Mobile Device Management

Mobile Device Management (MDM) is a technology commonly used to administer end-user computing devices and under macOS can be used to restrict the acceptance of system extensions.

System Extension

When a system policy blocks the loading of a system extension we see the following error in the UPDD Diagnostics log and also when manually trying to activate the extension, as per this example:

 dhb75@DD142 ~ % /Applications/Utilities/UPDD\ System\ Extension.app/Contents/MacOS/UPDD\ System\ Extension activate
2022-03-22 20:33:52.418 UPDD System Extension[1642:19421] UPDD System Extension application has started 
2022-03-22 20:33:52.419 UPDD System Extension[1642:19421] Activating DriverKit extension...
2022-03-22 20:33:52.421 UPDD System Extension[1642:19421] ...submitted activation request
2022-03-22 20:33:52.473 UPDD System Extension[1642:19421] Request failed with error code: 10
2022-03-22 20:33:52.476 UPDD System Extension[1642:19421] An error occurred: The operation couldn’t be completed. (OSSystemExtensionErrorDomain error 10.)

​You may also see this notification if a MDM profile exists that disallows user approvals:

An error code that indicates the system policy prohibits activating the system extension.

The unified log output also confirms the loading of the extension has been denied:

2021-01-04 13:23:59.863 Df sysextd[231:b19c7] Extension with teamID teamID("<redacted>"), identifier <redacted> is not in the list of allowed extensions.
2021-01-04 13:23:59.863 Df sysextd[231:b19c7] Activation decision for extension with teamID teamID("<redacted>"), identifier <redacted> is Deny

Adding UPDD System Extension to the approved list

In the MDM system extension configuration you can specify that the UPDD System Extension is approved

Team Identifier: U86H28HG4S

Bundle Identifier: com.touch-base.updd-system-extension-dext

Granting Accessibility and Screen Recording permissions

Certain applications included with the UPDD software suite require macOS privacy permissions that are typically granted manually by the end user. However, on managed macOS devices, administrators can pre-approve these permissions via a Privacy Preferences Policy Control (PPPC) profile payload to prevent user prompts.

Required permissions:

• Accessibility: Required by UPDD Commander, UPDD Annotate, and the driver process in order to inspect on-screen UI elements, synthesize mouse clicks, and send keystrokes.
• Screen Recording (Screen Capture): Required by UPDD Commander for its Smart Magnifier and screen zooming features.

MDM Configuration Reference

​To grant these permissions in your MDM solution (Jamf Pro, Apple Configurator, Kandji, Mosyle, Microsoft Intune, etc.), create or update a Privacy Preferences Policy Control (PPPC) configuration profile using the following settings:

Notes

Code Requirements: Most modern MDM platforms will automatically look up the Designated Requirement (Code Requirement) if you upload the .app bundle directly. If your MDM requires manual input, run the following command in Terminal to extract it:

codesign -dr - /path/to/Application.app

Screen Capture: Due to macOS restrictions, setting Screen Capture permission to "Allow" in your MDM profile cannot automatically enable it without a prompt. However, deploying this profile ensures that standard (non-admin) users can approve the prompt themselves without requiring administrative credentials.