diff --git a/pkg/automatic_policy/automatic_policy_test.go b/pkg/automatic_policy/automatic_policy_test.go
index b06fddea18..69da3bb9f0 100644
--- a/pkg/automatic_policy/automatic_policy_test.go
+++ b/pkg/automatic_policy/automatic_policy_test.go
@@ -15,6 +15,9 @@ func TestGenerateErrors(t *testing.T) {
 	})
 	require.ErrorIs(t, err, ErrExtensionNotSupported)
 
+	_, err = FullInstallerMetadata{}.PolicyPlatform()
+	require.ErrorIs(t, err, ErrExtensionNotSupported)
+
 	_, err = Generate(FullInstallerMetadata{
 		Title:            "Foobar",
 		Extension:        "msi",
@@ -30,6 +33,12 @@ func TestGenerateErrors(t *testing.T) {
 	})
 	require.ErrorIs(t, err, ErrMissingProductCode)
 
+	_, err = Generate(MacInstallerMetadata{
+		Title:            "Foobar",
+		BundleIdentifier: "",
+	})
+	require.ErrorIs(t, err, ErrMissingBundleIdentifier)
+
 	_, err = Generate(FullInstallerMetadata{
 		Title:            "Foobar",
 		Extension:        "pkg",
@@ -38,6 +47,15 @@ func TestGenerateErrors(t *testing.T) {
 	})
 	require.ErrorIs(t, err, ErrMissingBundleIdentifier)
 
+	_, err = Generate(MacInstallerMetadata{
+		Title:            "",
+		BundleIdentifier: "",
+	})
+	require.ErrorIs(t, err, ErrMissingTitle)
+
+	_, err = MacInstallerMetadata{}.PolicyQuery()
+	require.ErrorIs(t, err, ErrMissingBundleIdentifier)
+
 	_, err = Generate(FullInstallerMetadata{
 		Title:            "",
 		Extension:        "deb",
@@ -48,7 +66,17 @@ func TestGenerateErrors(t *testing.T) {
 }
 
 func TestGenerate(t *testing.T) {
-	policyData, err := Generate(FullInstallerMetadata{
+	policyData, err := Generate(MacInstallerMetadata{
+		Title:            "Foobar",
+		BundleIdentifier: "com.foo.bar",
+	})
+	require.NoError(t, err)
+	require.Equal(t, "[Install software] Foobar", policyData.Name)
+	require.Equal(t, "Policy triggers automatic install of Foobar on each host that's missing this software.", policyData.Description)
+	require.Equal(t, "darwin", policyData.Platform)
+	require.Equal(t, "SELECT 1 FROM apps WHERE bundle_identifier = 'com.foo.bar';", policyData.Query)
+
+	policyData, err = Generate(FullInstallerMetadata{
 		Title:            "Foobar",
 		Extension:        "pkg",
 		BundleIdentifier: "com.foo.bar",
diff --git a/server/datastore/mysql/policies_test.go b/server/datastore/mysql/policies_test.go
index 9436677e93..2089acd126 100644
--- a/server/datastore/mysql/policies_test.go
+++ b/server/datastore/mysql/policies_test.go
@@ -4430,6 +4430,22 @@ func testTeamPoliciesWithVPP(t *testing.T, ds *Datastore) {
 	policiesWithVPPs, err = ds.GetPoliciesWithAssociatedVPP(ctx, team2.ID, []uint{p1.ID, p2.ID})
 	require.NoError(t, err)
 	require.Empty(t, policiesWithVPPs)
+
+	// create another team1 app, this time with an automatic policy
+	team1App3, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp3", Platform: fleet.MacOSPlatform}, AddAutoInstallPolicy: true},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	automaticPolicies, err := ds.getPoliciesBySoftwareTitleIDs(ctx, []uint{team1App3.TitleID}, &team1.ID)
+	require.NoError(t, err)
+	require.Len(t, automaticPolicies, 1)
+
+	policyWithVPP, err := ds.Policy(ctx, automaticPolicies[0].ID)
+	require.NoError(t, err)
+	require.Equal(t, *policyWithVPP.VPPAppsTeamsID, team1App3.VPPAppTeam.AppTeamID)
+	require.Equal(t, `SELECT 1 FROM apps WHERE bundle_identifier = 'com.app.vpp3';`, policyWithVPP.Query)
 }
 
 func testTeamPoliciesWithScript(t *testing.T, ds *Datastore) {
diff --git a/server/datastore/mysql/software_installers_test.go b/server/datastore/mysql/software_installers_test.go
index acca438044..cf03f3048a 100644
--- a/server/datastore/mysql/software_installers_test.go
+++ b/server/datastore/mysql/software_installers_test.go
@@ -2075,6 +2075,39 @@ func testMatchOrCreateSoftwareInstallerWithAutomaticPolicies(t *testing.T, ds *D
 	require.NotNil(t, team1Policies[0].TeamID)
 	require.Equal(t, team1.ID, *team1Policies[0].TeamID)
 
+	// Test Mac FMA
+	fma, err := ds.UpsertMaintainedApp(ctx, &fleet.MaintainedApp{ID: 1})
+	require.NoError(t, err)
+	installerFMA, _, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallerFile:     tfr1,
+		BundleIdentifier:  "com.foo.fma",
+		Platform:          "darwin",
+		Extension:         "dmg",
+		FleetLibraryAppID: ptr.Uint(fma.ID),
+		StorageID:         "storage1",
+		Filename:          "foobar1",
+		Title:             "FooFMA",
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+		TeamID:            &team1.ID,
+		AutomaticInstall:  true,
+		ValidatedLabels:   &fleet.LabelIdentsWithScope{},
+	})
+	require.NoError(t, err)
+
+	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 2)
+	require.Equal(t, "[Install software] FooFMA", team1Policies[1].Name)
+	require.Equal(t, "SELECT 1 FROM apps WHERE bundle_identifier = 'com.foo.fma';", team1Policies[1].Query)
+	require.Equal(t, "Policy triggers automatic install of FooFMA on each host that's missing this software.", team1Policies[1].Description)
+	require.Equal(t, "darwin", team1Policies[1].Platform)
+	require.NotNil(t, team1Policies[1].SoftwareInstallerID)
+	require.Equal(t, installerFMA, *team1Policies[1].SoftwareInstallerID)
+	require.NotNil(t, team1Policies[1].TeamID)
+	require.Equal(t, team1.ID, *team1Policies[1].TeamID)
+
 	// Test msi.
 	installerID2, _, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		InstallerFile:    tfr1,
@@ -2197,8 +2230,8 @@ Software won't be installed on Linux hosts with Debian-based distributions becau
 
 	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
 	require.NoError(t, err)
-	require.Len(t, team1Policies, 3)
-	require.Equal(t, "[Install software] OtherFoobar (pkg) 2", team1Policies[2].Name)
+	require.Len(t, team1Policies, 4)
+	require.Equal(t, "[Install software] OtherFoobar (pkg) 2", team1Policies[3].Name)
 
 	team3, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 3"})
 	require.NoError(t, err)
diff --git a/server/service/integration_mdm_test.go b/server/service/integration_mdm_test.go
index 9b467a7e74..7b252194a3 100644
--- a/server/service/integration_mdm_test.go
+++ b/server/service/integration_mdm_test.go
@@ -11537,6 +11537,10 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
 		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, Platform: addedApp.Platform, SelfService: true},
 		http.StatusBadRequest, &addAppResp)
+	// No auto-install for iPadOS
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, Platform: addedApp.Platform, AutomaticInstall: true},
+		http.StatusBadRequest, &addAppResp)
 	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
 		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, Platform: addedApp.Platform},
 		http.StatusOK, &addAppResp)