Post

Replies

Boosts

Views

Activity

Reply to PPPC Accessibility Profile Not Applied on Golden Gate Beta When Deployed via Jamf
The macOS 27 change that makes Accessibility permissions user‑revocable, even when deployed via MDM, is causing major issues in our enterprise environment. We rely on agents like Digital Guardian, Forcepoint, and other security/RMM tools that need Accessibility. On macOS 26 and earlier, we could enforce these via PPPC. On macOS 27, users can disable them at any time, with no way to lock or prevent this on managed devices. Impact: Security controls can be silently disabled by users. We must build custom detection (TCC queries, scripts) and remediation flows. macOS becomes harder to align with Windows security baselines. Request: Provide an MDM‑enforced option to make critical permissions (Accessibility, Screen Recording, Input Monitoring) non‑revocable by standard users on supervised/corporate Macs. Offer clearer guidance and APIs for detecting and reporting permission state to EMM/UEM. We support the privacy goals, but this makes consistent enterprise security on macOS very difficult. Any clarification or roadmap for enterprise controls would be appreciated.
3w
Reply to PPPC Accessibility Profile Not Applied on Golden Gate Beta When Deployed via Jamf
The macOS 27 change that makes Accessibility permissions user‑revocable, even when deployed via MDM, is causing major issues in our enterprise environment. We rely on agents like Digital Guardian, Forcepoint, and other security/RMM tools that need Accessibility. On macOS 26 and earlier, we could enforce these via PPPC. On macOS 27, users can disable them at any time, with no way to lock or prevent this on managed devices. Impact: Security controls can be silently disabled by users. We must build custom detection (TCC queries, scripts) and remediation flows. macOS becomes harder to align with Windows security baselines. Request: Provide an MDM‑enforced option to make critical permissions (Accessibility, Screen Recording, Input Monitoring) non‑revocable by standard users on supervised/corporate Macs. Offer clearer guidance and APIs for detecting and reporting permission state to EMM/UEM. We support the privacy goals, but this makes consistent enterprise security on macOS very difficult. Any clarification or roadmap for enterprise controls would be appreciated.
Replies
Boosts
Views
Activity
3w