How to Manage macOS Privacy and Security Prompts (TCC) using MDM Configuration Profiles

Modern versions of macOS (starting aggressively with Catalina and expanding in Ventura and Sonoma) feature a robust security framework known as Transparency, Consent, and Control (TCC). This framework is responsible for the constant pop-up prompts users see when an application tries to access the camera, microphone, screen recording, or specific folders like Documents or Downloads. While great for personal security, TCC prompts cause massive friction in enterprise environments, often blocking management agents, backup software, or endpoint security tools until the end-user manually approves them in System Settings.

The Enterprise Solution: MDM and PPPC

To prevent users from being bombarded with prompts (and potentially clicking “Deny” on critical corporate software), administrators can pre-approve these permissions using Privacy Preferences Policy Control (PPPC) payloads, delivered via a Mobile Device Management (MDM) solution like Jamf Pro, Kandji, or Microsoft Intune.

Step 1: Identify the App Requirements

Before you can build a profile, you need to know exactly what permissions the application is requesting. Most enterprise software vendors (like CrowdStrike, Code42, or Zoom) provide documentation detailing their required TCC permissions. Common requirements include:

• Full Disk Access (SystemPolicyAllFiles)
• Accessibility (Accessibility)
• Screen Recording (ScreenCapture) – Note: Apple strictly forbids MDM from auto-allowing Screen Recording or Camera/Mic access. MDM can only “Deny” these or leave them up to the user.

Step 2: Gather Code Signature Information

macOS identifies applications based on their cryptographic code signature. You need the application’s Bundle Identifier and its Code Requirement string.

To find this, install the app on a test Mac, open Terminal, and use the codesign command:

codesign -dr - /Applications/TargetApp.app

You are looking for two pieces of information in the output:

1. Identifier: (e.g., com.vendor.targetapp)
2. Designated Requirement: A long string starting with identifier "com.vendor.targetapp" and anchor apple generic...

Step 3: Create the Configuration Profile

Writing a PPPC profile in raw XML (Mobileconfig) is incredibly difficult and prone to syntax errors. The industry standard is to use a graphical tool to generate the profile.

The most popular open-source tool for this is PPPC Utility (created by Jamf, but usable for any MDM).

1. Download and open the PPPC Utility on your Mac.
2. Drag and drop the target application into the left pane of the utility. The utility automatically reads the code signature.
3. In the right pane, select the permissions the app needs (e.g., set “All Files” to Allow).
4. Click Save. The tool will output a fully formatted .mobileconfig XML file.

Step 4: Deploy via MDM

Finally, upload the generated .mobileconfig file to your MDM provider as a Custom Configuration Profile. Scope the profile to your target Macs.

Because the profile is delivered by a trusted MDM server (assuming the Mac was enrolled via Automated Device Enrollment/DEP), macOS will silently accept the TCC overrides. When the software launches on the user’s machine, it will already have the necessary permissions, completely bypassing the disruptive pop-up prompts.