Adobe CC & Acrobat

How to deploy Adobe apps (Creative Cloud, Acrobat) to macOS devices via Relution and keep them up to date with the Remote Update Manager.

Adobe apps cannot be installed like a classic native app through Relution. The reason: Adobe packages are not simple silent installers – during installation they start their own background processes (Creative Cloud Desktop / HyperDrive). These do not run reliably in the restricted context of the native MDM command – the PKG upload succeeds, but the installation hangs or fails.

The installation is therefore performed via a script (macOS Companion). Updates are managed centrally through the Remote Update Manager.

Why a script is needed

Installation: installer -pkg … -target / runs in full root context, exactly as documented by Adobe. The signed-in user does not need administrator rights.
No file push: The macOS Companion does not deliver a file. The PKG must therefore be obtained (downloaded) over the network.
Updates: In the managed package, auto-update for end users is disabled. Updates are performed via a recurring update job that calls the Remote Update Manager (RUM) – see Ongoing updates.

Prepare the Adobe package

Create the package in the Admin Console #

Sign in to the Adobe Admin Console and go to Packages.
Create a Managed Package. Select all apps that should be installed on the devices – multiple apps (e.g. Photoshop, Illustrator, Acrobat) are bundled into one PKG.
In the management options, enable Remote Update Manager (RUM). This ships the RUM binary with the PKG to the devices, so it is available for updates later.
Download the finished package. The installer is located in the package folder under Build/<PackageName>_Install.pkg.

Note on splitting: If all users receive the same set of apps, one combined package is sufficient. If different groups need different apps, create a separate package per app or bundle and assign it to the respective device group. The update job (see below) remains the same in both cases.

Deploying the PKG

Since the Companion does not deliver a file, the PKG must be hosted at a network-reachable location from which the script downloads it – e.g. an internal web server or cloud storage.

Important: Use a permanent storage location. The download link from the Adobe Admin Console is temporary and session-bound and is not suitable as a fixed source. Download the package once and host it yourself. Also make sure the file name contains no spaces.

Automation scripts

The rollout consists of two Relution jobs: a one-time initial installation and a recurring update job.

Initial installation (recommended)

Adobe packages are often several gigabytes in size. A direct download within a Relution script can exceed the script timeout and is then aborted. The following script avoids this: it installs a LaunchDaemon that performs the download, installation and first update run decoupled in the background. The Relution script itself finishes within seconds.

Per package you only set PKG_URL and APP_LABEL.

#!/bin/bash
#
# Adobe Managed Deployment – JOB 1: Initial installation
# Run via the Relution macOS Companion.

set -e

# --- Configuration (adjust per package) ---
PKG_URL="https://your-share.example/Photoshop_Install.pkg"
APP_LABEL="photoshop"   # only for log/daemon name

LABEL="io.relution.adobe.${APP_LABEL}"
WORKER="/usr/local/relution/${LABEL}.sh"
PLIST="/Library/LaunchDaemons/${LABEL}.plist"
LOG="/var/log/relution_adobe_deploy.log"

if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: must run as root." >&2
    exit 1
fi

mkdir -p "$(dirname "$WORKER")"

cat > "$WORKER" <<WORKEOF
#!/bin/bash
PKG_URL="${PKG_URL}"
APP_LABEL="${APP_LABEL}"
RUM_BIN="/usr/local/bin/RemoteUpdateManager"
PLIST="${PLIST}"
WORKER="${WORKER}"
LOG="${LOG}"

log() { echo "\$(date '+%Y-%m-%d %H:%M:%S') [\$APP_LABEL] \$1" | tee -a "\$LOG"; }
log "=== Initial installation started ==="

BEFORE="\$(find /Applications -maxdepth 2 -iname "Adobe*.app" 2>/dev/null | wc -l | tr -d ' ')"

TMP="\$(mktemp -d /tmp/adobe.XXXXXX)"
PKG="\$TMP/install.pkg"
log "Downloading PKG: \$PKG_URL"
if caffeinate -i curl -fL --retry 4 --retry-delay 10 -C - "\$PKG_URL" -o "\$PKG" >>"\$LOG" 2>&1; then
    log "Download ok. Installing..."
    installer -pkg "\$PKG" -target / >>"\$LOG" 2>&1 && log "installer succeeded." || log "ERROR: installer (\$?)."
else
    log "ERROR: download failed (\$?)."
fi
rm -rf "\$TMP"

if [ -x "\$RUM_BIN" ]; then
    log "Starting RemoteUpdateManager..."
    "\$RUM_BIN" --action=install >>"\$LOG" 2>&1
    log "RUM finished (RC \$?)."
else
    log "WARNING: RUM not found."
fi

AFTER="\$(find /Applications -maxdepth 2 -iname "Adobe*.app" 2>/dev/null | wc -l | tr -d ' ')"
log "Adobe apps: before \$BEFORE, after \$AFTER"
find /Applications -maxdepth 2 -iname "Adobe*.app" 2>/dev/null | while read -r a; do
    mdimport "\$a" 2>/dev/null || true
    VER="\$(defaults read "\$a/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null || echo '?')"
    log "  - \$a (version \$VER)"
done

log "=== Done, cleaning up ==="
launchctl bootout system "\$PLIST" 2>/dev/null || true
rm -f "\$PLIST" "\$WORKER"
WORKEOF

chmod 700 "$WORKER"

cat > "$PLIST" <<PLISTEOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key><string>${LABEL}</string>
    <key>ProgramArguments</key>
    <array><string>/bin/bash</string><string>${WORKER}</string></array>
    <key>RunAtLoad</key><true/>
    <key>StandardErrorPath</key><string>${LOG}</string>
</dict>
</plist>
PLISTEOF

chown root:wheel "$PLIST"
chmod 644 "$PLIST"

launchctl bootout system "$PLIST" 2>/dev/null || true
launchctl bootstrap system "$PLIST"
echo "Bootstrap ok: $LABEL started."
exit 0

The result is logged to /var/log/relution_adobe_deploy.log.

Ongoing updates #

Set up this script as a recurring Relution job (e.g. weekly). It requires no download – the Remote Update Manager fetches the updates directly from Adobe. Without specifying products, all installed Adobe apps are updated together; a separate job per app is not needed.

#!/bin/bash
RUM_BIN="/usr/local/bin/RemoteUpdateManager"
RUM_PRODUCTS=""   # empty = all apps; otherwise SAP codes, e.g. "APRO,PHSP"
LOG="/var/log/relution_adobe_update.log"

log() { echo "$(date '+%Y-%m-%d %H:%M:%S') $1" | tee -a "$LOG"; }

if [ ! -x "$RUM_BIN" ]; then
    log "ERROR: RUM not found – is an Adobe app installed?"
    exit 2
fi

log "=== RUM update started ==="
if [ -n "$RUM_PRODUCTS" ]; then
    "$RUM_BIN" --action=install --productVersions="$RUM_PRODUCTS" >>"$LOG" 2>&1
else
    "$RUM_BIN" --action=install >>"$LOG" 2>&1
fi
log "RUM finished (RC $?)."

SAP codes for updating individual apps: APRO (Acrobat), PHSP (Photoshop), ILST (Illustrator), IDSN (InDesign), PPRO (Premiere Pro), AEFT (After Effects).

Alternative: Self-service #

If users should install their Adobe apps themselves instead of a central rollout, create a Self-Service package in the Admin Console instead (or enable the options “Enable self-service install” and “Allow non-admins to update and install apps” in the package). The script then installs only the Creative Cloud Desktop app; users then select and install the actual apps themselves. This requires Named User Licensing with matching product profiles. A central update job is not needed, since updates run through the Desktop app.

#!/bin/bash
#
# Self-service – installs only the Creative Cloud Desktop app.
# The actual apps are installed by the user afterwards.

PKG_URL="https://your-share.example/CreativeCloud_Install.pkg"

if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: must run as root." >&2
    exit 1
fi

TMP="$(mktemp -d /tmp/ccda.XXXXXX)"
PKG="$TMP/install.pkg"

echo "Downloading Creative Cloud Desktop app..."
if caffeinate -i curl -fL --retry 4 --retry-delay 10 -C - "$PKG_URL" -o "$PKG"; then
    installer -pkg "$PKG" -target /
    RC=$?
else
    echo "ERROR: download failed."
    rm -rf "$TMP"
    exit 1
fi
rm -rf "$TMP"

if [ "$RC" -eq 0 ]; then
    echo "Creative Cloud Desktop app installed."
    exit 0
else
    echo "ERROR: installation failed (RC $RC)."
    exit 1
fi

Note: If the package is very large and the direct download runs into the script timeout, use the decoupled LaunchDaemon variant from Initial installation – simply set PKG_URL to the Creative Cloud Desktop app package and omit the RUM step.

Status monitoring via App Compliance #

In this setup, installation is performed via the script – no PKG is uploaded to Relution. App Compliance therefore does not serve distribution but status monitoring: you add the app manually and set the previously chosen bundle ID as the detection rule.

Manually add an app in App Compliance (without PKG upload).
Set the bundle ID as the detection rule, e.g. com.adobe.acc.AdobeCreativeCloud.
Relution regularly checks this ID to determine whether the app is present on the device.
Devices without the app are flagged as Non-compliant. The installation script can then be run (again) on those devices.

App-specific detection (e.g. Photoshop only): The inventory does not provide a dedicated marker for this. In that case only the generic CC proof can be used, which confirms the package (not the individual app).

Notes #

Licensing (Named User Licensing): After installation, the user signs in with their Adobe ID on first launch. Each app requires a matching product profile in the Admin Console – without an entitlement the app is installed but not usable.
Major upgrades: The Remote Update Manager only updates within the installed major version (base and security updates). Moving to a new yearly generation requires a new package.
Education environments: For Adobe education customers, auto-update for end users is not available; management via the Remote Update Manager is the intended path here.
Spotlight: The initial installation script indexes installed apps via mdimport so they are immediately findable through Spotlight search – not only in Finder.

Browse docs

Adobe CC & Acrobat

Why a script is needed #

Prepare the Adobe package #

Create the package in the Admin Console # #

Deploying the PKG #

Automation scripts #

Initial installation (recommended) #

Ongoing updates # #

Alternative: Self-service # #

Status monitoring via App Compliance # #

Notes # #