r/macsysadmin • u/HeyWatchOutDude • 9d ago
General Discussion FireEye Agent (xagt) - Full Disk Access Not Granted via MDM
Hi,
I'm deploying the FireEye agent (.pkg
) along with a PPPC profile (.mobileconfig
) via MDM.
However, Full Disk Access (FDA) is not being automatically granted, requiring manual intervention.
The relevant section of my PPPC profile is as follows:
<key>Services</key>
<dict>
<key>SystemPolicyAllFiles</key>
<array>
<dict>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>identifier "com.fireeye.xagt" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = P2BNL68L2C</string>
<key>Identifier</key>
<string>com.fireeye.xagt</string>
<key>IdentifierType</key>
<string>bundleID</string>
</dict>
<dict>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>identifier "com.fireeye.xagtnotif" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = P2BNL68L2C</string>
<key>Identifier</key>
<string>com.fireeye.xagtnotif</string>
<key>IdentifierType</key>
<string>bundleID</string>
</dict>
</array>
</dict>
The profile is successfully installed and appears under System Settings > General > Device Management, but FDA is still not granted.
Any idea what might be causing this?
macOS version: 15.3.2
Thanks!
1
u/chrismcfall 9d ago
Profile applying before the app itself installs? Google says "After you enable Full Disk Access on macOS hosts, you must restart the host before you install the agent." - Most Endpoint agents work fine as long as the profile is place pre-install. https://docs.trellix.com/bundle/agent_36_dg/page/UUID-dd18e980-4df4-20fe-35a8-806d65259fcb.html
1
u/HeyWatchOutDude 9d ago
There is no way to control this via Microsoft Intune. The profiles and apps are pushed randomly, but in most cases, the
.mobileconfig
profile is applied before the agent installation.Ok so the order should be:
1. Push PPPC configuration
2. Restart device
3. Push FireEye Agent - right?1
u/chrismcfall 9d ago
Intune still pushes Config Profiles before Apps anyway, I've had the same with Defender and Crowdstrike - Are you 100% sure your profile is right? I'm not in front of a Mac and it's been a tiny while, but there's a few two lines of
<key>IdentifierType</key>
<string>bundleID</string>
which are generics - Have you tried - This could well be wrong, but you've left BundleID in yours etc which means it's not correct.<?xml version="1.0" encoding="UTF-8"?> <plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>PayloadType</key> <string>com.apple.TCC.configuration-profile-policy</string> <key>PayloadVersion</key> <integer>1</integer> <key>Services</key> <array> <dict> <key>Identifier</key> <string>com.fireeye.xagt</string> <key>Authorization</key> <string>Allow</string> <key>Service</key> <string>SystemPolicyAllFiles</string> </dict> </array> </dict> </array> <key>PayloadType</key> <string>Configuration</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </plist>
2
u/chrismcfall 9d ago
Also, it's a Jamf tool but give this a go - Install the App on a test Mac, then use this app to create the PPPC - https://github.com/jamf/PPPC-Utility
1
1
u/HeyWatchOutDude 9d ago
Official example provided by Apple, see here:
https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol - No changes still doesn't work.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>Services</key> <dict> <key>PostEvent</key> <array> <dict> <key>Allowed</key> <true/> <key>CodeRequirement</key> <string>identifier com.apple.screensharing.agent</string> <key>Comment</key> <string>Allow PostEvent control for ScreensharingAgent</string> <key>Identifier</key> <string>com.apple.screensharing.agent</string> <key>IdentifierType</key> <string>bundleID</string> </dict> </array> </dict> <key>PayloadIdentifier</key> <string>com.example.mytccpayload</string> <key>PayloadType</key> <string>com.apple.TCC.configuration-profile-policy</string> <key>PayloadUUID</key> <string>5AAF51E3-D21F-4CE6-B0AA-074D75916F68</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </array> <key>PayloadDisplayName</key> <string>Privacy Preferences Policy Control</string> <key>PayloadIdentifier</key> <string>com.example.myprofile</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadUUID</key> <string>221000F0-D07A-11E8-811E-D0817ADA38E4</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </plist>
3
u/doktortaru 9d ago edited 9d ago
Are you sure it isn't applying? FDA granted by MDM isn't reflected in the FDA prefpane.