AzureFeeds

By: Chris Kunze – Principal Product Manager | Microsoft Intune

Privacy Preferences Policy Control (PPPC) settings on macOS are used to pre-approve privacy permissions for apps so users aren’t repeatedly prompted by macOS for access requests. Common examples include Full Disk Access, Screen Recording, Camera, Microphone, Accessibility, Files and Folders, and Apple Events permissions.

Organizations commonly deploy PPPC profiles to improve the user experience, reduce support calls, and ensure management and security tools have the permissions they require to function correctly. This is especially important for tools such as Microsoft Defender, remote support applications, compliance agents, and inventory tools. PPPC profiles also help standardize privacy settings across managed Macs and support zero-touch onboarding scenarios where users can begin working without manually approving a series of permission prompts.

Intune’s settings catalog provides a straightforward way to deploy PPPC settings, but because macOS uses strict matching criteria, a few configuration details are important to get right. If these settings aren’t configured correctly, apps can either break – or worse, fail quietly. This article walks through the key configuration details that help ensure those settings are applied correctly.

How macOS evaluates PPPC entries

macOS evaluates PPPC entries using a combination of:

• App identifier (Bundle ID or Path)


• Code requirement (from the app’s signature)


• The specific permission being granted or denied.

Apple requires each PPPC payload to use either Authorization or Allowed, but not both. If any of these values don’t align correctly, the policy won’t apply.

Configure PPPC in Intune settings catalog

1. Create a settings catalog profile.
   In the Intune admin center, create a macOS configuration profile using Settings Catalog. Search for: Privacy Preferences Policy Control.
   
   Figure 1 – Settings picker showing Privacy Preferences Policy Control.This is where you’ll configure the PPPC permissions required by your application.
   
   


2. Use the Authorization field
   When configuring, select the Authorization setting instead of the legacy Allowed setting whenever supported, but never both.
   
   


3. Get the correct code requirement
   
   

   On a Mac where the application is installed, open Terminal and run:

   
   codesign -dr – /Applications/YourApp.app
   

   Replace /Applications/YourApp.app with the path to the application you’re configuring.
   
   The output will contain a string similar to:

   
   designated => identifier “com.example.app” and …
   

   Copy everything that appears after “designated =>” exactly as displayed. You’ll use this value when configuring the PPPC entry in Intune.
   
   

   
   

   Note: Some applications return a multi-line code requirement. If that happens, paste the value into Intune as a single continuous string without line breaks. The content for the Identifier field can also be extracted from this command.

   
   Figure 2 – Screenshot of a terminal window showing Chrome/ChromeDriver startup errors, including “DevToolsActivePort file doesn’t exist” and certificate-related error messages.
   

    

   
   


4. Configure the PPPC entry
   
   

   After gathering the required information, configure the application entry.

   
   
   
   

   Field	Value
   Identifier type	Bundle ID or Path
   Identifier	Application Bundle ID
   Code requirement	Full output from the codesign command in Step 3.
   Authorization	Allow

   
   
   
   
   Figure 3 – Screenshot of the Microsoft Intune admin center editing a OneDrive configuration profile. The main pane shows privacy and synchronization settings, while a right-side “Configure instance” panel displays Privacy Preferences Policy Control options, including an enabled setting for “Use System SSL.”
   
   Tip: Use Bundle ID for apps whenever possible. Bundle IDs are more reliable than file paths because they typically remain consistent when an app is updated or moved.
   
   

Why PPPC settings may not apply

If these settings fail, they fail silently. Intune may report the policy as successfully applied, but macOS evaluates PPPC entries when the app requests access to the protected resource. Upon app launch, macOS skips any entry where the code requirement doesn’t match the app’s current binary signature without any indication that the setting is skipped. The three most common causes are:

• Incorrect code requirement
  The code requirement must match the application’s current signing information exactly. Even a small mismatch can prevent the PPPC setting from being applied.


• Mixing Authorization and Allowed
  Apple’s documentation states PPPC entries should use either Authorization or Allowed, not both.


• Wrong identifier type
  If the PPPC entry is configured with the wrong identifier type, macOS won’t match the application correctly.

Try it in your environment

If you’ve been avoiding the settings catalog for PPPC, try this approach. Pull the identifier and code requirement directly from the app using codesign, use Authorization when available, and validate the configuration with a pilot group before broader deployment.

Most PPPC issues come down to matching. Once you understand how macOS evaluates these settings it becomes much more predictable.

If you have any questions, leave a comment below or reach out to us on X @IntuneSuppTeam.

Join our community! Discuss real-world scenarios, get expert guidance, connect with peers, and influence the future of Microsoft Security products. Learn more at aka.ms/JoinIntuneCommunity.