macOS - Privacy Preference Policy Controls - MDM Settings Catalog

[Statler]

Hello Experts

I'm trying to roll out some Privacy Preferences Policy Controls for our macOS devices.

We have a requirement to make our main Mac users 'Standard' users once they have enrolled their Macs. After this, they cannot approve the Privacy Controls within their own user profiles. 

Microsoft Endpoint Manager has introduced Settings Catalog within the Configuration Profiles for macOS. We should be able to set the Privacy Controls to automatically approve the setting for users for our most used applications, such as Microsoft Teams, where they require Accessibility and Screen Capture enabled in order to share and give remote control of their screen.

We have created a policy based on the recommendations from Apple for creating the XML/.mobileconfig files, translated these settings into what Microsoft Settings Catalog requires and published the policy to a test group. This all seems to have worked well and the policy is created.

The policy deployment fails on each item within the policy with a type 2 error : error code : 10022

The Mac logs give no suggestion that the policy install has even been attempted.

Endpoint Management portal gives no further information.

I'm hoping one of the Microsoft experts will come across this and be able to shed some light on how we can troubleshoot this further.

Thanks in advance

Steve

[#2]

Hi @Statler ,

Could you try to use configure the privacy policies using and also please share the error screenshot

https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-macos#privacy-prefere...

Best Regards,

Somesh

If you find this helpful and it answers your question, please mark it as an “Accepted Solution”.

[#3]

@somesh_pathak 

Hi Somesh
I used that link to create the policy in conjunction with this
https://support.apple.com/en-gb/guide/deployment/dep38df53c2a/web
and this
https://support.apple.com/en-gb/guide/deployment/dep9ddb7e0b5/1/web/1.0

This is the screen grab of the errors

and the errors themselves

 

There is really nothing to go on and in this instance neither Google or Bing are my friend.... :(

Thanks

Steve

[#4]

Just a bump to see if @Intune_Support_Team notices this. Thx

[#5]

Thanks for the tag! If you continue facing an issue where current macOS policies are not working as expected, please open a support request via the Microsoft Endpoint Manager admin center's "Help and support" blade or any of the other methods here: aka.ms/IntuneSupport, as this will help provide our team with the necessary information to resolve the issue. Please send us a direct message with your support case number for further follow-up. Thanks!

[#6]

And thanks for the reply!
I have opened a support case and direct messaged the reference number to you along with some additional information.
Thanks!

[#7]

Following this topic,
Experiencing the same issue but with the
"SystemPolicyAllFiles" section for "com.microsoft.wdav" and "com.microsoft.wdav.epsext" Identifiers

[#8]

I'm working through a process with Microsoft Support, we've done some checks and tried some things but with no result. They've pushed it up the line to next level support.
If I get anywhere I'll update here.

[#9]

@Statler 

Have You manged to sort the problem out ? i have been trying to add some permissions for MS Teams and i'm getting the same error :( 

Regards

Zaidan

[#10]

@Zaidan258 

Working with the Microsoft InTune Engineers, I’ve been gradually stepping back through the technological advances and went right back to basics.

I created a .mobileconfig file using JAMF’s free PPPC Utility app and was able to apply that as a Custom Template, which seems to have worked for Microsoft Teams.

This is the result of my findings then from the newest Technology, working backward:

1. Configuration Profiles > macOS > Settings Catalog > Privacy Preferences policy Control >>> This is delivered (according to the Microsoft Team) but not applied. Microsoft Engineers are investigating with a view to fixing it.
2. Configuration Profiles > macOS > Template > Device Restrictions >>> This is applied and Accessibility is applied but Screen Recording cannot be applied to an 'Allow' state. A non-Admin user cannot switch Screen Recording on without some Admin credentials which is the exact opposite of what this is intended to do.
3. Configuration Profiles > macOS > Custom Policy > Upload .mobileconfig file >>> This is applied, the settings for Accessibility and Screen Recording are applied as 'Allow'.
1. Screen recording for the apps is shown in System Settings > Security and Privacy > Screen Recording.
2. It can be controlled (on/off) by a non-Admin user

Option 3, while it appears to be the oldest technology and the one that has the most complicated steps, in terms of generating the .mobilconfig file does appear to work as required.

This is it so far.

I'm hoping for an update from the Intune Engineers this week.

HTH

Stephen

[#11]

Thanks a lot for the information.

Could you please maybe provide me the .mobileconfig that you have created so maybe i can try to apply it and test ?

[#12]

@Zaidan258 

Sorry if you know this.

Create a new Profile

Then upload the file

You can make your own .mobileconfig files with the PPPC Utility

GitHub - jamf/PPPC-Utility: Privacy Preferences Policy Control (PPPC) Utility

Rgds

Stephen

[#13]

Thanks a lot. this has worked for me.
I only have one question more, i have read the Config file and it seems like you have a Screen Capture Parameter in the PPPC Toll an i am using the same tool but i can' find this oprion, there is only screen recording and that's it. Does the Toll has some update or something ?

[#14]

It's now called Screen Recording in the Settings on the Mac

Looks like they haven't updated the XML to match

I've taken the file down as I've just noticed our Org name is shown in it. 

I appreciate your discretion.

[#15]

AH ok! Thanks a lot, i was just confused regarding the settings in the PPPC Tool beacuase this option does not exist. I would assume that you have just replaced the parameters in the XML.

Thanks a lot for the support and i will befollwoing this flow up regarding the standrd solution from Microsoft, at some point this has to work :)

[#16]

Glad to be able to help.
If you get anywhere with Microsoft, an update in this would be most useful.

[#17]

The work-around I used to eliminate the error code 10022 for SystemPolicyAllFiles Privacy Preferences Policy Control payload settings was to remove the Authorization key in the settings payload, since it shouldn't have this key when using the Allowed key.

As noted in Apple's MDM reference:

The Authorization key is an optional replacement for the Allowed key. Every payload must specify either Authorization or Allowed, but not both.

https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol/services/...

[#18]

@rrenstrom 
This fixed the issue for me. 

I removed the "Authorized Parameter" and the policy started working.

[#19]

@WyomingBound What is the authorization parameter in the code requirements? In the below image, I did not see any word called 'Authorization' or 'Allowed' in the code requirements. Kindly help me understand.

 

[#20]

@WyomingBound Great post and the only one I can find online.

Im having problems with the screen capture for macOS.  I tried removing the authorization option, it still didnt work, so I removed Allow (which is deprecated anyway) and left only authorization but still shows error 10022.  

How can I have this enable screen capture (guess this covers screen sharing/recording) for teams?  We're in a proof of concept of using macOS for our developers so I need these settings to work if we end up with 20 of them.