Description
The options to manage and enforce privacy settings have changed with macOS 27. Apple has introduced the app.settings declaration which consolidates organizationally based privacy requests into a single consent screen for end users to allow when they open the app for the first time.
Allow: When the end user chooses Allow, the configured defaults are applied and the user is not prompted again for the services.
Not Now: When the end user chooses Not Now, the user will receive the standard permission prompt when the app first needs access (for example with Zoom, enabling microphone or camera)
There is no supported mechanism on macOS 27 to grant these permissions silently or without user consent.
Requirements
Supervised computers on macOS 27 or later
macOS privacy declarations install as User-Channel, which requires an MDM-enabled user to receive those declaration settings
Apps are required to be "AppKit-based"
Capturing the Designated Requirement
Follow the steps below to capture the designated requirement of the app needed to configure the blueprint.
Keep in mind - app privacy permission defaults are scoped strictly to the app whose signature matches the composed identifier. If a sub-process or sub-app is the component that actually touches the privacy subsystem, then that component is the one that needs the permission — not necessarily the top-level app.
Install the app on a supervised computer with macOS 27. Ensure the app is the same version you are deploying to devices.
Open Terminal and run the following command, using the correct path and app name:
codesign -d -r - /path/to/AppName.appThe designated requirement will be everything in the output after
designated =>. This text will be added to the blueprint later; keep the whole string on one logical line and avoid rich-text sources that inject smart quotes or line breaks.
For example, the command and output for Zoom are below:codesign -d -r - /Applications/zoom.us.app
Executable=/Applications/zoom.us.app/Contents/MacOS/zoom.us
designated => identifier "us.zoom.xos" and anchor apple generic and certificate
1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate
leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate
leaf[subject.OU] = BJ4HAAB9B3
Configuring App Privacy in Jamf Pro
In Jamf Pro, go to Blueprints and either create a new blueprint or open an existing blueprint you'd like to add the setting to.
Click on the App Settings component.
Enable the App privacy permission defaults setting and then click Configure.
Click +Add key.
Click Configure on that empty key row that appears.
Enable Organization justification and fill in the message for your end users to see on the consent prompt. This field is required.
Enable the settings end users should consent to for the app and set them to Allow. Then click Update.
Leaving a service at
Noneomits it from the prompt rather than denying it.The permission defaults editor will show again, with the key row now summarizing the values configured previously. Replace the placeholder key name with the composed identifier: the bundle ID followed by the designated requirement gathered above wrapped in
{ }. Click Update in the lower-right corner.
Click Add.
Ensure the correct device groups are in Scope and set an activation if desired. For more information see the Jamf Pro Blueprints Configuration Guide.
Click Deploy.
More Resources