diff --git a/tools/mdm/make_cfg_profiles.sh b/tools/mdm/make_cfg_profiles.sh
new file mode 100755
index 0000000000..a0f13ddbfb
--- /dev/null
+++ b/tools/mdm/make_cfg_profiles.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+
+# ----------------------------------------------------
+# Build a JSON payload for configuration profiles batch request payload.
+# ----------------------------------------------------
+
+set -euo pipefail
+
+# Repeating block:
+#   --file <path> --name <display> [--labels-type include_any|include_all|exclude_any] [--label <str> ...] --next
+# Finish with --next or just end of args.
+
+usage() {
+  echo "Usage: $0 (--file F --name N [--labels-type include_any|include_all|exclude_any] [--label L ...] --next)..." >&2
+  exit 1
+}
+
+profiles='[]'
+
+cur_file=""
+cur_name=""
+cur_ltype=""
+cur_labels=()
+
+flush_item() {
+  [[ -n "${cur_file:-}" || -n "${cur_name:-}" || ${#cur_labels[@]} -gt 0 || -n "${cur_ltype:-}" ]] || return 0
+  [[ -n "${cur_file:-}" ]] || { echo "Missing --file before --next/end." >&2; exit 1; }
+  [[ -f "$cur_file" ]] || { echo "No such file: $cur_file" >&2; exit 1; }
+
+  b64="$(base64 < "$cur_file" | tr -d '\n')"
+
+  # labels array -> JSON
+  labels_json="$(printf '%s\n' "${cur_labels[@]:-}" | jq -R . | jq -s .)"
+
+  # choose labels key
+  lkey=""
+  case "${cur_ltype:-}" in
+    include_any)  lkey="labels_include_any" ;;
+    include_all)  lkey="labels_include_all" ;;
+    exclude_any)  lkey="labels_exclude_any" ;;
+    "" )          lkey="" ;; # omit labels entirely if not provided
+    * ) echo "Invalid --labels-type: $cur_ltype" >&2; exit 1 ;;
+  esac
+
+  # base object
+  item="$(jq -n --arg p "$b64" '{profile:$p}')"
+
+  # add display_name only if provided
+  if [[ -n "${cur_name:-}" ]]; then
+    item="$(jq --arg n "$cur_name" '. + {display_name:$n}' <<<"$item")"
+  fi
+
+  # add labels if provided
+  if [[ -n "$lkey" ]]; then
+    item="$(jq --arg lk "$lkey" --argjson lv "$labels_json" '. + {($lk):$lv}' <<<"$item")"
+  fi
+
+  profiles="$(jq --argjson it "$item" '. + [$it]' <<<"$profiles")"
+
+  # reset block
+  cur_file=""; cur_name=""; cur_ltype=""; cur_labels=()
+}
+
+[[ $# -gt 0 ]] || usage
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --file)        shift; [[ $# -gt 0 ]] || usage; cur_file="$1"; shift ;;
+    --name|--display-name) shift; [[ $# -gt 0 ]] || usage; cur_name="$1"; shift ;;
+    --labels-type) shift; [[ $# -gt 0 ]] || usage; cur_ltype="$1"; shift ;;
+    --label)       shift; [[ $# -gt 0 ]] || usage; cur_labels+=("$1"); shift ;;
+    --next)        shift; flush_item ;;
+    -h|--help)     usage ;;
+    *) echo "Unknown arg: $1" >&2; usage ;;
+  esac
+done
+flush_item
+
+jq -n --argjson arr "$profiles" '{configuration_profiles: $arr}'
diff --git a/tools/mdm/test-batch-profiles.sh b/tools/mdm/test-batch-profiles.sh
new file mode 100755
index 0000000000..0e54677492
--- /dev/null
+++ b/tools/mdm/test-batch-profiles.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+#--------------------------------------------------------------
+# This script helps with testing batch setting of configuration
+# profiles via the Fleet API. Change this file as needed
+# to generate different test cases.
+#--------------------------------------------------------------
+
+if [[ -z "$FLEET_PATH" ]]; then
+  echo "Error: FLEET_PATH environment variable is not set. This is the path to the Fleet project." >&2
+  exit 1
+fi
+
+if [[ -z "$FLEET_SERVER_URL" ]]; then
+  echo "Error: FLEET_SERVER_URL environment variable is not set. This is the URL of the Fleet server." >&2
+  exit 1
+fi
+
+if [[ -z "$FLEET_AUTH_TOKEN" ]]; then
+  echo "Error: FLEET_AUTH_TOKEN environment variable is not set. This is the authentication token used for Fleet API requests." >&2
+  exit 1
+fi
+
+# generate request payload
+payload="$(
+$FLEET_PATH/tools/mdm/make_cfg_profiles.sh \
+--file $FLEET_PATH/it-and-security/lib/macos/configuration-profiles/1password-managed-settings.mobileconfig --name "1Password Managed Settings" \
+--labels-type include_all --label "test label 2" --next \
+--file $FLEET_PATH/it-and-security/lib/windows/configuration-profiles/Enable\ Firewall.xml --name "Windows Enable Firewall" \
+--labels-type include_any --label "test label 1" --next \
+)"
+
+# make request to Fleet API
+curl -X POST "$FLEET_SERVER_URL/api/latest/fleet/configuration_profiles/batch" \
+-H "Content-Type: application/json" \
+-H "Authorization: Bearer $FLEET_AUTH_TOKEN" \
+-d "$payload"