macOS Privacy Preferences Full Disk Access

[dbooth]

Hi. Does anyone have any insights into configuring a Privacy Preferences payload for macOS to give an application Full Disk Access (the permission shown in Systems Manager is 'System Policy All Files')? I am trying to do this for Cisco Secure Client & Cisco Secure Endpoint, using the Secure Endpoint published documentation (by specifying the BundleID), but it just doesn't seem to get applied. I've checked the BundleID given in the documentation matches the application when installed and it does. Thanks

[aleabrahao]

Cisco Secure Endpoint requires Full Disk Access for versions 1.18.0 and newer. Ensure your connector version is compatible.

Configure Permissions for Secure Endpoint Mac Connector and Orbital with MDM: Full Disk Access, System Extensions - Cisco

macOS 11+ requires System Extensions approval for Cisco Secure Client. You may need a separate payload for this.

Cisco Secure Client (including AnyConnect) Administrator Guide, Release 5 - Appendix: Cisco Secure Client Changes Related to macOS 11 (And Later) [Cisco Secure Client (including AnyConnect)] - Cisco

[dbooth]

Hi Alessandro, thanks these were the documents I had found originally to help me try and apply these settings.

[BlakeRichardson]

Try this utility.

https://github.com/jamf/PPPC-Utility

I have started seeing vendors provide a mobileconfig.profile for users to upload to their MDM that contain all of the relevant settings so hopefully Cisco does this soon.

[dbooth]

Blake, I had seen mentions of such utilities so thanks for the link.

[dbooth · Accepted solution]

It turns out that when you configure the Full Disk Access permissions it doesn't get reflected in the GUI on the device, so when I was thinking it wasn't being applied it actually was. There's just no way of verifying the policy is being applied on the end device other than if the application you're granting the permission to starts working correctly/stops complaining.