Modern versions of macOS (including macOS Sonoma and macOS Sequoia) enforce a strict sandboxing and privacy governance architecture known as Transparency, Consent, and Control (TCC). Designed to protect user data from rogue background processes, TCC mandates that applications explicitly request user consent before accessing hardware peripherals (cameras, microphones) or protected file system boundaries (Desktop, Documents, Photos, Full Disk Access).
However, during enterprise software rollouts, app updates, or development cycles, TCC permissions frequently become corrupted or stuck in inconsistent states. An application might crash during its initial authorisation prompt, leaving it permanently blocked from accessing the camera, or an updated binary might fail code-signing validation against historical TCC records. The native command-line utility tccutil allows system administrators and power users to flush and reset these permissions granularly without requiring a destructive operating system reinstall. This guide details how to leverage tccutil to audit and reset macOS privacy permissions.
Architectural Mechanics: The TCC Privacy Framework
The TCC subsystem maintains two discrete SQLite databases protected by Apple’s System Integrity Protection (SIP):
| Database Location | Scope | Governed Permissions | Write Restrictions |
|---|---|---|---|
~/Library/Application Support/com.apple.TCC/TCC.db |
Per-User Store | Camera, Microphone, Contacts, Calendars, Photos, Automation (AppleEvents). | Protected by SIP; writable only by native Apple daemons and tccutil. |
/Library/Application Support/com.apple.TCC/TCC.db |
System-Wide Store | Full Disk Access (SystemPolicyAllFiles), Accessibility (SystemPolicySysAdminFiles), Screen Recording. | Requires root privileges; heavily restricted even against elevated sudo users. |
When an application executes, the kernel-level tccd daemon evaluates its cryptographic designated requirement (code signature) against the records in TCC.db. If an administrator resets a service via tccutil, macOS purges the corresponding database rows, forcing the application to present a fresh authorisation prompt upon its subsequent execution.
Recognised TCC Service Identifiers
The tccutil command requires exact internal programmatic service strings rather than the consumer-facing labels displayed in System Settings > Privacy & Security.
| Consumer-Facing Setting | Internal TCC Service Identifier | Typical Operational Impact |
|---|---|---|
| Camera | Camera |
Built-in FaceTime HD camera and external USB webcams. |
| Microphone | Microphone |
Internal audio inputs, external audio interfaces, and headsets. |
| Screen Recording | ScreenCapture |
Display capture for screen sharing (e.g., Teams, Zoom, Slack). |
| Accessibility | Accessibility |
UI automation, hotkey interceptors, and window management tools. |
| Full Disk Access | SystemPolicyAllFiles |
Universal access to User and System Library containers, Mail, and Time Machine. |
| Developer Tools | SystemPolicyDeveloperFiles |
Running software locally that doesn’t meet system security policy. |
| AppleEvents (Automation) | AppleEvents |
Inter-process communication between scripts and apps via AppleScript. |
| Photos | Photos |
Direct access to the macOS Photos library database. |
| Calendar | Calendar |
Access to local and Exchange/iCloud calendar events. |
| Reminders | Reminders |
Read/write permissions for system Reminders and tasks. |
Command Syntax and Usage Patterns
The tccutil binary provides a concise command structure:
tccutil reset <SERVICE_NAME> [BUNDLE_IDENTIFIER]reset: The primary administrative verb executed by the utility.<SERVICE_NAME>: The exact case-sensitive TCC identifier (e.g.,Camera,Microphone). PassingAllresets all user-level privacy permissions universally.[BUNDLE_IDENTIFIER]: (Optional) The unique reverse-DNS identifier of a specific application (e.g.,com.tinyspeck.slackmacgap). If omitted,tccutilwipes the specified permission for every installed app on the system.
Step 1: Identifying an Application’s Bundle Identifier
To avoid wiping permissions for innocent applications, always target specific apps using their official Bundle Identifier. Query an application’s internal metadata using mdls or defaults:
# Query bundle identifier for Google Chrome
mdls -name kMDItemCFBundleIdentifier /Applications/Google\ Chrome.app
# Expected output:
# kMDItemCFBundleIdentifier = "com.google.Chrome"
# Query bundle identifier for Microsoft Teams
mdls -name kMDItemCFBundleIdentifier /Applications/Microsoft\ Teams.app
# Expected output:
# kMDItemCFBundleIdentifier = "com.microsoft.teams2"
# Query bundle identifier for Zoom
mdls -name kMDItemCFBundleIdentifier /Applications/zoom.us.app
# Expected output:
# kMDItemCFBundleIdentifier = "us.zoom.xos"Step 2: Resetting Permissions for a Specific Application
When an application fails to request permissions or its video/audio pipeline stalls, target only that application’s specific service record:
Resetting Camera Access for a Single App:
# Reset Camera permission for Google Chrome
tccutil reset Camera com.google.Chrome
# Expected output:
# Successfully reset Camera approval status for com.google.ChromeResetting Microphone Access for Video Conferencing:
# Reset Microphone for Microsoft Teams
tccutil reset Microphone com.microsoft.teams2
# Reset Microphone for Zoom
tccutil reset Microphone us.zoom.xosResetting Screen Capture Permissions:
# Reset Screen Recording for Slack
tccutil reset ScreenCapture com.tinyspeck.slackmacgapUpon restarting the application, macOS presents a pristine system security prompt requesting camera, audio, or screen capture privileges as if the application were launched for the first time.
Step 3: Resetting System-Wide Service Categories
If an entire category of hardware inputs becomes unmanageable across multiple software clients, reset the entire subsystem:
# Reset Camera approvals across all installed applications
tccutil reset Camera
# Reset Microphone approvals across all installed applications
tccutil reset Microphone
# Reset Accessibility approvals across all installed applications
tccutil reset AccessibilityWarning Regarding tccutil reset All: Executing tccutil reset All revokes every privacy permission for every user-space application on your Mac. You will be inundated with dozens of pop-up dialogues as background utilities, cloud sync daemons, and productivity tools request permission to run.
Step 4: Inspecting TCC Permissions via Terminal
While tccutil lacks a native “list” command, administrators can read the user-level TCC SQLite database directly using read-only SQL queries in Terminal:
# Query user TCC database for active Camera and Microphone records
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
"SELECT service, client, auth_value, last_modified FROM access WHERE service IN ('kTCCServiceCamera', 'kTCCServiceMicrophone');"Interpreting the auth_value column:
0: Denied (Explicitly blocked by user in dialogue).2: Allowed (Explicitly approved by user in dialogue).kTCCService...: The programmatic service prefix used internally by the database engine.
Troubleshooting Common tccutil Faults
| Observed Issue | Root Cause | Diagnostic & Remediation Step |
|---|---|---|
tccutil: Failed to reset service error |
Typo in the service name or attempting to reset a protected system-level service without elevated rights | Service names are strictly case-sensitive. Verify exact identifier (e.g., ScreenCapture, not screen-recording). For system-wide stores, prefix command with sudo. |
App still blocked after tccutil reset |
Application was actively running in memory when the command was executed | TCC cache is held in process memory. Completely quit the application (Cmd + Q or killall [app_name]) before running tccutil reset, then relaunch. |
Direct SQLite update fails with Error: database is locked or Operation not permitted |
System Integrity Protection (SIP) strictly forbids write access to TCC.db even for root |
Never attempt direct UPDATE or DELETE SQL queries on TCC.db. Use tccutil reset or deploy Privacy Preferences Policy Control (PPPC) profiles via an MDM. |
| Screen Recording toggle in System Settings remains greyed out | Enterprise Mobile Device Management (MDM) profile enforcing strict restriction payload | Open System Settings > Privacy & Security > Profiles. Check if an IT administrative profile (Jamf, Intune, or Kandji) has locked down screen recording permissions. |
Operational Governance and Best Practices
- Target Bundle IDs in Support Scripts: When preparing automated self-help scripts for corporate helpdesks, never run naked
tccutil reset Microphone. Always bind the command strictly to the failing enterprise app (e.g.,tccutil reset Microphone com.cisco.webexmeetingsapp). - Deploy PPPC Payloads for Enterprise Apps: In managed enterprise fleets, avoid forcing users to manually click prompts. Pre-approve camera, screen capture, and accessibility access using Apple Privacy Preferences Policy Control (PPPC) configuration profiles deployed via your MDM.
- Verify Code Signing After Binary Updates: If an in-house enterprise app constantly loses its TCC permissions across version updates, verify that the application binary is signed with a stable Developer ID certificate (
codesign -dv --verbose=4 /Applications/App.app). An inconsistent code signing identity triggers TCC invalidation.