Technical Tip: Why users need to grant permissions for the Reveal Agent on macOS

Several factors can affect the number of Privacy permission requests shown to a macOS user. These include:

• The version of macOS.
• The version of the Reveal Agent.
• Agent configuration settings such as 'User input monitoring' and 'Clipboard monitoring'.
• The use of the screenshot action.

macOS version:

Recent editions of macOS have successively added additional security and privacy permissions. In some instances where a new permission category has been added the Reveal Agent may request access to it after an Operating System upgrade.

Reveal Agent version:

When new features are added to the agent that requires new permissions, the user will be shown a request to enable that permission after the upgrade. 

By default, once permission has been granted, it will remain available to the Reveal Agent unless explicitly disabled again. In some cases, the user may be required to re-grant permissions for a previously granted permission. This should only happen after an upgrade to the Reveal Agent when the application identifier has been updated. Currently, this will happen after an upgrade from versions earlier than v7.6.0.

Agent configuration:

The Input monitoring permission will be requested if 'User Input Monitoring' or 'Clipboard monitoring' is enabled on the Agent Configuration.

Action usage:

After the first operator request or policy violation trigger of a screenshot action, the Screen Recording permission will be requested. This will also be requested if the 'motion screenshot' mode is first enabled, even if a screenshot is not saved at the time.

Remotely grant permissions:

The design of macOS Security and Privacy settings places the end user in full control of which permissions are granted. There is no way for an administrator to remotely grant these permissions, they may only deny the user the option to enable such permissions. 

If the end user denies permission for any of the requested access, the Reveal Agent will continue to function and report all event streams it has access to, but some features will stop working. For example, if Screen Recording is denied, screenshots will not be sent to the Reveal Platform. 

Some functionality, such as approval of Kernel and System Extensions can be enabled via MDM profiles. 

Related article:

https://support.nextdlp.com/en/support/solutions/articles/103000032868