> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Privacy Library Item

> Set up the Privacy Library Item in Iru Endpoint. Enforce app access with PPPC on Mac computers and recommend app and website permissions on iPhone and iPad devices.

<Callout icon="apple" color="#B84A7A" iconType="regular">This Library Item is available for Mac computers, iPhone devices, and iPad devices</Callout>

### About the Privacy Library Item

The Privacy Library Item holds two sets of controls. They work differently and apply to different platforms, so each one lives in its own tile in the Library Item.

| Control                             | Platform                | Behavior                                                                                       |
| ----------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------------- |
| **App access**                      | Mac computers           | Sets the privacy decision on the device. The user is not prompted and cannot change it.        |
| **Recommended privacy permissions** | iPhone and iPad devices | Tells the device which permissions an app or website needs. The user makes the final decision. |

App access is backed by Privacy Preferences Policy Control (PPPC) and appears in the **Mac only settings** tile. Recommended privacy permissions appear in the **iPhone iPad only settings** tile, split into an **Apps** section and a **Websites** section.

The **Recommended privacy permissions** sections appear only after you add iPhone or iPad under **Install on**.

<Note>
  Existing Privacy Library Items are not re-scoped. If you created a Library Item before iPhone and iPad support was added, you need to add those platforms to **Install on** yourself.
</Note>

### Add a Privacy Library Item

<Steps>
  <Step title="Create the Library Item">
    Follow the steps in [Managing Library](/en/endpoint/getting-started/blueprints-and-library/managing-library) to create a Privacy Library Item.
  </Step>

  <Step title="Name the Library Item">
    Give the Library Item a descriptive name.
  </Step>

  <Step title="Set Install on">
    Under **Install on**, select the platforms this Library Item applies to: **Mac**, **iPhone**, and **iPad**.
  </Step>

  <Step title="Assign to Blueprints">
    Assign the Library Item to your desired [Blueprints](/en/endpoint/blueprints/assignment-maps/creating-a-blueprint).
  </Step>
</Steps>

Only one Privacy Library Item applies to a device at a time. Configure the platform settings below, then select **Save**.

### Configure Privacy Settings

<Tabs>
  <Tab title="Mac" id="mac" icon="apple" iconType="brands">
    App access uses PPPC to write a privacy decision directly to the Mac. Because the decision is set by the system, it does not appear in System Settings, users cannot change it, and there is no way to work around it.

    PPPC configures Transparency, Consent, and Control (TCC) settings. You identify each app by bundle ID or path, supply its code requirement, and choose which services it can reach. For more information, see [Apple's Privacy Preferences Policy Control documentation](https://support.apple.com/en-gb/guide/deployment/dep38df53c2a/web).

    #### Determine which apps need a privacy profile

    To determine if an app needs additional privacy permissions, follow these steps.

    <Steps>
      <Step title="Install and launch the app">
        Install the app on a test device or a macOS virtual machine. Launch it and note any dialogs that appear, such as requests for accessibility features or the Downloads folder.
      </Step>

      <Step title="Open System Settings">
        Navigate to System Settings and select **Privacy & Security**.
      </Step>

      <Step title="Check app permissions">
        Select an option on the right, such as **Accessibility**. If your app is listed there, it needs that PPPC permission.
      </Step>

      <Step title="Get the app path">
        Control-click the app, then choose **Show in Finder**. Finder opens with the app selected. Drag the app into Terminal to get its full path for the next step.
      </Step>
    </Steps>

    #### Determine the identifier and code requirement

    Collect the app's code requirement and identifier using Terminal on a Mac that has the app installed.

    <Steps>
      <Step title="Launch Terminal">
        Launch Terminal on a Mac that has the app installed.
      </Step>

      <Step title="Run codesign command">
        Run the following command, replacing `/Applications/zoom.us.app` with the path to your app:

        ```bash theme={null}
        codesign -dr - "/Applications/zoom.us.app"
        ```
      </Step>

      <Step title="Copy the code requirement and identifier">
        Copy all text after the **=>** characters, with no leading or trailing spaces. This is the **Code requirement**. The portion between the quotes, such as `us.zoom.xos`, is the **Identifier**.
      </Step>
    </Steps>

    #### Configure app access

    <Note>
      Privacy settings deployed through MDM do not appear in System Settings.
    </Note>

    Fill out the **Mac only settings** tile.

    <Steps>
      <Step title="Set the identifier type">
        If your output includes an identifier in the first part of the code requirement, leave **App Identifier** set to **Bundle ID**. Otherwise, select **Path**.
      </Step>

      <Step title="Enter the identifier or path">
        Enter the identifier found in the first part of the code requirement. If you selected **Path**, enter the path instead.
      </Step>

      <Step title="Paste the code requirement">
        Paste the full code requirement you copied from Terminal. Leading or trailing spaces can prevent the profile from deploying.
      </Step>

      <Step title="Validate the code requirement (optional)">
        Select **Statically validate the code requirement** only if the process invalidates its dynamic code signature. Most apps do not need this.
      </Step>

      <Step title="Select app or service">
        Select an option from the **App or Service** dropdown. This selection depends on the application's requirements. For more information, see [Determine which apps need a privacy profile](#determine-which-apps-need-a-privacy-profile).
      </Step>

      <Step title="Select access">
        From the **Select access** dropdown, choose **Allow** or **Deny**.

        <Warning>
          Due to Apple's privacy requirements, you can only select **Deny** for Camera, Microphone, and Screen Recording. If you leave these settings undefined, the user can approve access themselves.
        </Warning>
      </Step>

      <Step title="Complete additional fields (if shown)">
        Some apps or services ask for more information. For **AppleEvents**, set **Receiver identifier type** to **Bundle ID** or **Path**, then enter the **Receiver identifier** and **Receiver code requirement**.
      </Step>

      <Step title="Add more access (optional)">
        Select **Add more** to give the same app access to another service, or continue to the next step.
      </Step>

      <Step title="Add additional apps (optional)">
        Select **Add app access** only if you need to add another Mac app.
      </Step>
    </Steps>

    When you finish the Mac settings, go to the [iPhone and iPad](#iphone-and-ipad) tab to configure recommended privacy permissions, or select **Save**.

    #### Verify the profile

    <Steps>
      <Step title="Open System Information">
        Open **System Information** on the target Mac computer.
      </Step>

      <Step title="Select Profiles">
        Select **Profiles** in the left column.
      </Step>

      <Step title="Locate the profile">
        Locate the profile containing the PPPC payload.
      </Step>

      <Step title="Expand profile details">
        Select the disclosure triangle next to the profile name.
      </Step>

      <Step title="Verify the TCC policy">
        Look for the `com.apple.TCC.configuration-profile-policy` entry. This confirms the profile is managing TCC permissions on the device.
      </Step>
    </Steps>
  </Tab>

  <Tab title="iPhone and iPad" id="iphone-and-ipad" icon="mobile-phone" iconType="solid">
    On iPhone and iPad devices, you recommend permissions rather than set them. The first time the user opens the app, or visits the site in Safari, the device shows one consent prompt listing everything you recommend along with your justification message. The user taps **Allow** to apply all of them, or **Not Now** to keep the standard prompts. The decision stays with the user.

    <Note>
      There is no way to deny a permission for a single app on iPhone or iPad. Enforcing a privacy decision per app is a Mac capability, configured under App access. The [Apple Restrictions Library Item](/en/endpoint/library/library-items-profiles/configure-the-restrictions-library-item) can turn off the camera, screenshots and screen recording, or dictation for the whole device, but it does not control Microphone, Bluetooth, Local Network, or Location for an individual app.
    </Note>

    Recommended privacy permissions require the following:

    * iOS 27 or later, or iPadOS 27 or later
    * Requires a supervised device.
    * **iPhone** or **iPad** added under **Install on**

    #### Recommend permissions for an app

    Fill out the **iPhone iPad only settings** tile under **Recommended privacy permissions - Apps**.

    <Steps>
      <Step title="Identify the app">
        Enter one or more bundle IDs in **Bundle ID**, or select **Pick from Library** and choose apps already in your Library. You cannot add the same app twice in one Library Item.
      </Step>

      <Step title="Enter a justification message">
        Enter a **Justification message** explaining why your organization recommends these permissions. Users see this text on the consent prompt. Every app requires one, and a rule without one shows **Missing required fields**.
      </Step>

      <Step title="Set the recommended permissions">
        Set a value for each permission you want to recommend. Any permission left at **Not configured** is not sent, and the user is prompted for it as usual.
      </Step>

      <Step title="Add additional apps (optional)">
        Select **Add app** only if you need to add another app.
      </Step>
    </Steps>

    These are the permissions you can recommend for an app:

    | Permission        | Values               |
    | ----------------- | -------------------- |
    | Bluetooth         | Allow                |
    | Camera            | Allow                |
    | Dictation         | Allow                |
    | Microphone        | Allow                |
    | Local Network     | Allow                |
    | Location          | While using, Always  |
    | Location Accuracy | Approximate, Precise |

    #### Recommend permissions for a website

    Websites can ask for the camera and microphone in the same way apps do, so you can recommend those permissions for the sites your organization relies on. Unlike the Apps section, you do not choose permissions per site. The justification message and the recommended permissions apply to every website you add. On the first visit in Safari, the device shows a single consent prompt, and the user taps **Allow** or **Not Now**.

    <Note>
      These recommendations apply to Safari only. If a user opens one of these websites in another browser, that browser prompts for camera and microphone access as it normally would, even when it is set as the default browser.
    </Note>

    <Steps>
      <Step title="Add a website">
        Under **Recommended privacy permissions - Websites**, select **Add website**.
      </Step>

      <Step title="Enter the website identifier">
        Select **Domain** to match a single domain, such as `www.iru.com`. Select **Wildcard** to match a domain and its subdomains, such as `*example.com`. Enter a domain, not a full URL.
      </Step>

      <Step title="Add more websites (optional)">
        Select **Add website** to include additional domains. They use the same justification message and recommended permissions.
      </Step>

      <Step title="Enter a justification message">
        Enter a **Justification message**. Users see this text when they visit any of the websites you added.
      </Step>

      <Step title="Set the recommended permissions">
        Recommend **Camera**, **Microphone**, or both. These values apply to every website in the list. Any permission left at **Not configured** is not sent.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Applications still prompting for permissions on Mac">
    <Steps>
      <Step title="Verify the code requirement">
        Confirm the code requirement was copied correctly with no leading or trailing spaces. Re-run the `codesign -dr -` command to verify it matches what is in your profile.
      </Step>

      <Step title="Check the identifier type">
        Verify you selected the correct identifier type, Bundle ID or Path, and that the identifier matches what the codesign command returned.
      </Step>

      <Step title="Verify the app is approved">
        Confirm the app is included in the approved applications list in your profile.
      </Step>

      <Step title="Check service permissions">
        Verify the correct services are configured for the app. For example, if an app needs screen recording access, confirm **Screen Recording** is selected.
      </Step>

      <Step title="Use the TCC log stream">
        To identify which app or binary is requesting access, run this command in Terminal:

        ```bash theme={null}
        log stream --debug --predicate 'subsystem == "com.apple.TCC" AND eventMessage BEGINSWITH "AttributionChain"'
        ```

        This shows TCC permission requests in real time and helps identify the exact app or binary to add to your profile.
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="Consent prompt not appearing on iPhone or iPad">
    <Steps>
      <Step title="Confirm the OS version">
        Recommended privacy permissions require iOS 27 or later, or iPadOS 27 or later. Devices below that version ignore the settings.
      </Step>

      <Step title="Confirm the device is supervised">
        Recommended privacy permissions require a supervised device. See [Apple Device Supervision](/en/endpoint/enrollment/apple/apple-device-supervision).
      </Step>

      <Step title="Confirm the platforms are assigned">
        Check that **iPhone** or **iPad** is listed under **Install on** in the Library Item.
      </Step>

      <Step title="Check for missing required fields">
        A rule without a justification message shows **Missing required fields** and is not deployed.
      </Step>

      <Step title="Confirm the app has not already been opened">
        The prompt appears at first launch or first visit. If the user already responded to permission prompts for that app or site, the recommendation does not appear again.
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="System Settings shows grayed out permissions">
    <Steps>
      <Step title="Test app functionality">
        In System Settings > Privacy & Security, sliders for certain permissions can appear grayed out even when the app has the permissions it needs. This is a display behavior, not a problem. Test the app to confirm it works.
      </Step>

      <Step title="Verify the profile is active">
        Confirm the profile is installed and active on the device by checking System Information > Profiles.
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="Code requirement issues">
    <Steps>
      <Step title="Verify the code requirement format">
        Confirm the code requirement has no leading or trailing spaces. A single space can prevent the profile from working.
      </Step>

      <Step title="Re-verify after an app update">
        If an app was updated, its code requirement may have changed. Re-run the codesign command and update your profile.
      </Step>

      <Step title="Check static validation">
        If you are using **Statically validate the code requirement**, confirm it is enabled only when the process invalidates its dynamic code signature. Most apps do not need it.
      </Step>
    </Steps>
  </Accordion>
</AccordionGroup>