Preferences reference

Every managed preference key App Auto-Patch 4 reads from the xyz.techitout.appAutoPatch preference domain (78 keys). A managed value overrides the matching control in the Settings window; leave a key unset to use its default.

This page is generated from the profile manifest published with each release. See Configuration profiles to import the manifests into ProfileCreator, iMazing Profile Editor or Jamf Pro.

• Download the iMazing Profile Editor manifest (.plist, settings grouped in tabs)
• Download the ProfileCreator manifest (.json)
• Download the Jamf Pro custom schema

Most admins only need these

The baseline profile sets the ones marked “in the baseline”; the others are common additions. Everything else keeps its default. The quick start explains the choices.

• InstallomatorOptions: User Experience / Advanced Behavior / Network & Process › Installomator options. Default NOTIFY=silent LOGO=appstore. In the baseline.
• BackgroundPatchClosedAppsScheduler: Background Patching › Scheduler. Default inApp. In the baseline.
• DiscoveryFrequency: App Discovery › Automatic discovery frequency (hours). Default 0. In the baseline.
• PatchWeekStartDay: Patching Cadence › Anchor weekday. Default 2. In the baseline.
• DaysUntilReset: Patching Cadence › Reset cycle after (days). Default 1. In the baseline.
• DeadlineDaysFocus: Focus Deferral › Day limit. No default (unset). In the baseline.
• DeadlineDaysHard: Hard Deadline › Day limit. No default (unset). In the baseline.
• AggressivePatchDayDeferral: Hard Deadline › Aggressive patch-day deferral. Default false. In the baseline.
• DeferralTimerDefault: Default Deferral Timer › Delay (minutes). Default 60. In the baseline.
• DeferralTimerMenu: Default Deferral Timer › Deferral menu. No default (unset). In the baseline.
• DialogTimeoutDeferral: Default Deferral Timer › Dialog timeout. Default 300. In the baseline.
• DialogTimeoutDeferralAction: Default Deferral Timer › Dialog timeout action. Default defer. In the baseline.
• DeferralDialogPrimaryButton: Default Deferral Timer › Primary button. Default update. In the baseline.
• HardDeadlineDialogAllowClose: Hard Deadline › Allow closing the dialog. Default false. In the baseline.
• IgnoredLabels: App Labels › Ignored. No default (unset). In the baseline.
• IgnoreExternalDrives: App Discovery › Ignore apps on external drives. Default false. In the baseline.
• DiscoverSelfUpdateLabel: Self-Update › Show App Auto-Patch in the app list. Default true. In the baseline.
• LockSettings: Managed Only › Lock settings. Default false. In the baseline.
• ManagedSilentLaunchEnabled: Managed Only › Silent launch. No default (unset). In the baseline.
• MenuBarConcealAdvancedActions: Menu Bar › Conceal Settings and Quit. No default (unset). In the baseline.
• MenuBarHideQuit: Menu Bar › Hide Quit. Default false. In the baseline.
• SupportTeamName: Support › Team. No default (unset). In the baseline.
• SupportTeamEmail: Support › Email. No default (unset). In the baseline.
• SupportTeamPhone: Support › Phone. No default (unset). In the baseline.
• SupportTeamWebsite: Support › Website. No default (unset). In the baseline.
• BackgroundPatchClosedAppsEnabled: Background Patching › Silently patch apps that aren’t currently open. Default true.
• BackgroundPatchClosedAppsIntervalHours: Background Patching › Run every (hours). Default 4.
• BackgroundPatchStartupJitterMaxMinutes: Background Patching › Startup jitter maximum (minutes). Default 0.
• PatchingEndTime: Hard Deadline › Patching end time. No default (unset).
• DeadlineCountHard: Hard Deadline › Count limit. No default (unset).
• RequiredLabels: App Labels › Required. No default (unset).
• BusinessHoursStartTime: Business Hours › Start. No default (unset).
• BusinessHoursEndTime: Business Hours › End. No default (unset).
• TelemetryEnabled: Anonymous usage data › Send anonymous usage data. Default true.

Installomator Version

InstallomatorVersion

Setting: Version · Type: string · Default: main · Allowed: release, main, custom

Installomator source that App Auto-Patch downloads and uses for discovery and patching. release: the latest tagged Installomator release. main: the main branch of Installomator/Installomator. custom: the repository and branch set in InstallomatorVersionCustomRepoPath and InstallomatorVersionCustomBranchName. Case-insensitive; an unrecognized value uses main. Default: main.

InstallomatorVersionCustomRepoPath

Setting: Custom repo path · managed only (no Settings control) · Type: string

GitHub owner/repository to download Installomator from, for example MyOrg/Installomator. Used only when InstallomatorVersion is custom. Default: Installomator/Installomator.

InstallomatorVersionCustomBranchName

Setting: Custom branch name · managed only (no Settings control) · Type: string · Default: main

Branch of the custom repository to download. Used only when InstallomatorVersion is custom. Default: main.

InstallomatorUpdateDisable

Setting: Disable Installomator updates · managed only (no Settings control) · Type: boolean · Default: false

When true, App Auto-Patch does not download or replace Installomator.sh or fragments/. LabelVersionHelper.zsh is still refreshed. Use this when MDM pushes its own Installomator payload. A string TRUE or FALSE is accepted. Default: false.

GitHub API

GitHubAPIAuthEnabled

Setting: Authenticate API requests · Type: boolean · Default: false

When true, api.github.com requests that check Installomator send GitHubAPIToken. The rate limit rises from 60 to 5,000 requests an hour. A missing token makes those requests fail instead of going out unauthenticated. Archive downloads on github.com are unchanged. A string TRUE or FALSE is accepted. Also editable in Settings. Default: false.

GitHubAPIToken

Setting: Personal access token · Type: string

Personal access token used when GitHubAPIAuthEnabled is true. A fine-grained token needs Contents: Read on the repositories App Auto-Patch queries. The value is not written to the log. Also editable in Settings. Default: empty.

User Experience / Advanced Behavior / Network & Process

InstallomatorOptions

Setting: Installomator options · Type: string · Default: NOTIFY=silent LOGO=appstore

Space-separated KEY=VALUE options passed to every Installomator run. The Installomator tab builds this one string from three sections. User Experience: NOTIFY, BLOCKING_PROCESS_ACTION, LOGO and REOPEN. Advanced Behavior: IGNORE_APP_STORE_APPS, SYSTEMOWNER and INSTALL=force. Network & Process: INTERRUPT_DND, IGNORE_DND_APPS, PROXY and PROMPT_TIMEOUT. Other options are passed through unchanged. Background patching of closed apps always uses BLOCKING_PROCESS_ACTION=tell_user. IGNORE_DND_APPS is an Installomator option and is separate from the IgnoreDNDApps key. Apps with a Mac App Store receipt are left to the App Store and kept out of the pending count, Update All and deadlines unless IGNORE_APP_STORE_APPS=yes. Default: NOTIFY=silent LOGO=appstore. BLOCKING_PROCESS_ACTION is omitted, so Installomator uses tell_user.

Default Deferral Timer

DeferralTimerDefault

Setting: Delay (minutes) · Type: integer · Default: 60

Minutes App Auto-Patch waits before showing the update prompt again after the user defers. Accepts an integer or a numeric string. Default: 60.

DeferralTimerMenu

Setting: Deferral menu · managed only (no Settings control) · Type: string

Comma-separated deferral lengths, in minutes, offered in the deferral dialog, for example 30,60,240,1440. Entries that aren’t positive whole numbers are ignored. When unset or empty, the menu is DeferralTimerDefault, 60, 120 and 240. Default: unset.

DialogTimeoutDeferral

Setting: Dialog timeout · managed only (no Settings control) · Type: integer · Default: 300 · Minimum: 1

Seconds the deferral dialog stays open before DialogTimeoutDeferralAction is applied. At a hard deadline it also sets the countdown before installation starts. Values below 1 are treated as 1. Accepts an integer or a numeric string. Default: 300.

DialogTimeoutDeferralAction

Setting: Dialog timeout action · managed only (no Settings control) · Type: string · Default: defer · Allowed: defer, continue

What happens when the deferral dialog times out. defer: the updates are deferred. continue: the updates are installed. Case-insensitive; other values are ignored. At a hard deadline the dialog always continues. Default: defer.

DeferralDialogPrimaryButton

Setting: Primary button · managed only (no Settings control) · Type: string · Default: update · Allowed: update, defer

Which deferral-dialog button is the default (blue, Return-key) action. update: the Update button. defer: the Defer button, so an accidental Return press doesn’t start an install. Other values behave as update. Has no effect at a hard deadline, where there is no Defer button. Default: update.

DeferralTimerError

Setting: Retry after an update error · managed only (no Settings control) · Type: integer · Default: 60 · Minimum: 1

Minutes to wait before another attempt after an Update All finishes with one or more errors. This wait replaces restarting the prompt on DialogTimeoutDeferral. Values below 1 are treated as 1. Accepts an integer or a numeric string. Ignored when WorkflowUpdateAllErrorCompletesPatching is true. Default: 60.

Focus Deferral

DeadlineCountFocus

Setting: Count limit · Type: integer

Number of automatic focus deferrals allowed. While Focus, Do Not Disturb or a display-sleep assertion is active, App Auto-Patch defers automatically and hides the dialog until this limit or DeadlineDaysFocus is reached; dialogs then continue normally. Clamped to at least 1 below DeadlineCountHard. Accepts an integer or a numeric string. Unset: no count limit. With both focus limits unset there are no automatic focus deferrals.

DeadlineDaysFocus

Setting: Day limit · Type: integer

Days from the start of the patch cycle during which automatic focus deferrals are allowed. Interchangeable with DeadlineCountFocus: whichever is reached first ends automatic deferrals. Clamped to at least 1 below DeadlineDaysHard. Accepts an integer or a numeric string. Unset: no day limit.

DeferralTimerFocus

Setting: Automatic deferral (minutes) · Type: integer · Default: 60

Minutes an automatic focus deferral waits before checking again. Accepts an integer or a numeric string. Default: 60.

FocusDeferralNotificationsEnabled

Setting: Notify during an automatic focus deferral · Type: boolean · Default: false

When true, an automatic focus deferral posts a notification; clicking it opens the deferral dialog. The dialog itself stays hidden either way. Default: false.

IgnoreDNDApps

Setting: Ignore display-sleep apps · Type: string · Default: ""

Comma-separated process names to ignore when checking for display-sleep assertions, for example Google Chrome,caffeinate. coreaudiod is always ignored. Focus and Do Not Disturb are still detected. Default: empty.

Hard Deadline

DeadlineCountHard

Setting: Count limit · Type: integer

Number of user deferrals allowed before installation is required. Accepts an integer or a numeric string. Unset: no count limit.

DeadlineDaysHard

Setting: Day limit · Type: integer

Days from the start of the patch cycle before installation is required, regardless of deferrals. Accepts an integer or a numeric string. Unset: no day limit.

HardDeadlineDialogAllowClose

Setting: Allow closing the dialog · managed only (no Settings control) · Type: boolean · Default: false

When true, the user may close the required-update dialog after a hard deadline. The enforcement countdown continues, and reminders are posted 60, 30 and 5 minutes before installation. Default: false (the dialog can’t be closed).

AggressivePatchDayDeferral

Setting: Aggressive patch-day deferral · managed only (no Settings control) · Type: boolean · Default: false

When true, deferral options on the hard-deadline day are capped by the time left until PatchingEndTime: more than 6 hours left, 120 minutes; 3–6 hours, 60; 1–3 hours, 30; 30–60 minutes, 15; under 30 minutes, 5. After PatchingEndTime no deferral is offered. Default: false.

PatchingEndTime

Setting: Patching end time · managed only (no Settings control) · Type: string · Format: ^([01][0-9]|2[0-3]):[0-5][0-9]$

End of the patching window used by AggressivePatchDayDeferral, as HH:mm (24-hour), for example 17:00. Unset: 17:00.

Patching Cadence

PatchWeekStartDay

Setting: Anchor weekday · Type: integer · Default: 2 · Allowed: 1 (Sunday), 2 (Monday), 3 (Tuesday), 4 (Wednesday), 5 (Thursday), 6 (Friday), 7 (Saturday)

Weekday that starts each weekly patch cycle: 1 = Sunday through 7 = Saturday. Used when MonthlyPatchingCadenceEnabled is false. Accepts an integer or a numeric string. Default: 2 (Monday).

DaysUntilReset

Setting: Reset cycle after (days) · Type: integer · Default: 1

Days after CurrentPatchingStartDate before deferral counts and deadlines reset and a new patch cycle begins. 7 is weekly and 14 is every other week. Monthly cadence uses the next matching weekday instead. Accepts an integer or a numeric string. Default: 1.

MonthlyPatchingCadenceEnabled

Setting: Use monthly cadence (Nth weekday of the month) · Type: boolean · Default: false

When true, each patch cycle starts on the weekday of the month set by MonthlyPatchingCadenceOrdinalValue and MonthlyPatchingCadenceWeekdayIndex instead of PatchWeekStartDay. Default: false.

MonthlyPatchingCadenceOrdinalValue

Setting: Occurrence · Type: string · Default: second · Allowed: first, second, third, fourth, fifth, final (Last)

Which occurrence of MonthlyPatchingCadenceWeekdayIndex starts the monthly cycle: first, second, third, fourth, fifth or final (the last one in the month). Must be a string; a number is ignored. Case-insensitive; an unrecognized value uses second. Default: second.

MonthlyPatchingCadenceWeekdayIndex

Setting: Weekday · Type: string · Default: tuesday · Allowed: sunday, monday, tuesday, wednesday, thursday, friday, saturday

Weekday that starts the monthly cycle: sunday through saturday. Must be a string; a number is ignored. Case-insensitive; an unrecognized value uses tuesday. Default: tuesday.

MonthlyPatchingCadenceStartTime

Setting: Start time · managed only (no Settings control) · Type: string · Default: 09:00:00

Local time of day for the monthly cadence, as HH:mm:ss, for example 09:00:00. App Auto-Patch reads this key, but the monthly cycle currently starts on the configured day regardless of the time. Setting it locks the Deferrals settings, as any deferral key does. Default: 09:00:00.

Business Hours

BusinessHoursStartTime

Setting: Start · Type: string

Start of business hours, as HH:mm (24-hour), for example 08:00. When both start and end are set, a hard-deadline install of open apps waits until business hours end; the user still sees the prompt and can install sooner. Background patching of closed apps isn’t affected. Windows that cross midnight, such as 22:00 to 06:00, are supported. Unset: no business-hours hold.

BusinessHoursEndTime

Setting: End · Type: string

End of business hours (exclusive), as HH:mm (24-hour), for example 17:00. See BusinessHoursStartTime. Unset: no business-hours hold.

Admin Test Mode

AdminTestModeEnabled

Setting: Show Admin Test Mode · managed only (no Settings control) · Type: boolean · Default: false

When true, Settings › Deferrals shows the Admin Test Mode panel. It lets an admin override the patch-cycle anchor, deferral counts and next launch, and trigger the deferral and hard-deadline prompts and a test notification. Its actions bypass normal deferral guards, so don’t deploy true to production Macs. Default: false.

App Labels

IgnoredLabels

Setting: Ignored · Type: array of strings

Installomator labels skipped during discovery. Wildcards * and ? are supported, for example microsoft* zoom*. A space-separated string, an array containing one space-separated string, or an array with one label per string. When no ignored labels are set, App Auto-Patch seeds this list once per user: microsoft*, googlechrome*, jamfconnect, zoom*, 1password*, firefox*, homebrew, androidstudio.

RequiredLabels

Setting: Required · Type: array of strings

Installomator labels that are always included, even when an IgnoredLabels pattern also matches them. Wildcards are supported. A space-separated string, an array containing one space-separated string, or an array with one label per string. Default: empty.

OptionalLabels

Setting: Optional · Type: array of strings

Installomator labels that are discovered and shown but not installed automatically. Wildcards are supported. A space-separated string, an array containing one space-separated string, or an array with one label per string. Default: empty.

Version Comparison

VersionComparisonMethod

Setting: Method · Type: string · Default: IS_AT_LEAST · Allowed: IS_AT_LEAST (At least (recommended)), EQUAL_TO (Exact match)

How an installed version is compared with the latest version. IS_AT_LEAST: up to date when the installed version is the same or newer. EQUAL_TO: up to date only when the versions match exactly. Case-insensitive; other values are ignored. Default: IS_AT_LEAST.

VersionComparisonInstallomatorFallback

Setting: Allow Installomator fallback when label version is unknown · Type: boolean · Default: true

When true, a label whose latest version can’t be read from its metadata may run Installomator in DEBUG mode during Check for Updates to find it. This uses more bandwidth. Default: true.

Webhooks

WebhookFeature

Setting: Feature · Type: string · Default: off · Allowed: off, all, failures (Failures Only)

When to post a run summary to the webhook URLs. off: never. all: after every run with results. failures: only when an update fails. Case-insensitive; an unrecognized value uses off. Default: off.

WebhookURLSlack

Setting: Slack Webhook URL · Type: string

Slack incoming-webhook URL. Used when WebhookFeature is all or failures. Default: unset.

WebhookURLTeams

Setting: Teams Webhook URL · Type: string

Microsoft Teams Workflows webhook URL. An Office 365 connector URL does not receive the card. Used when WebhookFeature is all or failures. Default: unset.

Helper

AutoResetHelperOnLaunch

Setting: Automatically reset the helper if it stops responding · Type: boolean · Default: true

When true, App Auto-Patch unregisters and re-registers its root helper when the helper is registered but not responding, or when the helper binary has changed since it was last registered (for example after an upgrade). At most once per launch and once per hour. macOS may ask the user to approve the helper again. Default: true.

Self-Update

DiscoverSelfUpdateLabel

Setting: Show App Auto-Patch in the app list · Type: boolean · Default: true

When true, App Auto-Patch itself (SelfUpdateLabel) appears in the dashboard update list. Set false to hide it. While self-update is on it is always hidden, because the self-update scheduler updates it. Default: true.

SelfUpdateEnabled

Setting: Automatically update App Auto-Patch itself · Type: boolean · Default: false

When true, App Auto-Patch checks for its own updates with SelfUpdateLabel at SelfUpdateFrequency and installs them in the background. AppSelfUpdateEnabled overrides this key when set. Default: false.

AppSelfUpdateEnabled

Setting: Automatic update override · managed only (no Settings control) · Type: boolean

Overrides SelfUpdateEnabled when set, turning self-update on (true) or off (false). Default: unset.

SelfUpdateLabel

Setting: Installomator label · Type: string · Default: appautopatch4

Installomator label used to update App Auto-Patch 4. The default reads the build number from downloads.appautopatch.app. The 3.x label appautopatch does not see 4.x releases. Change it only for a private Installomator fork. A blank value is ignored. Default: appautopatch4.

SelfUpdateFrequency

Setting: Check frequency · Type: string · Default: daily · Allowed: daily, weekly, monthly

How often self-update checks run: daily, weekly or monthly. Case-insensitive; an unrecognized value uses daily. Default: daily.

App Discovery

IgnoreExternalDrives

Setting: Ignore apps on external drives · Type: boolean · Default: false

When true, installed apps on volumes other than the boot volume (external disks, disk images, network mounts, Time Machine backups) are excluded from discovery. /Applications, /Applications/Utilities and ~/Applications on the boot volume are always scanned. Default: false.

IgnoreFilePaths

Setting: Additional ignored paths · Type: array of strings

Case-insensitive substrings; an installed app whose path contains any of them is excluded from discovery. These add to four built-in exclusions: /Daemon Containers/, /Library/Application Support/JAMF/Composer/, /Applications/Chrome Apps.localized/ and /Applications/Edge Apps.localized/. Array of strings, or one space-separated string. Use an array for paths that contain spaces. Default: empty.

DiscoveryFrequency

Setting: Automatic discovery frequency (hours) · Type: integer · Default: 0 · Minimum: 0

Hours between automatic root-helper discovery and update checks. Unset or 0 leaves the schedule off. Mid-cycle runs refresh the GUI and menu bar inventory only; notifications and the deferral dialog wait until NextAutoLaunch. Cadence reset (monthly or DaysUntilReset) always rediscovers immediately with the full notify/dialog path. Independent of background closed-app patching. Default: unset (off).

Update All errors

WorkflowUpdateAllErrorCompletesPatching

Setting: Mark the cycle complete when Update All has errors · Type: boolean · Default: false

When true, an Update All that finishes with one or more errors still records the patching cadence as complete until the next reset, and App Auto-Patch does not retry. When false, the still-pending apps are tried again after DeferralTimerError minutes. Default: false.

Background Patching

WorkflowStageUpdates

Setting: Download installers before installing · Type: boolean · Default: true

When true, each detected update’s installer is downloaded to a local staging folder before any install, including background patching of closed apps, and later installs reuse it. When false, installers are downloaded at install time. Default: true.

BackgroundPatchClosedAppsEnabled

Setting: Silently patch apps that aren’t currently open · Type: boolean · Default: true

When true, App Auto-Patch periodically checks for updates and silently installs them for apps that aren’t running. Open apps are left to Update All and deferrals. Default: true.

BackgroundPatchClosedAppsScheduler

Setting: Scheduler · Type: string · Default: inApp · Allowed: inApp (In-app), helperDaemon (Helper daemon)

Where background patching is scheduled. inApp: inside App Auto-Patch; it stops when the user quits the app. helperDaemon: inside the root helper; it keeps running after the user quits, which suits managed Macs. Also accepts app and helper; an unrecognized value uses inApp. Default: inApp.

BackgroundPatchClosedAppsIntervalHours

Setting: Run every (hours) · Type: integer · Default: 4 · Range: 1 to 24

Hours between background patching passes, 1–24. Values outside the range are clamped. Default: 4.

BackgroundPatchClosedAppsRequireOnAC

Setting: Only when on power adapter · Type: boolean · Default: true

When true, background passes are skipped while the Mac is on battery. Default: true.

BackgroundPatchClosedAppsNotifyOnCompletion

Setting: Show a notification when a background pass finishes · Type: boolean · Default: true

When true, a notification is posted when a background pass starts and when it finishes. Default: true.

UpdatesAvailableNotificationsEnabled

Setting: Show a notification when new updates become available · Type: boolean · Default: true

When true, a notification is posted the first time Check for Updates finds more pending updates than were last notified. Not posted while the App Auto-Patch window is in front. Default: true.

BackgroundPatchClosedAppsAllowList

Setting: Allow list (optional) · Type: array of strings

When not empty, only these Installomator labels are patched in the background. Array of strings, or one space-separated string. Default: empty.

BackgroundPatchClosedAppsBlockList

Setting: Block list · Type: array of strings

Installomator labels never patched in the background, even when they’re on the allow list. Array of strings, or one space-separated string. Default: empty.

BackgroundPatchStartupJitterMaxMinutes

Setting: Startup jitter maximum (minutes) · managed only (no Settings control) · Type: integer · Default: 0 · Minimum: 0

Maximum random delay, in minutes, before the first background pass. Each Mac picks a delay between 0 and this value once per patch cycle and keeps it across restarts, so a fleet doesn’t patch all at once. 0 turns jitter off; negative values are treated as 0. 60–240 suits most fleets. Default: 0.

TemporaryNotificationTypes

Setting: Temporary notification types · managed only (no Settings control) · Type: array of strings

Notification types to post as temporary banners from the main app. Allowed: backgroundPatchStarted, backgroundPatchCompleted, backgroundPatchFailed, updatesAvailable, acPowerRequired, deferralResuming, hardDeadlineReminder, selfUpdateAvailable. Unlisted types keep their built-in routing: informational background-patch events are temporary and action-required events are persistent. A type in both lists is persistent. Unknown names are ignored and logged. Default: empty.

PersistentNotificationTypes

Setting: Persistent notification types · managed only (no Settings control) · Type: array of strings

Notification types to post as persistent alerts from App Auto-Patch Notification (bundle ID xyz.techitout.appAutoPatch-persistent). Allowed: backgroundPatchStarted, backgroundPatchCompleted, backgroundPatchFailed, updatesAvailable, acPowerRequired, deferralResuming, hardDeadlineReminder, selfUpdateAvailable. Unlisted types keep their built-in routing. This list wins when a type is in both lists. Unknown names are ignored and logged. Default: empty.

Debug

VerboseMode

Setting: Verbose Mode · Type: boolean · Default: false

When true, adds [VERBOSE] lines (per-label discovery timings, full Installomator output, retry decisions) to /Library/Application Support/AppAutoPatch/logs/aap.log. Patching behavior doesn’t change. Default: false.

DebugMode

Setting: Debug Mode · Type: boolean · Default: false

Same effect as VerboseMode: either one turns on [VERBOSE] logging. Default: false.

Anonymous usage data

TelemetryEnabled

Setting: Send anonymous usage data · Type: boolean · Default: true

When true, the app sends anonymous TelemetryDeck signals for update checks, the number of applications a finished patch updated, and diagnostic bundle creation. A background pass and a patch started from the app are counted separately. The number is a numeric value, not an app name. Signals do not include app names, user names, paths, or serial numbers. A launch does not send its own signal. Only the App Auto-Patch app sends signals; the root helper and XPC service do not. Set false to turn this off. The Settings toggle is disabled while this key is managed. Default: true.

Menu Bar

ShowMenuBarIcon

Setting: Show menu bar icon · Type: boolean · Default: true

When true, App Auto-Patch shows its menu bar icon. Set false to hide it. Default: true.

MenuBarConcealAdvancedActions

Setting: Conceal Settings and Quit · managed only (no Settings control) · Type: boolean

When true, the Settings… and Quit App Auto-Patch rows in the menu bar menu are hidden until the user holds Option. If this key isn’t in the profile, it is true on a Mac whose profile sets other common App Auto-Patch keys (such as IgnoredLabels, InstallomatorOptions, the deadline keys or the SupportTeam keys) and false on an unmanaged Mac. A value set locally on the Mac applies when the profile doesn’t set this key. Deploy false to always show both rows.

MenuBarHideQuit

Setting: Hide Quit · managed only (no Settings control) · Type: boolean · Default: false

When true, the Quit App Auto-Patch row is removed from the menu bar menu, even when Option is held. Default: false.

Startup

OpenAtLogin

Setting: Open at login · Type: boolean · Default: false

When true, App Auto-Patch writes a per-user LaunchAgent that starts the app at login. Quitting the app leaves it quit until the next login. The Settings toggle is disabled while this key is managed, while LockSettings is true, or while /Library/LaunchAgents/xyz.techitout.appAutoPatch.agent.plist is installed. Do not deploy that LaunchAgent and this key together; the installed LaunchAgent stays in charge and the app removes its own agent. Default: false.

KeepAlive

Setting: Keep running if quit · Type: boolean · Default: false

When true, App Auto-Patch writes a per-user LaunchAgent that starts the app again if the user quits it. That also starts the app at login. The Settings toggle is disabled while this key is managed, while LockSettings is true, or while /Library/LaunchAgents/xyz.techitout.appAutoPatch.agent.plist is installed. Do not deploy that LaunchAgent and this key together; the installed LaunchAgent stays in charge and the app removes its own agent. Default: false.

Support

SupportTeamName

Setting: Team · Type: string

Support team name shown on the About tab and in the “managed by your organization” banner in Settings. Set it to hide, or leave it unset, to omit it. Default: unset.

SupportTeamPhone

Setting: Phone · Type: string

Support phone number shown on the About tab. Set it to hide, or leave it unset, to omit it. Default: unset.

SupportTeamEmail

Setting: Email · Type: string

Support email address shown on the About tab. Set it to hide, or leave it unset, to omit it. Default: unset.

SupportTeamWebsite

Setting: Website · Type: string

Support website shown as a link on the About tab and opened by Help › App Auto-Patch Help. Set it to hide, or leave it unset, to omit it; Help then opens the App Auto-Patch GitHub page. Default: unset.

Managed Only

LockSettings

Setting: Lock settings · Type: boolean · Default: false

When true, Settings can’t be saved and its controls are disabled, including options that have no managed key of their own. Exceptions: the Version Comparison controls still respond but changes can’t be saved; the Admin Test Mode panel (shown only when AdminTestModeEnabled is true) stays fully usable and its actions apply immediately; the About tab keeps its links and the Generate Diagnostic Bundle button. Default: false.

ManagedSilentLaunchEnabled

Setting: Silent launch · Type: boolean

When true, App Auto-Patch launches without a Dock icon and closes the dashboard window, leaving the menu bar icon and notifications. If this key isn’t in the profile, it is true on a Mac whose profile sets other common App Auto-Patch keys (such as IgnoredLabels, InstallomatorOptions, the deadline keys or the SupportTeam keys) and false on an unmanaged Mac. Deploy false to keep the dashboard visible on managed Macs. To start App Auto-Patch at login, set OpenAtLogin, or deploy the LaunchAgent in MDM-LaunchAgent.md. Do not do both.

ZoomCallActiveCheck

Setting: Skip Zoom labels during an active call · Type: boolean · Default: true

When true, Zoom labels aren’t installed while a Zoom call is active. Default: true.

AppTitle

Setting: Display name · Type: string · Default: App Auto-Patch

Replaces the visible name “App Auto-Patch” in the dashboard window title, menu bar, notifications, and other on-screen text. A blank or missing value uses App Auto-Patch. This does not rename App Auto-Patch.app or the helper executables, and there is no Settings control. Default: App Auto-Patch.