Description

The options to manage and enforce privacy settings have changed with macOS 27. This article details the changes and provides a workflow for deploying app privacy settings in macOS 27.

Accessibility Management Changes

With macOS 27, admin and standard users can always disable an app from having Accessibility privacy privileges at any time.
PPPC configuration profiles or legacy profile settings in blueprints will continue to automatically enable Accessibility access for an application, but end users are shown a Notification Center banner stating the privacy access for the application.
Apple has introduced the app.settings declaration which consolidates organizationally based privacy requests into a single consent screen, shown below, for end users to allow when they open the app for the first time.

Allow	When the end user chooses Allow, the configured defaults are applied and the user is not prompted again for the services.
Not Now	When the end user chooses Not Now, the user will receive the standard permission prompt when the app first needs access (for example with Zoom, enabling microphone or camera)

Note:

There is no supported mechanism on macOS 27 to grant these permissions silently or without user consent.
The PPPC keys for items now available in the app.settings declaration are now listed as deprecated but still work for macOS 27.

Requirements for app.settings

Supervised computers on macOS 27 or later
macOS privacy declarations install as User-Channel, which requires an MDM-enabled user to receive those declaration settings
Apps are required to be AppKit-based

Capturing the Designated Requirement

Follow the steps below to capture the designated requirement of the app needed to configure the blueprint.

Keep in mind - app privacy permission defaults are scoped strictly to the app whose signature matches the composed identifier. If a sub-process or sub-app is the component that actually touches the privacy subsystem, then that component is the one that needs the permission — not necessarily the top-level app.

Install the app on a supervised computer with macOS 27. Ensure the app is the same version you are deploying to devices.
Open Terminal and run the following command, using the correct path and app name: codesign -d -r - /path/to/AppName.app

The designated requirement will be everything in the output after designated =>. This text will be added to the blueprint later; keep the whole string on one logical line and avoid rich-text sources that inject smart quotes or line breaks.

For example, the command and output for Zoom are below:

codesign -d -r - /Applications/zoom.us.app

Executable=/Applications/zoom.us.app/Contents/MacOS/zoom.us
designated => identifier "us.zoom.xos" and anchor apple generic and certificate
1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate
leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate
leaf[subject.OU] = BJ4HAAB9B3

Configuring App Privacy in Jamf Pro

In Jamf Pro, go to Blueprints and either create a new blueprint or open an existing blueprint you'd like to add the setting to.
Click on the App Settings component.
Enable the App privacy permission defaults setting and then click Configure.
Click +Add key.
Click Configure on that empty key row that appears.
Enable Organization justification and fill in the message for your end users to see on the consent prompt. This field is required.
Enable the settings end users should consent to for the app and set them to Allow. Then click Update.
Leaving a service at None omits it from the prompt rather than denying it.
The permission defaults editor will show again, with the key row now summarizing the values configured previously. Replace the placeholder key name with the composed identifier: the bundle ID followed by the designated requirement gathered above wrapped in { }. Click Update in the lower-right corner.
Click Add.
Ensure the correct device groups are in Scope and set an activation if desired. For more information see the Jamf Pro Blueprints Configuration Guide.
Click Deploy.

Displaying the Consent Prompt After First Launch

If the app has already been opened before the blueprint declaration is on the device, end users will not receive the consent prompt. If your organization would like end users to receive the prompt, the tccutil tool can reset the permissions so a prompt will generate on the next launch: sudo tccutil reset All <applicationBundleID>

For example, to display the consent prompt for Zoom: sudo tccutil reset All us.zoom.xos

A Jamf Pro policy can be used to reset the permissions for an app following the steps below:

In Jamf Pro go to Computers > Policies and click + New.
Under the Options > General payload:
1. Provide a Display Name
2. Select a Trigger
3. Set the Execution frequency - once per computer is recommended depending on the scope used
Select the Files and Processes payload and click Configure.
Under Execute Command add the tccutil tool with the bundle ID for the app. No sudo is needed: tccutil reset All <applicationBundleID>
Click Scope and add desired computers.
Click Save.

Deploying App Privacy Permission Defaults in macOS 27