Profile: Privacy Preferences

The "Privacy Preferences" profile (also known as PPPC, or Privacy Preferences Policy Control) allows admins to silently grant or deny specific macOS privacy permissions to an app — such as Accessibility, Full Disk Access, or Camera — without the app ever showing the device user a consent prompt.

Apple documentation for this feature is available here.

Note: To pre-populate the default answer to a user-facing consent prompt instead of silently granting or denying access, see App Privacy Permissions instead.

To create a Privacy Preferences profile:

1. Make sure the target devices are running macOS 10.14+ and have completed User-Approved MDM enrollment.
2. Go to Configs > Profiles and click "Create Profile".
3. From the list, select "Privacy Preferences".
4. Click "Add App Identity" to add an app to the profile.
5. Configure the identity and services as desired (see below).
6. Repeat for any additional apps, then assign the configuration to your devices/groups.

Privacy Preferences settings explained

A single profile can contain multiple app identities, and each identity can have multiple services configured at once.

• Identifier Type: Specifies how the app is identified — either by bundle ID or by file path.
• Identifier: The app's bundle identifier or file path, matching the identifier type selected above.
• Code Requirement: The app's code signing requirement. This can be obtained by running codesign --display -r -[path_to_app] against the app on a Mac. An incorrect or mismatched code requirement is a common reason a permission fails to apply.
• Static code validation: When enabled, if the app's dynamic code signature can't be validated (for example, because the process has already exited), SimpleMDM/macOS attempts to validate the code requirement statically instead.

• Services: Each service below can be set to Not Set (no change), Allow, or Block. Some services also support Allow Standard User To Set System Service (macOS 11+), which lets a standard (non-admin) user grant the permission themselves rather than having it silently allowed. Available services include:

  • Accessibility
  • Address Book (Contacts)
  • Calendar
  • Reminders
  • Photos
  • Camera (Block only)
  • Microphone (Block only)
  • Media Library
  • Speech Recognition
  • Screen Capture (Block or Allow Standard User To Set System Service)
  • Listen Event (Block or Allow Standard User To Set System Service)
  • Post Event
  • File Provider Presence
  • Access all files (Full Disk Access)
  • Access system administration files
  • Update or delete other applications
  • Access app data
  • System Policy Desktop Folder, Documents Folder, Downloads Folder, Network Volumes, and Removable Volumes

  Note: Some services require a minimum macOS version and are only shown for target devices running that version or later.

• Apple Events: In addition to the services above, an app identity can be configured to send Apple Events to one or more other apps. For each target, specify the receiving app's Identifier, Identifier Type, and Code Requirement, and whether the Apple Event is allowed.