Skip to main content
This Library Item is available for Mac computers, iOS devices, and iPadOS devices

​
About the Privacy Library Item

The Privacy Library Item holds two sets of controls. They work differently, so each one lives in its own tile in the Library Item. App access is backed by Privacy Preferences Policy Control (PPPC) and appears in the Mac only settings tile. Configure recommended app permissions separately for iPhone and iPad, and for Mac. Recommended website permissions use the same settings for Mac, iPhone, and iPad. Recommended privacy permissions require a supervised device running iOS 27 or later, iPadOS 27 or later, or macOS 27 or later. The tiles appear after you add the matching platforms under Install on.
Existing Privacy Library Items are not re-scoped. If you created a Library Item before iPhone and iPad support was added, you need to add those platforms to Install on yourself.

​
Add a Privacy Library Item

1

Create the Library Item

Follow the steps in Managing Library to create a Privacy Library Item.
2

Name the Library Item

Give the Library Item a descriptive name.
3

Set Install on

Under Install on, select the platforms this Library Item applies to: Mac, iPhone, and iPad.
4

Assign to Blueprints

Assign the Library Item to your desired Blueprints.
Only one Privacy Library Item applies to a device at a time. Configure the platform settings below, then select Save.

​
Configure Privacy Settings

App access uses PPPC to write a privacy decision directly to the Mac. Because the decision is set by the system, it does not appear in System Settings, users cannot change it, and there is no way to work around it.PPPC configures Transparency, Consent, and Control (TCC) settings. You identify each app by bundle ID or path, supply its code requirement, and choose which services it can reach. For more information, see Apple’s Privacy Preferences Policy Control documentation.

​
Determine which apps need a privacy profile

To determine if an app needs additional privacy permissions, follow these steps.
1

Install and launch the app

Install the app on a test device or a macOS virtual machine. Launch it and note any dialogs that appear, such as requests for accessibility features or the Downloads folder.
2

Open System Settings

Navigate to System Settings and select Privacy & Security.
3

Check app permissions

Select an option on the right, such as Accessibility. If your app is listed there, it needs that PPPC permission.
4

Get the app path

Control-click the app, then choose Show in Finder. Finder opens with the app selected. Drag the app into Terminal to get its full path for the next step.

​
Determine the identifier and code requirement

Collect the app’s code requirement and identifier using Terminal on a Mac that has the app installed.
1

Launch Terminal

Launch Terminal on a Mac that has the app installed.
2

Run codesign command

Run the following command, replacing /Applications/zoom.us.app with the path to your app:
3

Copy the code requirement and identifier

Copy all text after the => characters, with no leading or trailing spaces. This is the Code requirement. The portion between the quotes, such as us.zoom.xos, is the Identifier.

​
Configure app access

Privacy settings deployed through MDM do not appear in System Settings.
Fill out the Mac only settings tile.
1

Set the identifier type

If your output includes an identifier in the first part of the code requirement, leave App Identifier set to Bundle ID. Otherwise, select Path.
2

Enter the identifier or path

Enter the identifier found in the first part of the code requirement. If you selected Path, enter the path instead.
3

Paste the code requirement

Paste the full code requirement you copied from Terminal. Leading or trailing spaces can prevent the profile from deploying.
4

Validate the code requirement (optional)

Select Statically validate the code requirement only if the process invalidates its dynamic code signature. Most apps do not need this.
5

Select app or service

Select an option from the App or Service dropdown. This selection depends on the application’s requirements. For more information, see Determine which apps need a privacy profile.
6

Select access

From the Select access dropdown, choose Allow or Deny.
Due to Apple’s privacy requirements, you can only select Deny for Camera, Microphone, and Screen Recording. If you leave these settings undefined, the user can approve access themselves.
7

Complete additional fields (if shown)

Some apps or services ask for more information. For AppleEvents, set Receiver identifier type to Bundle ID or Path, then enter the Receiver identifier and Receiver code requirement.
8

Add more access (optional)

Select Add more to give the same app access to another service, or continue to the next step.
9

Add additional apps (optional)

Select Add app access only if you need to add another Mac app.
When you finish App access, configure recommended privacy permissions for Mac apps in Recommend permissions for a Mac app. For iPhone and iPad apps, go to the iPhone and iPad tab. For websites, see Recommend permissions for a website. Select Save. After you save and deploy the Library Item, verify the profile on a target Mac.

​
Verify the profile

Verify the profile after you save the Library Item and deploy it to a Mac. The steps below check the installed profile on that Mac.
1

Open System Information

Open System Information on the target Mac computer.
2

Select Profiles

Select Profiles in the left column.
3

Locate the profile

Locate the profile containing the PPPC payload.
4

Expand profile details

Select the disclosure triangle next to the profile name.
5

Verify the TCC policy

Look for the com.apple.TCC.configuration-profile-policy entry. This confirms the profile is managing TCC permissions on the device.

​
Recommend permissions for a Mac app

Recommended privacy permissions on Mac work the same way as on iPhone and iPad. They recommend a decision, and the user makes the final choice. The first time the user opens the app, the Mac shows one consent prompt listing the permissions you recommend and your justification. The user selects Allow to apply all of them, or Not Now to keep the standard prompts.This is separate from App access. App access writes the privacy decision for a Mac app. Recommended privacy permissions leave the decision with the user.Configure Mac apps under Recommended privacy permissions - Apps. The Mac must be supervised and running macOS 27 or later.On Mac, you identify the app only by its bundle ID and its designated requirement. This is the same pair you collect for App access. The designated requirement is the code requirement.
1

Identify the app

In App Identifier, enter the bundle ID and the designated requirement. The field is labeled Bundle ID + Designated Requirement, and it applies to macOS App Kit apps only. Collect both values in Determine the identifier and code requirement. The field shows the shape of the value, such as com.example.app (anchor apple generic).Select Add app under the identifier to add another bundle ID and designated requirement to this rule.
2

Enter a justification message

Enter a Justification message. Users see this text on the consent prompt when they launch the app. Every app requires one, and a rule without one shows Missing required fields.
3

Set the recommended permissions

Set a value for each permission you want to recommend. Any permission left at Not configured is not sent, and the user is prompted for it as usual.
4

Add additional apps (optional)

Select Add app only if you need another Mac app with its own justification and permissions.
These are the permissions you can recommend for a Mac app:To recommend camera or microphone access for a website opened in Safari, see Recommend permissions for a website.

​
Recommend permissions for a website

Websites can ask for the camera and microphone in the same way apps do, so you can recommend those permissions for the sites your organization relies on. The same website settings apply to Mac, iPhone, and iPad. The justification message and the recommended permissions apply to every website you add. On the first visit in Safari, the device shows a single consent prompt, and the user selects Allow or Not Now. Recommended website permissions require a supervised device running iOS 27 or later, iPadOS 27 or later, or macOS 27 or later. Add Mac, iPhone, or iPad under Install on.
These recommendations apply to Safari only. If a user opens one of these websites in another browser, that browser prompts for camera and microphone access as it normally would, even when it is set as the default browser.
1

Add a website

Under Recommended privacy permissions - Websites, select Add website.
2

Enter the website identifier

Select Domain to match a single domain, such as www.iru.com. Select Wildcard to match a domain and its subdomains, such as *example.com. Enter a domain, not a full URL.
3

Add more websites (optional)

Select Add website to include additional domains. They use the same justification message and recommended permissions.
4

Enter a justification message

Enter a Justification message. Users see this text when they visit any of the websites you added.
5

Set the recommended permissions

Recommend Camera, Microphone, or both. These values apply to every website in the list, on Mac, iPhone, and iPad. Any permission left at Not configured is not sent.

​
Troubleshooting

1

Verify the code requirement

Confirm the code requirement was copied correctly with no leading or trailing spaces. Re-run the codesign -dr - command to verify it matches what is in your profile.
2

Check the identifier type

Verify you selected the correct identifier type, Bundle ID or Path, and that the identifier matches what the codesign command returned.
3

Verify the app is approved

Confirm the app is included in the approved applications list in your profile.
4

Check service permissions

Verify the correct services are configured for the app. For example, if an app needs screen recording access, confirm Screen Recording is selected.
5

Use the TCC log stream

To identify which app or binary is requesting access, run this command in Terminal:
This shows TCC permission requests in real time and helps identify the exact app or binary to add to your profile.
1

Test app functionality

In System Settings > Privacy & Security, sliders for certain permissions can appear grayed out even when the app has the permissions it needs. This is a display behavior, not a problem. Test the app to confirm it works.
2

Verify the profile is active

Confirm the profile is installed and active on the device by checking System Information > Profiles.
1

Verify the code requirement format

Confirm the code requirement has no leading or trailing spaces. A single space can prevent the profile from working.
2

Re-verify after an app update

If an app was updated, its code requirement may have changed. Re-run the codesign command and update your profile.
3

Check static validation

If you are using Statically validate the code requirement, confirm it is enabled only when the process invalidates its dynamic code signature. Most apps do not need it.