How to Silently Install the Backblaze Client with JumpCloud

You can use JumpCloud Commands to deploy Backblaze Computer Backup to managed macOS and Windows devices. This guide covers installation, account association, macOS permissions, and deployment verification.

Note

These instructions provide general guidance for silently deploying Backblaze Computer Backup with JumpCloud. Configuration requirements may vary by operating system, client version, and environment. Consult the current Backblaze silent installation documentation and JumpCloud Commands documentation to confirm your requirements, and test installation, account association, permissions, and backup activity on a small device group before deploying to production.

Choose a Deployment Model

The examples supply the email address explicitly through a JumpCloud variable. They do not infer device ownership from JumpCloud user associations or use an administrator API key. Do not assign one user’s installation command to devices that should use a different account.

Prerequisites

• Administrator access to the JumpCloud Admin Portal and permission to manage Commands, variables, device groups, and applicable macOS policies.

• Devices enrolled with the JumpCloud agent, using an operating system supported by both JumpCloud and Backblaze Computer Backup. Windows devices must use supported 64-bit Windows 10 or Windows 11. This guide does not cover Linux or Windows Server. Windows in S mode cannot use the MSI workflow.

• An active Backblaze group, group administrator access, and sufficient licenses for the intended deployment.

• The groupID and groupToken for the Backblaze group.

• The intended account email address for each command target. Prepare existing accounts and their group association before deploying to an existing-account environment.

• A small pilot device group for each operating system.

• Network access to download the Backblaze installer and connect to Backblaze services.

• For macOS, a plan to deploy the required privacy and background-item settings through your MDM, or to complete any required user approvals.

Backblaze groups without purchased licenses are limited to silent deployment to 10 accounts until a license is purchased for the group. This is an account limit.

See Backblaze Unsupported Operating Systems and JumpCloud agent requirements for platform details.

Create the Deployment Variables

1. In the JumpCloud Admin Portal, select Settings > Automation Variables.

2. Click +Variable, and create the following variables with the String data type.

JumpCloud also supports creating command-local variables from the Command Details page. For decentralized deployments, use a separate command-local email variable for each user, or use unique variable names for each command and update the script’s email placeholder accordingly. Do not change a shared email variable to deploy another user while earlier commands still reference it.

JumpCloud wraps substituted values in single quotes. The examples therefore use bare placeholders such as group_id={{bzGroupID}} in Bash and $groupId = {{bzGroupID}} in PowerShell. Do not add another pair of quotes around these placeholders. For more information, see Manage Variables .

Prepare macOS Permissions

Deploy permissions before the installation command. Include the Backblaze main client’s Full Disk Access, its separate background/menu components, and Managed Login Items settings for the client version you deploy. Do not assume that approving only com.backblaze.backblaze covers every component.

1. Review the current component identifiers and reference profiles in Backblaze’s v10 macOS deployment guidance and the Backblaze RMM repository. Use these as references for Backblaze requirements; Jamf-specific policies do not transfer directly to JumpCloud.

2. In JumpCloud, select Device Management > Policy Management, and create an Application Privacy Preferences policy for each required component.

3. Enter the component’s identifier and identifier type, its Code Requirement, and the required privacy permission. Obtain the signing requirement from the installed component on a pilot Mac using JumpCloud’s documented procedure. Follow Create a Device Level macOS Application Privacy Preferences Policy.

4. Configure Managed Login Items for the applicable Backblaze components on macOS 13 or later. Follow JumpCloud’s Managed Login Items guidance for your MDM arrangement.

5. Assign the policies or equivalent profiles from your MDM to the pilot devices. Verify that the settings are applied before installing Backblaze.

6. Ensure that the JumpCloud agent itself has Full Disk Access when required to run the command. See the permissions guidance in Get Started: Commands.

Use the privacy-policy documentation’s MDM prerequisites for the policy you select. If another MDM manages the Macs, deploy the equivalent settings through that MDM. Do not assume the JumpCloud agent alone grants Backblaze Full Disk Access.

Create the Installation Commands

1. In the JumpCloud Admin Portal, select Device Management > Commands.

2. Click +Command, and select Command.

3. Create a separate command for each operating system and account target.

4. Use the settings in the table above, and paste the corresponding script.

5. For Event, select Run Manually for the pilot. In Timeout After, enter an execution timeout in seconds that allows the download and installation to finish. Adjust this value based on your pilot results.

6. Save the command without assigning it to production devices.

For the current command fields and launch options, see Create a Command.

Important

These scripts are installation examples. If existing Backblaze files or registration are found, they skip installation. A skipped command does not confirm a complete installation, the correct account, or a healthy backup. The examples do not repair, update, or reassign an existing client.

Use the macOS Script

This example uses the direct bzinstall_mate invocation documented in Backblaze’s Mac silent installation guide. It downloads the DMG into a private temporary directory and mounts it at a unique path. It does not implement the separate v10 JSON bootstrap workflow. If your deployment requires organization settings through -cfg, use the v10 configuration guidance and maintained Backblaze scripts as the implementation reference.

#!/bin/bash
# JumpCloud Command: Type Mac; Run As root.
# Create String variables: bzGroupID, bzGroupToken (Secret), bzEmail.
# JumpCloud supplies single quotes around substituted values.
set -u
umask 077
group_id={{bzGroupID}}
group_token={{bzGroupToken}}
email={{bzEmail}}

fail() { echo "ERROR: $1" >&2; exit 1; }
[ "$(id -u)" -eq 0 ] || fail "Set Run As to root."
[ -n "$group_id" ] && [ -n "$group_token" ] && [ -n "$email" ] \
  || fail "Set all three deployment variables."
[[ "$email" == *@* ]] || fail "Check the account email variable."

# This is a conservative presence check, not a backup health check.
if [ -e /Library/Backblaze.bzpkg ]; then
  echo "Existing Backblaze files found. No installation or account change performed. Verify the client and account separately."
  exit 0
fi

work_dir=$(mktemp -d /private/tmp/backblaze-install.XXXXXX) \
  || fail "Cannot create a temporary directory."
mount_point="$work_dir/volume"
mkdir "$mount_point" || fail "Cannot create a mount directory."
mounted=0
cleanup() {
  if [ "$mounted" -eq 1 ]; then
    if ! /usr/bin/hdiutil detach "$mount_point" -quiet; then
      echo "Could not detach the installer. Temporary files remain at $work_dir."
      return
    fi
  fi
  /bin/rm -rf "$work_dir"
}
trap cleanup EXIT
/usr/bin/curl --fail --silent --show-error --location --max-time 600 \
  --output "$work_dir/install_backblaze.dmg" \
  'https://secure.backblaze.com/mac/install_backblaze.dmg' \
  || fail "Installer download failed."
/usr/bin/hdiutil attach -quiet -nobrowse -mountpoint "$mount_point" \
  "$work_dir/install_backblaze.dmg" || fail "Cannot mount the installer."
mounted=1
installer="$mount_point/Backblaze Installer.app/Contents/MacOS/bzinstall_mate"
[ -x "$installer" ] || fail "The installer executable was not found."

# Direct installation syntax from Backblaze's Mac silent installation guide.
# Do not enable shell tracing or print credentials or raw installer output.
"$installer" -nogui -createaccount_or_signinaccount \
  "$email" "$group_id" "$group_token" > "$work_dir/installer-output.log" 2>&1
status=$?
if [ "$status" -ne 0 ]; then
  echo "Installation process failed with exit status $status. Review Backblaze's local installation logs."
  exit "$status"
fi
if /usr/bin/grep -Eq 'BZERROR:(190|1000|1003|1016)([^0-9]|$)' "$work_dir/installer-output.log"; then
  fail "The installer reported a Backblaze error. Review local installation logs."
fi
echo "Installation process completed. Verify account association, permissions, and backup activity in Backblaze."
exit 0

The script returns the installer’s process status and checks for selected known Backblaze errors in captured output. It does not treat a zero exit status as proof that backup has started. The presence check looks for /Library/Backblaze.bzpkg, a common Backblaze installation location on macOS. Confirm this path on a pilot Mac before you deploy. A client installed in a different location is not detected, and the directory can also remain after a partial installation, so a skipped command still requires a separate client and account check. Temporary installer output is deleted during normal cleanup; use Backblaze’s local logs for further investigation.

Use the Windows Script

This example explicitly supplies BZEMAIL; it does not rely on Active Directory lookup from the SYSTEM account. It waits for msiexec.exe, preserves the MSI exit code, and identifies the deployment stage if an exception occurs. It writes a local verbose log without copying its contents into JumpCloud results.

# JumpCloud Command: Type Windows; select Windows PowerShell.
# Create String variables: bzGroupID, bzGroupToken (Secret), bzEmail.
# JumpCloud supplies single quotes around substituted values.
$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'
$groupId = {{bzGroupID}}
$groupToken = {{bzGroupToken}}
$email = {{bzEmail}}
$workDir = $null
$exitCode = 1
$stage = 'Validate deployment variables'

try {
    if (-not $groupId -or -not $groupToken -or -not $email) {
        throw 'Set all three deployment variables.'
    }
    # These values are inserted into MSI arguments. Reject argument delimiters.
    foreach ($value in @($groupId, $groupToken, $email)) {
        if ($value -match '[\s"]') {
            throw 'Deployment values must not contain whitespace or double quotes.'
        }
    }
    if ($email -notmatch '^[^@]+@[^@]+$') { throw 'Check the account email variable.' }

    $stage = 'Check for an existing installation'
    # Check both registry views, including from a 32-bit Command process.
    $installed = $false
    foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64,
                        [Microsoft.Win32.RegistryView]::Registry32)) {
        $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey(
            [Microsoft.Win32.RegistryHive]::LocalMachine, $view)
        try {
            $key = $base.OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall')
            if ($null -ne $key) {
                try {
                    foreach ($name in $key.GetSubKeyNames()) {
                        $app = $key.OpenSubKey($name)
                        if ($null -ne $app) {
                            try {
                                if ($app.GetValue('DisplayName') -eq 'Backblaze') {
                                    $installed = $true
                                }
                            } finally { $app.Dispose() }
                        }
                    }
                } finally { $key.Dispose() }
            }
        } finally { $base.Dispose() }
    }
    if ($installed) {
        Write-Output 'Existing Backblaze registration found. No installation or account change performed. Verify the client and account separately.'
        exit 0
    }

    $stage = 'Prepare temporary files'
    $workDir = Join-Path $env:TEMP ('BackblazeInstall-' + [guid]::NewGuid().ToString('N'))
    New-Item -ItemType Directory -Path $workDir | Out-Null
    $msiPath = Join-Path $workDir 'install_backblazemsi.msi'
    $logPath = Join-Path $workDir 'Backblaze-install.log'
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $stage = 'Download the installer'
    Invoke-WebRequest -UseBasicParsing -Uri 'https://secure.backblaze.com/win32/install_backblazemsi.msi' -OutFile $msiPath
    $msiArgs = "/i `"$msiPath`" /qn /norestart /l*v `"$logPath`" BZEMAIL=$email BZGROUPID=$groupId BZGROUPTOKEN=$groupToken"
    $stage = 'Run the MSI installer'
    $process = Start-Process -FilePath 'msiexec.exe' -ArgumentList $msiArgs -Wait -PassThru
    $exitCode = $process.ExitCode
    Write-Output "MSI process exit code: $exitCode"
    if ($exitCode -eq 0 -or $exitCode -eq 3010) {
        if ($exitCode -eq 3010) { Write-Output 'Installation requires a restart. Follow your restart policy.' }
        Write-Output 'Verify account association and backup activity in Backblaze.'
        $stage = 'Remove temporary files'
        Remove-Item -LiteralPath $workDir -Recurse -Force
        $workDir = $null
    } else {
        Write-Output "Review the local MSI log: $logPath"
    }
} catch {
    # Avoid echoing exception details that could contain deployment arguments.
    Write-Output "Deployment did not complete at stage: $stage. Check variables, download access, permissions, and local logs."
    $exitCode = 1
} finally {
    if ($workDir -and (Test-Path -LiteralPath $workDir)) {
        Write-Output "Temporary deployment files remain at $workDir. Logs can contain credentials; restrict access and remove them after troubleshooting."
    }
}
exit $exitCode

Windows Installer code 0 indicates success; 3010 indicates success with a restart required. The script preserves 3010, so JumpCloud can show a nonzero result even though MSI completed successfully. Review the output and handle restarts according to your policy. Other nonzero results require investigation. For more information, see Windows Installer error codes.

Assign and Test the Pilot Deployment

1. Create or select a small pilot device group in JumpCloud.

2. Verify that every device in the group should use the email configured in that command. Use separate groups or individual device targets for different users.

3. Open the installation command, select the pilot device group or devices as its targets, and save it.

4. Run the command manually.

5. In Device Management > Commands > Results, review the output and process exit status. Distinguish a skipped installation from a completed installation.

6. In the Backblaze web console, confirm the device appears in the expected group under the intended account.

7. On macOS, confirm Full Disk Access and background permissions. On both platforms, confirm that the initial backup begins and the client reports a healthy state.

8. Rerun the command on a pilot device to check its skip behavior. Verify the existing client separately; the script does not check backup health.

BZERROR:1001 is documented as a successful installation message in Backblaze’s Windows silent installation guide. It is not an MSI exit code, and these scripts do not promise to display it in JumpCloud results.

Roll Out and Maintain the Deployment

1. Add a small production device group whose intended account matches the command’s email variable.

2. Run the command and review JumpCloud results and Backblaze backup activity.

3. Resolve installation, account-association, and permission failures before adding the next group.

4. Repeat until all intended devices are deployed.

JumpCloud supports manual, scheduled, repeating, webhook-triggered, and login-based launch options. Use the options documented for your tenant. This guide does not use an agent-check-in trigger. If you schedule a repeating command, understand that the examples skip existing installations and will not repair or reassign them.

Backblaze manages automatic client updates through a gradual rollout (see Auto-Update Process). For a manual update, follow Update the Backblaze Backup Client; install over the existing client rather than uninstalling it first. The installation examples above are not update commands.

Resolve Deployment Issues

Important

Installation commands and logs can contain email addresses, group IDs, and group tokens. Restrict access to local logs and JumpCloud results, redact sensitive values before sharing, and remove retained temporary files after troubleshooting. Do not enable shell tracing or print secret variables.

Additional Resources

• Silently Install the Backblaze Client

• Install the Backblaze Client Silently on Mac

• Install the Backblaze Client Silently on Windows

• Get Started: JumpCloud Commands

• Manage JumpCloud Variables

• Create a JumpCloud Command