard mSCP output formats
- Python-based execution
- Full mSCP compatibility
M.A.C.E. Build Engine
MACE's native Swift build engine. Fast, fully featured, and supports all customizations.
- Full ODV substitution
- All output formats
- Profile signing
- Custom rule support
- Direct MDM export
Starting a Build
Cmd+BMDM Export
In addition to generating files locally, the Build Hub can upload your compliance artifacts directly to your MDM. Select the MDM tab in the Build window to configure a connection and export.
Connect to your Jamf Pro server with API Client credentials or username/password. MACE generates scripts, profiles, and extension attributes, then uploads them to Jamf's Scripts, Configuration Profiles, and Extension Attributes objects automatically. You can upload as a combined object or individual items per rule, and configure naming prefixes.
Also supports Offline Script mode for Jamf — MACE uploads the installer and suppression profile directly to your Jamf server.
Connect to your Workspace ONE UEM tenant using Basic Auth or OAuth. MACE generates compliance scripts, profiles, and sensors, then uploads them to Workspace ONE. Configure your Organization Group and select which artifacts to upload.
Also supports Offline Script mode for Workspace ONE deployments.
Connect to Intune using your Azure AD tenant ID, client ID, and client secret. MACE generates compliance scripts, configuration profiles, and custom attributes, then uploads them to your Intune tenant. Configure naming and select which artifacts to push.
Also supports Offline Script mode for Intune deployments.
Connect to your Iru tenant to upload MACE's compliance scripts, profiles, and custom attributes directly. This integration is currently in beta — connection options and generated artifacts may change.
Connect to your Addigy account to push MACE's compliance profiles, scripts, and attribute checks. This integration is currently in beta — connection options and generated artifacts may change.
Connect to your Fleet instance to deploy MACE's compliance scripts and policies. This integration is currently in beta — connection options and generated artifacts may change.
Local Build vs MDM Export
Local Build generates files to a folder on your Mac. You then upload them to your MDM manually.
MDM Export generates the same files and uploads them directly to your MDM in one step. Each MDM tab has its own build options and connection settings independent of the Local Build tab.
What's Next?
After building, you need to deploy the generated files to your Macs. See these guides for detailed instructions:
- Scripts: How audit and remediation scripts work, and how to deploy them via MDM
- Configuration Profiles: How profiles enforce settings, and how to deploy them via MDM
- DDM Declarations: How Apple's declarative management works