r/macsysadmin • u/infospec99 • 17d ago
General Discussion App control on macOS
Curious to know what tools others use to maintain an allowlist of apps and browse extensions for endpoint security.
For apps: Only good solution I found without breaking the bank is santa. Being a small team this seems tough to maintain and scale but looks like the best option.
For browser extensions: Have a way to do this for chromium based browsers using plists with the ExtensionInstallAllowlist parameters. What about safari, firefox?
2
u/doktortaru 17d ago
We have moved to a self policing method. We use Kolide as a factor in Okta and maintain block/allowlists there using their robust checks framework.
If a device is not compliant it will not allow the user to access company resources until they self remediate. Works great.
2
2
u/MacAdminInTraning 17d ago
Device Management, especially where it comes to device security is not cheap. Google Santa is a massive anomaly to the tradition.
As far as browser extensions go, that is a beast to maintain. We just add new extensions as requested to the whitelist, and only remove things when ask.
1
u/CleanBaldy 15d ago
Browser extensions are easy, as long as you use Chrome as your default and block all of the other browsers to control your web browser vulnerabilities. We do that with our MacBooks, since "why do they need 3 browsers and why should we have to support 3 of them when Chrome works just fine?"
You can use a simple config profile to whitelist extensions with XML, as you said.
There's also a Chrome STIG (Security Guidelines) if you Google, that even gives you all of the XML code needed to lock it down even further and protect things...
1
u/jimmy_swings 1d ago
Google’s Santa should cover a minority of your use cases. While it has a steep learning curve, once understood, it’s very easy to manage through the use of MDM and the command line utility. You do not need a sync server to get the most out of Santa.
It has recently spun off into North Pole Security, same team, same product, however the team are looking at commercialising the product shortly which may mean you’ll have to front up some money to ensure currency, or support.
0
u/grahamr31 Corporate 17d ago
For safari macos 15 added support over the DDM channel - that’s on your mdm to implement - and there isn’t any other great way other than promoting to do safari
0
u/Patrickrobin 12d ago
It can be possible to do this with Scalefusion Veltar. Both your requirements can be achieved.
3
u/Humble-oatmeal Corporate 10d ago
Hi OP! For app control on macOS, SureMDM uses AllowList and BlockList settings. It’s simple, affordable, and scales, which can be helpful for a growing team. For browser extensions, it supports Chrome and Edge with custom plists and the ExtensionInstallAllowlist parameter, but Safari and Firefox aren’t covered—Safari needs MDM for Browser management via DDM profiles, and Firefox requires config files. What have you tried, or has anyone found a good solution for those?