Thanks Eskimo Your answer made me realize the error was on my part. I think I started building my sysex using a driverkit template so I could not add a provisioning profile to the extension. Using the template for a network extension it worked perfectly.

Hi! Thanks for your suggestion. The binary already makes itself the active application with NSApp.activate(ignoringOtherApps: true) but it had no effect. Moving a binary out of its app bundle makes its window non-active so I think there something related to app bundle... As a side note, talking about bundle, the Info.plist has Application is agent (UIElement).

Thank you eskimo for your answer. What I am afraid of is if a malicious program modifies the script contained in our app bundle after it is being distributed with our MDM solution. From manual test I did it seems that the app will run even if the script has been compromised. I thought that by code signing the app it would prevent the app launch when the content changed.

Thanks Eskimo! We will consider about using the codesigning API or another way to validate our script. And thanks nk_kennedy for the comments!

Hey, No we did not find how to defer activation to the next reboot. Seems like the after reboot is reserved for particular SystemExtensions.