How to Implement MDM Configuration Profiles for macOS Kernel Extensions

The Transition from Kexts to System Extensions

Historically, low-level macOS software like antivirus tools, VPN clients, and advanced audio drivers relied on Kernel Extensions (Kexts) to function. Kexts run directly in the macOS kernel space, meaning a poorly written Kext could cause the entire operating system to suffer a kernel panic.

Starting with macOS Big Sur (macOS 11), Apple heavily deprecated Kexts in favor of System Extensions, which run in user space. However, legacy enterprise software may still require Kexts. To install a Kext on a modern Mac, the user is heavily prompted to reboot the machine, open the Recovery partition, and manually downgrade the system’s security settings. In an enterprise environment with hundreds of Macs, this manual intervention is unacceptable. The solution is to use Mobile Device Management (MDM) configuration profiles to silently authorize specific Kexts.

Requirements for Kext Authorization via MDM

Before you begin, you must ensure two strict requirements are met:

1. The Mac must be enrolled in your MDM solution via Automated Device Enrollment (formerly DEP), or enrolled via User Approved MDM.
2. You must possess the Team Identifier (Team ID) of the software developer who created the Kext, and optionally the Bundle Identifier of the Kext itself.

The Team ID is a 10-character alphanumeric string assigned by Apple to registered developers (e.g., EQHXZ8M8AV for Google).

Step 1: Finding the Developer Team ID and Bundle ID

If you have the application installed on a test Mac, you can use the sqlite3 tool to query the local Kext policy database to find the developer’s Team ID.

Open the Terminal and run:

sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy "SELECT team_id, bundle_id, allowed FROM kext_policy;"

This will output a list of installed Kexts. Look for the application you wish to deploy and note the 10-character Team ID in the first column, and the bundle ID (e.g., com.company.app.kext) in the second column.

Step 2: Creating the Configuration Profile Payload

To authorize the Kext, you must build a Configuration Profile using the com.apple.syspolicy.kernel-extension-policy payload type. You can create this using tools like Apple Configurator 2, iMazing Profile Editor, or directly via XML.

Here is an example of the XML structure required in the `.mobileconfig` file to whitelist all Kexts signed by a specific Team ID:

<key>PayloadContent</key>
<array>
    <dict>
        <key>PayloadType</key>
        <string>com.apple.syspolicy.kernel-extension-policy</string>
        <key>AllowUserOverrides</key>
        <true/>
        <key>AllowedTeamIdentifiers</key>
        <array>
            <string>EQHXZ8M8AV</string>
        </array>
        <key>AllowedKernelExtensions</key>
        <dict>
            <key>EQHXZ8M8AV</key>
            <array>
                <string>com.google.dfsfuse.filesystems.dfsfuse</string>
            </array>
        </dict>
    </dict>
</array>

In this payload, AllowedTeamIdentifiers broadly authorizes any Kext signed by that Team ID. If you want tighter security, you can specify exact Kexts using the AllowedKernelExtensions dictionary, mapping the Team ID to the specific Bundle ID.

Step 3: Deploying the Profile via MDM

Upload the saved `.mobileconfig` file to your MDM server (such as Jamf Pro, Kandji, or Workspace ONE). Scope the profile to the target Macs.

Crucial Timing Rule: You MUST deploy the Configuration Profile to the Mac before the application containing the Kext is installed. If the software is installed first, macOS will trigger the security block and prompt the user. By ensuring the MDM profile is active on the machine beforehand, the Kext will load silently in the background without user intervention.

While Apple is strongly pushing developers away from Kernel Extensions, enterprise IT administrators still need to manage legacy software. By utilizing the Kernel Extension Policy MDM payload, administrators can authorize required Kexts silently, ensuring security compliance without disrupting the end-user experience.