Skip to main content
This Library Item is available for Mac computers, iPhone devices, and iPad devices

​
About the Privacy Library Item

The Privacy Library Item holds two sets of controls. They work differently and apply to different platforms, so each one lives in its own tile in the Library Item. App access is backed by Privacy Preferences Policy Control (PPPC) and appears in the Mac only settings tile. Recommended privacy permissions appear in the iPhone iPad only settings tile, split into an Apps section and a Websites section. The Recommended privacy permissions sections appear only after you add iPhone or iPad under Install on.
Existing Privacy Library Items are not re-scoped. If you created a Library Item before iPhone and iPad support was added, you need to add those platforms to Install on yourself.

​
Add a Privacy Library Item

1

Create the Library Item

Follow the steps in Managing Library to create a Privacy Library Item.
2

Name the Library Item

Give the Library Item a descriptive name.
3

Set Install on

Under Install on, select the platforms this Library Item applies to: Mac, iPhone, and iPad.
4

Assign to Blueprints

Assign the Library Item to your desired Blueprints.
Only one Privacy Library Item applies to a device at a time. Configure the platform settings below, then select Save.

​
Configure Privacy Settings

App access uses PPPC to write a privacy decision directly to the Mac. Because the decision is set by the system, it does not appear in System Settings, users cannot change it, and there is no way to work around it.PPPC configures Transparency, Consent, and Control (TCC) settings. You identify each app by bundle ID or path, supply its code requirement, and choose which services it can reach. For more information, see Apple’s Privacy Preferences Policy Control documentation.

​
Determine which apps need a privacy profile

To determine if an app needs additional privacy permissions, follow these steps.
1

Install and launch the app

Install the app on a test device or a macOS virtual machine. Launch it and note any dialogs that appear, such as requests for accessibility features or the Downloads folder.
2

Open System Settings

Navigate to System Settings and select Privacy & Security.
3

Check app permissions

Select an option on the right, such as Accessibility. If your app is listed there, it needs that PPPC permission.
4

Get the app path

Control-click the app, then choose Show in Finder. Finder opens with the app selected. Drag the app into Terminal to get its full path for the next step.

​
Determine the identifier and code requirement

Collect the app’s code requirement and identifier using Terminal on a Mac that has the app installed.
1

Launch Terminal

Launch Terminal on a Mac that has the app installed.
2

Run codesign command

Run the following command, replacing /Applications/zoom.us.app with the path to your app:
3

Copy the code requirement and identifier

Copy all text after the => characters, with no leading or trailing spaces. This is the Code requirement. The portion between the quotes, such as us.zoom.xos, is the Identifier.

​
Configure app access

Privacy settings deployed through MDM do not appear in System Settings.
Fill out the Mac only settings tile.
1

Set the identifier type

If your output includes an identifier in the first part of the code requirement, leave App Identifier set to Bundle ID. Otherwise, select Path.
2

Enter the identifier or path

Enter the identifier found in the first part of the code requirement. If you selected Path, enter the path instead.
3

Paste the code requirement

Paste the full code requirement you copied from Terminal. Leading or trailing spaces can prevent the profile from deploying.
4

Validate the code requirement (optional)

Select Statically validate the code requirement only if the process invalidates its dynamic code signature. Most apps do not need this.
5

Select app or service

Select an option from the App or Service dropdown. This selection depends on the application’s requirements. For more information, see Determine which apps need a privacy profile.
6

Select access

From the Select access dropdown, choose Allow or Deny.
Due to Apple’s privacy requirements, you can only select Deny for Camera, Microphone, and Screen Recording. If you leave these settings undefined, the user can approve access themselves.
7

Complete additional fields (if shown)

Some apps or services ask for more information. For AppleEvents, set Receiver identifier type to Bundle ID or Path, then enter the Receiver identifier and Receiver code requirement.
8

Add more access (optional)

Select Add more to give the same app access to another service, or continue to the next step.
9

Add additional apps (optional)

Select Add app access only if you need to add another Mac app.
When you finish the Mac settings, go to the iPhone and iPad tab to configure recommended privacy permissions, or select Save.

​
Verify the profile

1

Open System Information

Open System Information on the target Mac computer.
2

Select Profiles

Select Profiles in the left column.
3

Locate the profile

Locate the profile containing the PPPC payload.
4

Expand profile details

Select the disclosure triangle next to the profile name.
5

Verify the TCC policy

Look for the com.apple.TCC.configuration-profile-policy entry. This confirms the profile is managing TCC permissions on the device.

​
Troubleshooting

1

Verify the code requirement

Confirm the code requirement was copied correctly with no leading or trailing spaces. Re-run the codesign -dr - command to verify it matches what is in your profile.
2

Check the identifier type

Verify you selected the correct identifier type, Bundle ID or Path, and that the identifier matches what the codesign command returned.
3

Verify the app is approved

Confirm the app is included in the approved applications list in your profile.
4

Check service permissions

Verify the correct services are configured for the app. For example, if an app needs screen recording access, confirm Screen Recording is selected.
5

Use the TCC log stream

To identify which app or binary is requesting access, run this command in Terminal:
This shows TCC permission requests in real time and helps identify the exact app or binary to add to your profile.
1

Test app functionality

In System Settings > Privacy & Security, sliders for certain permissions can appear grayed out even when the app has the permissions it needs. This is a display behavior, not a problem. Test the app to confirm it works.
2

Verify the profile is active

Confirm the profile is installed and active on the device by checking System Information > Profiles.
1

Verify the code requirement format

Confirm the code requirement has no leading or trailing spaces. A single space can prevent the profile from working.
2

Re-verify after an app update

If an app was updated, its code requirement may have changed. Re-run the codesign command and update your profile.
3

Check static validation

If you are using Statically validate the code requirement, confirm it is enabled only when the process invalidates its dynamic code signature. Most apps do not need it.