Skip to main content
This guide applies to Mac computers

​
What are Helper Tools?

Helper tools in macOS let applications perform privileged operations without running the full app with elevated privileges. They handle tasks that need higher permissions than the main application, such as managing file permissions, creating or deleting files, opening privileged ports, and modifying system settings.

​
How Helper Tools Work

A helper tool runs as a separate process with elevated privileges while the main application runs as a standard user. When the app needs a privileged operation, it calls the helper tool to perform it.

​
When to Expect Prompts about Helper Tools

On macOS, apps in the system Applications folder require administrator credentials to update, regardless of how they were installed. If an app checks for updates automatically, standard users may be prompted for administrator authentication so a helper tool can install the update. Users with administrator credentials should not see these prompts.

​
How to Avoid Helper Tool Prompts

Manage app updates through MDM when you can. Some vendors provide an MDM payload to disable automatic update checks; others need a scripted solution. Contact the vendor if you are unsure what a given application supports. For MDM in Iru, see MDM Overview. Iru also maintains a Custom Script to suppress helper tool prompts for many Auto App titles.
The method for disabling automatic updates varies by application. Not all titles support it.

​
Suppress App Update Helper Tool Prompts

This solution applies to macOS apps that prompt for administrator credentials to add a helper tool for a pending update. It will not cover every scenario, but it prevents most update helper tool prompts.If end users must enter administrator credentials to update apps outside the Auto Apps catalog, consider KAPPA, kpkg, AutoPkg, or Installomator to apply updates per your organization policy.
Many third-party apps try to add helper tools when a new version is available. macOS then shows an authorization prompt for administrator credentials. Without those credentials, the user may not be able to finish the update. Iru provides suppress_helper_prompts.zsh in the Support GitHub repository. The script changes one authorization right in the macOS authorization database (com.apple.ServiceManagement.daemons.modify) so non-root processes are denied silently before the helper prompt appears. Root processes, including mdmclient and the Iru Agent, are not affected. Iru continues to deliver settings and Auto App updates as expected. The change persists across logins, logouts, restarts, OS updates, and major upgrades, and it is reversible. See the project README for details.

​
Deploy the script

To add this Library Item, see Library Overview. For execution frequency and audit script options, see Custom Scripts Overview.
1

Copy the script

Copy the contents of suppress_helper_prompts.zsh from the Support GitHub repository.
2

Add a Custom Script Library Item

In Library, click Add Library Item, select Custom Script, then click Add and configure.
3

Name the Library Item

Give the Custom Script Library Item a Name.
4

Assign to Blueprints

Assign the Library Item to your desired Blueprints. Test with a subset of devices first.
5

Select Execution Frequency

Select Install once per device as the Execution Frequency.
The setting persists after the first successful run. Because the script is idempotent, you can use Run daily instead if you prefer.
6

Add Audit Script

Paste the script into the Audit Script field.
7

Save

Click Save.