Privacy Preferences Policy Control


With the release of macOS Mojave (10.14), Apple introduced controls that let the users allow or restrict cross-application data requests. Subsequently, macOS Catalina (10.15) extended this list of requests to include permissions such as Camera, Photos, Accessibility, AppleEvents, and much more. 

For example, certain apps or services might require users' permission(s) to access specific data or even other apps; similar to the permissions requested on mobile devices. The users must provide their consent, without which the apps and services might fail to function. Certain apps or services like Accessibility might even require admin privileges to grant access, which cannot be manually granted by a standard user.

Configuring Privacy Preferences Policy Control (PPPC) in MDM lets you remotely manage these security preferences/permissions. You can allow or restrict permissions requested by Mac applications, on the users' behalf.


Profile Settings



Identifier Specify the unique bundle identifier of the app.
Installation path Specify the installation path, if a non-bundled app is used.
Code sign requirement

Run the following command on a fresh installation of macOS 10.14 or later to obtain the
Code sign requirement, and specify it here.
codesign --display -r - /path/to/app/binary

For example, if you want to obtain Code sign requirement for the Desktop Central agent,
run the following command and specify the output displayed after => as the Code sign requirement.

codesign --display -r - /Library/DesktopCentral_Agent/ManageEngine\ Desktop\ Central\ -\

Output: designated => identifier "com.manageengine.ManageEngine-Desktop-Central---Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.] / exists */ and certificate leaf[field.1.2.840.113635.] / exists */ and certificate leaf[subject.OU] = TZ824L8Y37
Static code validation Enable this only if the app or process invalidates the dynamic Code sign requirement. By default, this will be disabled.
Permissions Allowed Permissions Specify permissions that you want to provide consent to, on behalf of the users.
Other Permissions Permissions which are not marked as allowed can be set to user controlled or restricted.
Specify apps for AppleEvents If the app or service requires permission to access other apps or services, individually specify them under AppleEvents.
  • You can configure PPPC for multiple apps within a single policy.
  • Permissions such as Camera, Microphone, and Screen Recording cannot be granted access by any MDM. These can only be restricted or left to user controlled, which is the default option.
Copyright © 2021, ZOHO Corp. All Rights Reserved.