[quote='866622022, ehale, /thread/807112?answerId=866622022#866622022, /profile/ehale'] @DTS Engineer I've discovered more information. The process /usr/libexe/mdmclient runs every so often to check if the machine is enrolled in MDM (I believe). This process seems to invoke our security agent plugin to check the right com.apple.ServiceManagement.daemons.modifywhich is the same right we are already modifying when this happens. I have tried to return early in our security agent's invoke method if it is the mdmclient process, but that didn't seem to work. I am going to see if I can return even earlier, or, ignore it altogether. [/quote] We are seeing the same thing. We can reproduce the SecurityAgent focus steal by killing the mdmclient process and making our Intune Company Portal app do a resync. @DTS Engineer Could we please get some feedback on this? This is affecting a lot of our Mac users.

[quote='866786022, DTS Engineer, /thread/807112?answerId=866786022#866786022'] Have either of your filed a bug about this yet? If so, please post the bug number. [/quote] Yes, I have reported a bug with this number: FB20987979

[quote='866797022, Afogh, /thread/807112?answerId=866797022#866797022, /profile/Afogh'] Yes, I have reported a bug with this number: FB20987979 [/quote] @DTS Engineer Any update on this? Is this being fixed?

[quote='867120022, shara7, /thread/806187?answerId=867120022#867120022, /profile/shara7'] This issue is a bug where CLI applications are not displayed in "Security and Privacy." [/quote] I believe it is a critical bug when it is related to security settings. You can't see what CLI applications you have given permissions.

@ehale Have you found any workarounds to the problem? Issue is still present in 26.2 RC...

[quote='869113022, ehale, /thread/807112?answerId=869113022#869113022, /profile/ehale'] @Afogh Yes, we have. If you keep "is-root" at the beginning of your list of rules (when needed), the system processes should be happier with that. [/quote] That is really nice to hear! We are still struggling with this problem. If I may ask how does your own custom rule look like? Is that a evaluate-mechanisms where you list your plugin?