Privacy Preferences Policy Control

Overview

With the release of macOS Mojave (10.14), Apple introduced controls that let the users allow or restrict cross-application data requests. Subsequently, macOS Catalina (10.15) extended this list of requests to include permissions such as Camera, Photos, Accessibility, AppleEvents, and much more.

For example, certain apps or services might require users' permission(s) to access specific data or even other apps; similar to the permissions requested on mobile devices. The users must provide their consent, without which the apps and services might fail to function. Certain apps or services like Accessibility might even require admin privileges to grant access, which cannot be manually granted by a standard user.

Configuring Privacy Preferences Policy Control (PPPC) in MDM lets you remotely manage these security preferences/permissions. You can allow or restrict permissions requested by Mac applications, on the users' behalf.

Prerequisite(s)

The managed Mac machines must be running macOS 10.14 or later.

Profile Settings

PROFILE SPECIFICATION		DESCRIPTION
Identifier		Specify the unique bundle identifier of the app.
Installation path		Specify the installation path, if a non-bundled app is used.
Code sign requirement		Run the following command on a fresh installation of macOS 10.14 or later to obtain the Code sign requirement, and specify it here. codesign --display -r - /path/to/app/binary For example, if you want to obtain Code sign requirement for the Desktop Central agent, run the following command and specify the output displayed after => as the Code sign requirement. Command: codesign --display -r - /Library/DesktopCentral_Agent/ManageEngine\ Desktop\ Central\ -\ Agent.app Output: designated => identifier "com.manageengine.ManageEngine-Desktop-Central---Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists / and certificate leaf[subject.OU] = TZ824L8Y37
Static code validation		Enable this only if the app or process invalidates the dynamic Code sign requirement. By default, this will be disabled.
Permissions	Allowed Permissions	Specify permissions that you want to provide consent to, on behalf of the users.
Permissions	Other Permissions	Permissions which are not marked as allowed can be set to user controlled or restricted.
Specify apps for AppleEvents		If the app or service requires permission to access other apps or services, individually specify them under AppleEvents.

You can configure PPPC for multiple apps within a single policy.
Permissions such as Camera, Microphone, and Screen Recording cannot be granted access by any MDM. These can only be restricted or left to user controlled, which is the default option.

ManageEngine