topic Re: macOS Privacy Preferences Full Disk Access in Endpoint Security

macOS Privacy Preferences Full Disk Access

dbooth — Tue, 28 Oct 2025 11:58:08 GMT

Hi. Does anyone have any insights into configuring a Privacy Preferences payload for macOS to give an application Full Disk Access (the permission shown in Systems Manager is 'System Policy All Files')? I am trying to do this for Cisco Secure Client & Cisco Secure Endpoint, using the Secure Endpoint published documentation (by specifying the BundleID), but it just doesn't seem to get applied. I've checked the BundleID given in the documentation matches the application when installed and it does. Thanks

Re: macOS Privacy Preferences Full Disk Access

aleabrahao — Tue, 28 Oct 2025 16:57:27 GMT

Cisco Secure Endpoint requires Full Disk Access for versions 1.18.0 and newer. Ensure your connector version is compatible.

Configure Permissions for Secure Endpoint Mac Connector and Orbital with MDM: Full Disk Access, System Extensions - Cisco

macOS 11+ requires System Extensions approval for Cisco Secure Client. You may need a separate payload for this.

Cisco Secure Client (including AnyConnect) Administrator Guide, Release 5 - Appendix: Cisco Secure Client Changes Related to macOS 11 (And Later) [Cisco Secure Client (including AnyConnect)] - Cisco

Re: macOS Privacy Preferences Full Disk Access

BlakeRichardson — Tue, 28 Oct 2025 20:00:19 GMT

Try this utility.

https://github.com/jamf/PPPC-Utility

I have started seeing vendors provide a mobileconfig.profile for users to upload to their MDM that contain all of the relevant settings so hopefully Cisco does this soon.

Re: macOS Privacy Preferences Full Disk Access

dbooth — Fri, 31 Oct 2025 08:58:11 GMT

Hi Alessandro, thanks these were the documents I had found originally to help me try and apply these settings.

Re: macOS Privacy Preferences Full Disk Access

dbooth — Fri, 31 Oct 2025 08:58:53 GMT

Blake, I had seen mentions of such utilities so thanks for the link.

Re: macOS Privacy Preferences Full Disk Access

dbooth — Fri, 31 Oct 2025 09:01:23 GMT

It turns out that when you configure the Full Disk Access permissions it doesn't get reflected in the GUI on the device, so when I was thinking it wasn't being applied it actually was. There's just no way of verifying the policy is being applied on the end device other than if the application you're granting the permission to starts working correctly/stops complaining.