We are seeing a reproducible system-wide input hang when Accessibility permission is revoked from an application that has an active Quartz event tap. The behavior reproduces on macOS Sequoia, Tahoe, and Golden Gate. I have created the standalone diagnostic app(EventTapPassThroughTest) isolates an active Quartz event tap implementation. It creates a session-level event tap for keyboard and mouse events and returns every event unchanged. It does not register for Accessibility-change notifications, suppress events, recreate the tap, or re-enable a tap disabled by macOS. It contains only the following behavior: Requests Accessibility access using AXIsProcessTrustedWithOptions. Creates a session-level, head-insert CGEventTap with .defaultTap. Observes common keyboard and mouse event types. Returns every received CGEvent unchanged with Unmanaged.passUnretained(event). Adds the tap to the main run loop and enables it. It does not suppress or modify events. It does not register for Accessibility-change notifications, recreate the tap, or re-enable a tap disabled by macOS. In both the disable and delete cases, local keyboard and mouse input become unresponsive. A forced restart is required when no remote session is available. The result reproduces even though the event-tap callback always returns the event unchanged. We did not observe a tapDisabledByTimeout or tapDisabledByUserInput callback before input became unresponsive. System logs show TCC modifying or deleting the Accessibility record. WindowServer then checks the running application's kTCCServicePostEvent/kTCCServiceListenEvent access and receives a denied or unknown result. Input subsequently stops being delivered normally. Expected result Revoking the permission should invalidate or disable the application's event tap without affecting system-wide input. If the application is expected to perform cleanup, it should receive a documented notification or tap-disabled callback early enough to disable and invalidate the tap safely. Questions Is revoking Accessibility permission while an active .defaultTap event tap exists expected to be supported? Is there a documented notification that an application can observe before or when its Accessibility/PostEvent access is revoked? Is there a supported way to ensure an existing event tap is safely disabled when the user turns off or deletes the application's permission? Should WindowServer automatically invalidate the tap in this situation?

We are testing the new Declarative Device Management (DDM) App Settings configuration on macOS 27 Golden Gate to manage Accessibility permission for our applications as suggested by the apple team in https://developer.apple.com/forums/thread/839536. We created a Jamf Blueprint with a custom com.apple.configuration.app.settings declaration and configured the required Accessibility settings. After applying the Blueprint to the User channel, we now receive the consent prompt shown in the attached screenshot. However, the permission flow does not appear to work as expected. Our understanding is that, after the user clicks Allow in this consent prompt, the configured Accessibility permission should be applied to the application without requiring an additional Accessibility authorization prompt. Instead, after selecting Allow, we still receive the subsequent prompt, which asks the user to choose either Open System Settings or Deny. The DDM declaration appears to have been successfully deployed and is shown as active on the system. Could you please clarify the following? Expected consent behavior: After the user selects Allow in the DDM App Settings consent prompt, should the configured Accessibility permission become effective without any additional Accessibility prompts? Consent scope: We are observing an Allow / Not Allow consent prompt for each DDM App Settings declaration. Is user consent expected to be requested separately for each declaration, or should macOS consolidate the Accessibility settings from multiple declarations into a single consent request? Additional Accessibility prompt: Why does the application continue to receive the Accessibility permission alert with Open System Settings / Deny even after the user has selected Allow for the DDM declaration? User interaction: Is there any supported way for an organization to manage or suppress these additional prompts so that no further user interaction is required after the initial DDM consent? Our goal is to understand the expected macOS 27 behavior and determine the supported management configuration for applications that previously received Accessibility permission through the PPPC payload.

We are experiencing an issue with Privacy Preferences Policy Control (PPPC) profiles deployed through Jamf Pro on the Golden Gate beta. We use the following Jamf configuration profiles to pre-approve Digital Guardian Accessibility permissions: DG – Grant Accessibility Access to DgSessionSvc.app DG – RME These profiles are intended to grant Accessibility permissions automatically for Digital Guardian under: System Settings → Privacy & Security → Accessibility On macOS Tahoe and macOS Sequoia, these PPPC profiles work as expected. After deployment, the required Accessibility permissions are granted automatically and users are not prompted. However, on the Golden Gate beta, the same configuration profiles are installed successfully, but the required Accessibility permissions are not granted. As a result, users continue to receive the Accessibility permission prompts. We also observed a difference when inspecting the installed profile under: System Settings → General → Device Management → Profile On macOS Tahoe, the installed profile contains the following entry: Control the Computer — com.verdasys.DgSessionSvc — Allowed On the Golden Gate beta, this entry is missing, even though the identical Jamf PPPC profile has been installed successfully. For reference, we have attached: The Jamf PPPC configuration profiles (.mobileconfig) DGSessionSvc MobileConfig RME MobileConfig Comparison screenshots from macOS Tahoe and the Golden Gate beta Could you please confirm whether this is: a known issue in the Golden Gate beta, an intentional change in PPPC behavior, or an issue with our PPPC configuration profile? If this is an operating system issue, we would appreciate it if it could be investigated and addressed in a future Golden Gate beta release. Environment Affected OS: Golden Gate 27.0 Beta (26A5388g) Working OS versions: macOS Tahoe and macOS Sequoia MDM Solution: Jamf Pro 11.30.1 Affected Application: Fortra Digital Guardian Required Permission: Accessibility (Control the Computer) Architecture: Apple silicon We would also appreciate it if you could review the attached .mobileconfig files and let us know whether any modifications are required to make the PPPC profiles compatible with the Golden Gate beta, or if any additional information would be helpful for your investigation.

We have an application which is written in Swift, which activates Transparent Proxy network extension. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) Sometimes we have observed that on starting the transparent proxy extension, the startProxy overridden delegate method(override func startProxy(options: [String : Any]?, completionHandler: @escaping (Error?) -> Void) {) in our AppProxyProvider class which is derived from NETransparentProxyProvider being called more than once for the same extension(pid). This leads to Over-resume of an object crash as we invoke setTunnelNetworkSettings inside the startProxy delegate. As this is controlled by the system, we are not sure why this delegate being called more than once sometimes even if we call the start TransparentProxy only once. Note that, this issue is seen only in Mac OS Tahoe. Apple Feedback ticket: FB21464147 (startProxy delegate for NETransparentProxyProvider class is being called twice for the same pid extension sometimes)

We have an application which is written in Swift, which activates Transparent Proxy network extension. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) We are using JamF MDM profile with VPN payload for deployment. With this MDM profile, we are observing an issue, ie TransparentProxy extension is not enabled when user performs logout and login and only in Sonoma. By analyzing it further we are noticing that in Sonoma some times, the system invokes NETransparentProxyProvider's stopProxy delegate once or twice with NEProviderStopReason as 12 ie userLogout. Due to this after login the system extension is not activated.

We have an application which is written in Swift, which activates Transparent Proxy network extension. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) We are using JAMF MDM profile for installing our transparent proxy in customer environment. We are using VPN payload(https://developer.apple.com/documentation/devicemanagement/vpn) for this network system extension. This payload does not have any field for order. As per https://developer.apple.com/documentation/devicemanagement/vpn/transparentproxy-data.dictionary documentation there is another payload for TransparentProxy and we could create a Transparent Proxy profile using iMazingProfile Editor. Noticed that, if we add the Order attribute to the VPN/TransparentProxy payload, while installing the extension, the save to preferences fails with "Error in saving TP configuration in updateOnDemandRule permission denied" error. Can we use this Order field to ordering the installed Transparent Proxy extension in a machine? Customer devices will likely have other Transparent Proxy network extensions as well. We want to allow the Customer to control the order in which each Transparent Proxy network extension receives the network traffic. How can we set the order of the Transparent proxy extension that can be deployed using MDM profile with VPN/TransparentProxy payload? Attached the TransparentProxy payload profile for the reference. DGWebProxy_TransparentProxy_iMazing

We have an application which is written in Swift, which activates Transparent Proxy network extension. We want to use MDM deployment for this network system extension. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) We don’t have any remote server setup to forward the traffic, instead we open a connection with a certain localhost:port (127.0.0.1:3128) to redirect the traffic which is received in our transparent proxy. We have another module that listens to the particular localhost:port to process the traffic further. As per https://developer.apple.com/documentation/devicemanagement/vpn/transparentproxy documentation, we noticed that we can use the VPN payload with app-proxy as Provider Type for Transparent Proxy. By referring this document, we created the profile. If we provide "127.0.0.1" as RemoteAddress field, we were able to install the profile and also while installing our product, the Transparent Proxy gets mapped with the one which is installed via profile. However after that the network is broken and hence unable to browse anything. We are suspecting the remote server(RemoteAddress) filed is causing this. What value should be provided in the RemoteAddress field?

We have an application which is written in Swift, which activates Transparent Proxy network extension. We are using Jamf MDM profile for deployment. To avoid the user deleting / disabling the extension from General -> LogIn Items & Extension -> Network Extensions screen, we are using "Non-removable system extensions from UI" attribute under Allowed System Extensions and Teams IDs section. In new Mac OS 26 (Tahoe), user can also enable/disable the extension from General -> LogIn Items & Extension -> Apps tab. The "Non-removable system extensions from UI" attribute set in Jamf MDM profile does not apply to this tab. Same attribute is working for General -> LogIn Items & Extension -> Extensions tab and there the slider is greyed out and Remove option is not available under more menu. Is there any new key/configuration defined to disable the slider from General -> LogIn Items & Extension -> Apps tab? Created https://feedbackassistant.apple.com/feedback/18198031 - FB18198031 feedback assistant ticket as well.

We have an application which is written in Swift, which activates network extension (Transparent Proxy). We want to use MDM deployment for this network system extension. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) We don’t have any remote server setup to forward the traffic, instead we open a connection with a certain localhost:port to redirect the traffic which is received in our transparent proxy. We have another module that listens to the particular localhost:port to process the traffic further. As per https://developer.apple.com/documentation/devicemanagement/vpn/transparentproxy documentation, we noticed that we can use the VPN payload with app-proxy as Provider Type for Transparent Proxy. We were able to install the profile created via Jamf Pro and also while in stalling our product the Transparent Proxy gets mapped with the one which is installed via profile. However after that the network is broken and hence unable to browse anything. We are suspecting the remote server filed is causing this. So we tried creating the custom profile without remote server address for VPN payload, but we are unable to install the profile. It throws below error: 2025-02-11 16:43:55.193348+0530 0x2f880 Error 0x0 6815 0 mdmclient: (NetworkExtension) [com.apple.networkextension:] Failed to save configuration DGWebProxy because it is invalid: Error Domain=NEConfigurationErrorDomain Code=2 "configuration is invalid: Missing server address" UserInfo={NSLocalizedDescription=configuration is invalid: Missing server address}
2025-02-11 16:43:55.193376+0530 0x2f880 Error 0x0 6815 0 mdmclient: (NetworkExtension) [com.apple.networkextension:] NEProfileIngestion Error occurred when saving configuration 'DGWebProxy': configuration is invalid: configuration is invalid: Missing server address 
2025-02-11 16:43:55.196159+0530 0x2f880 Error 0x0 6815 7 mdmclient: [com.apple.ManagedClient:CPDomainPlugIn] [ERROR] [0:MDMDaemon:CPDomainPlugIn:<0x2f880>] <<<<< PlugIn: InstallPayload [NEProfileIngestionPlugin] Error: Error Domain=ConfigProfilePluginDomain Code=-319 "The ‘VPN Service’ payload could not be installed. The VPN service could not be created." UserInfo={NSLocalizedDescription=The ‘VPN Service’ payload could not be installed. The VPN service could not be created.} <<<<<
2025-02-11 16:43:55.196826+0530 0x2f880 Error 0x0 6815 7 mdmclient: [com.apple.ManagedClient:MDMDaemon] [ERROR] [0:MDMDaemon:<0x2f880>] [CE] PlugIn_InstallPayload ==> Error Domain=ConfigProfilePluginDomain Code=-319 "The ‘VPN Service’ payload could not be installed. The VPN service could not be created." UserInfo={NSLocalizedDescription=The ‘VPN Service’ payload could not be installed. The VPN service could not be created.} Can we create MDM profile for Transparent Proxy without remote server address?

We have an application which is written in Swift, which activates two network extensions (Content Filter, Transparent Proxy). We want to use MDM deployment for these network system extensions. For Content Filter, we already have Jamf Profile which has Web Content Filter payload and it works fine. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) We don’t have any remote server setup to forward the traffic, instead we open a connection with a certain localhost:port to redirect the traffic which is received in our transparent proxy. We have another module that listens to the particular localhost:port to process the traffic further. We are unable to find the appropriate payload in any of the Profile Editor applications like Apple Configurator, iMazing Profile Editor and Jamf Pro that correctly describes our setup. As per https://developer.apple.com/documentation/devicemanagement/vpn/transparentproxy documentation, we noticed that we can use the VPN payload with app-proxy as Provider Type for Transparent Proxy. Here are the list of issues encountered with different MDM solutions. **AppleConfigurator: ** We were able to install the profile created via Apple Configurator. However when we install our product (which has the above mentioned system extensions), the Transparent Proxy added by our product fails to map with the installed profile. User has to provide the credentials and follow the steps while installing the extension via the product. Attached the screenshot of "Network-&gt;Filters" screen and the profile for reference. Profile Created using Apple Configurator iMazing Profile Editor: Unable to install the profile created using iMazing Profile Editor. Attached the screenshot of error and the profile for reference: Profile Created Using iMazing Profile Editor Jamf Pro: We were able to install the profile created via Jamf Pro and also while in stalling our product the Transparent Proxy gets mapped with the one which is installed via profile. However after that the network is broken and hence unable to browse anything. Attached the profile for reference. Profile Created using Jamf Pro What should be the correct profile payload to use for our Transparent Proxy?

We have an application, which activates two network extensions (Content Filter, Transparent Proxy) during app launch which is written in Swift. When we are activating multiple network extensions under the same app bundle, in Ventura and Sonoma, under Privacy and Security it shows "Details" button. On click of it we see below issues: - It shows the app bundle name instead of respective network extension bundle name. - On click of OK button, it adds only one extension under "Network -> Filters -> Filters & VPN" and only after machine restart, we can see both the extensions under this screen. These issues are not seen in Sequoia. In Sequoia, it shows the extension names under the app name. There are separate controls to enable/add each of the extension. Attached the screenshots of Sonoma and Sequoia for reference Already submitted the feedback ticket. (FB16331169)