We are testing the new Declarative Device Management (DDM) App Settings configuration on macOS 27 Golden Gate to manage Accessibility permission for our applications as suggested by the apple team in https://developer.apple.com/forums/thread/839536.
We created a Jamf Blueprint with a custom com.apple.configuration.app.settings declaration and configured the required Accessibility settings. After applying the Blueprint to the User channel, we now receive the consent prompt shown in the attached screenshot.
However, the permission flow does not appear to work as expected.
Our understanding is that, after the user clicks Allow in this consent prompt, the configured Accessibility permission should be applied to the application without requiring an additional Accessibility authorization prompt.
Instead, after selecting Allow, we still receive the subsequent prompt, which asks the user to choose either Open System Settings or Deny.
The DDM declaration appears to have been successfully deployed and is shown as active on the system.
Could you please clarify the following?
Expected consent behavior: After the user selects Allow in the DDM App Settings consent prompt, should the configured Accessibility permission become effective without any additional Accessibility prompts?
Consent scope: We are observing an Allow / Not Allow consent prompt for each DDM App Settings declaration. Is user consent expected to be requested separately for each declaration, or should macOS consolidate the Accessibility settings from multiple declarations into a single consent request?
Additional Accessibility prompt: Why does the application continue to receive the Accessibility permission alert with Open System Settings / Deny even after the user has selected Allow for the DDM declaration?
User interaction: Is there any supported way for an organization to manage or suppress these additional prompts so that no further user interaction is required after the initial DDM consent?
Our goal is to understand the expected macOS 27 behavior and determine the supported management configuration for applications that previously received Accessibility permission through the PPPC payload.