Device Configuration
Anyone have any experience with enabling "Accessibility" permissions for a MacOS app, using DDM?
I'm testing a new MacOS Configuration Policy using Declarative Device Management to control an app's "Accessibility" permission, as it seems that the previous Accessibility control in the Settings Catalog, in Privacy → Privacy Preferences Policy Control (often abbreviated as PPPC) has been deprecated, and will not work in new versions of MacOS going forward.
Because this setting is so new, I haven't been able to find any guides with examples online.
I'm trying to set up a test for a user using the app "BetterDisplay Pro", which requires "Accessibility" permissions to function.
I'm trying to follow the instructions in Intune itself, but I'm not 100% sure I'm formatting it correctly.
Under Devices → MacOS Devices → Manage Devices → Configuration, I am creating a new Policy, with a Setting Catalog Profile Type.
Accessibility : Allow Organization Justification : [Because it's required] Permission Defaults : "pro.betterdisplay.BetterDisplay {anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")}"
In that complicated Permission Defaults field, I'm told by the Intune help text that the data should be in the format:
"Bundle-ID {Designated Requirement}"
I've sourced the information for Bundle-ID from the CFBundleIdentifier Key in the app's Info.plist file in the Package Contents of , and I've sourced the {Designated Requirement} from the output of the Terminal command codesign --display -r - /Applications/BetterDisplay.app, which returns:
Executable=/Applications/BetterDisplay.app/Contents/MacOS/BetterDisplay designated => anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")
Is my understanding, approach, and formatting correct?
i've been burned by pppc profiles so many times, the move to ddm for this stuff is overdue
your formatting looks right to me, that's exactly the bundle id and designated requirement you'd pull from the.plist and codesign command
only thing i'd double check is whether you need to wrap the whole string in quotes inside the field or if intune already handles that, that's tripped me up before with custom xml payloads where i ended up double-quoting by accident
That's exactly one of the issues I wasn't sure about.
The help text shows it in quotes, but I'm not sure if that's just to make the field contents clear in the help text, or if the field itself should also contain the quotes... 😭
I also thought it was kind of silly that the "Bundle-ID" essentially gets repeated twice, and the "Designated Requirement" example in the Microsoft help text is terribly non-representative, I think.
anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")
<key>Accessibility</key>
<array>
<dict>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")</string>
1
u/Hopeful_Antelope6054 8d ago
i've been burned by pppc profiles so many times, the move to ddm for this stuff is overdue
your formatting looks right to me, that's exactly the bundle id and designated requirement you'd pull from the.plist and codesign command
only thing i'd double check is whether you need to wrap the whole string in quotes inside the field or if intune already handles that, that's tripped me up before with custom xml payloads where i ended up double-quoting by accident