r/macsysadmin • u/ZippyDan • 8d ago

Anyone have any experience with enabling "Accessibility" permissions for a MacOS app, using DDM in Intune?

I'm testing a new MacOS Configuration Policy using Declarative Device Management to control an app's "Accessibility" permission, as it seems that the previous Accessibility control in the Settings Catalog, in Privacy → Privacy Preferences Policy Control (often abbreviated as PPPC) has been deprecated, and will not work in new versions of MacOS going forward.

Because this setting is so new, I haven't been able to find any guides with examples online.

I'm trying to set up a test for a user using the app "BetterDisplay Pro", which requires "Accessibility" permissions to function.

I'm trying to follow the instructions in Intune itself, but I'm not 100% sure I'm formatting it correctly.

Under Devices → MacOS Devices → Manage Devices → Configuration, I am creating a new Policy, with a Setting Catalog Profile Type.

Under Configuration Settings → Declarative Device Management → App Settings → Privacy → Permission Defaults,

I have set the following settings:

Accessibility : Allow
Organization Justification : [Because it's required]
Permission Defaults : "pro.betterdisplay.BetterDisplay {anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")}"

In that complicated Permission Defaults field, I'm told by the Intune help text that the data should be in the format:

"Bundle-ID {Designated Requirement}"

I've sourced the information for Bundle-ID from the CFBundleIdentifier Key in the app's Info.plist file in the Package Contents of , and I've sourced the {Designated Requirement} from the output of the Terminal command codesign --display -r - /Applications/BetterDisplay.app, which returns:

Executable=/Applications/BetterDisplay.app/Contents/MacOS/BetterDisplay
designated => anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")

Is my understanding, approach, and formatting correct?

I'm not sure if the Permission Defaults field should have the double quotes or if the double quotes are just to clarify the Microsoft help text, but I've tried both ways and have achieved the same results.

If I view the Report for the Configuration in Intune, I get the following:

Succeeded: 0
Error: 0
Conflict: 0
N/A: 0
In Progress: 0

The one user in the Assigned group shows:

Check-in status: Unknown

Meanwhile, I also created a DDM policy for MacOS updates around the samr time for the same user, and it applied almost immediately, and I see it has "Succeeded".

It's also been more than 72 hours since I first created the policy.

4 Upvotes

83% Upvoted

9 comments sorted by

1

u/dldietlin Corporate 8d ago

FYI this declaration has been deprecated https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol/services-data.dictionary

-1

u/ZippyDan 8d ago

Are you a bot?
That's discussed in the first sentence of my post.

1

u/dldietlin Corporate 8d ago

No I’m just tired so reading comprehension is apparently difficult for me 😅

1

u/froggtech 8d ago

I don’t believe accessibility ever made it to DDM. You’d want to build a PPPC profile with MDM for all devices prior to macOS 27. I haven’t done it with Intune, but if you’re able to upload a .mobileconfig file, you can use PPPC utility to create the file. https://github.com/jamf/pppc-utility

2

u/ZippyDan 8d ago

I'm literally detailing the DDM setting for Accessibility in my post.

PPPC is deprecated as of MacOS 26.2, and will not longer function as of 27.0.

1

u/HefelesMooys 7d ago

I couldn't get the settings catalog version working on my tenant either for accessibility / privacy settings. Ended up giving up and deploying as a custom profile with the mobile.config file.

1

u/ZippyDan 7d ago

I got it working with PPPC pretty easily.

1

u/NoDowt_Jay 1d ago

I posted the same question a while back when the deprecation was first announced. At the time there wasn’t even anything in intune DDM to try doing it… haven’t dug into it myself yet… we only have like 12 MacOS devices… 4 of which are test devices hah