Enforce CoCo policy with MDM and managed-settings.json

CoCo policy enforcement allows administrators to set account restrictions, allowed authentication methods, and minimum required versions for CoCo CLI and CoCo Desktop. These rules can be delivered via MDM profiles (such as Jamf or Intune), Windows Group Policy, or through a secured managed-settings.json file.

Use cases

Imagine you need to prevent users from connecting CoCo to unauthorized accounts or using weak authentication methods in production.

• Block access to unlisted Snowflake accounts.
• Restrict sign-in methods globally or per account.
• Enforce minimum client versions before starting the application.

How to use

Place the configuration file in the system path or deploy it via MDM.

{
  "version": "1.0",
  "enabled": true,
  "tenant": {
    "allowedAccounts": ["acme-prod", "acme-analytics"]
  },
  "auth": {
    "allowedMethods": ["OAUTH_AUTHORIZATION_CODE", "EXTERNALBROWSER"],
    "accounts": {
      "acme-prod": { "allowedMethods": ["EXTERNALBROWSER"] }
    }
  },
  "required": {
    "minimumVersion": "1.1.89"
  }
}

What happens in this code:

1. The version parameter defines the configuration schema version.
2. The tenant.allowedAccounts field restricts which accounts CoCo can access.
3. The auth.allowedMethods block defines globally allowed login methods.
4. The auth.accounts block specifies restricted rules for specific accounts, such as requiring browser SSO only in production.

Limitations and requirements

• Preview feature available to all accounts.
• Requires macOS (CoCo CLI 1.1.89+, Desktop 1.21.4+) or Windows (CoCo CLI 1.1.104+, Desktop 1.21.6+).
• Changes take effect the next time CoCo starts.