FortiClient Full Disk Access Via MDM system

[milanminchevext]

Hello Forum,

MacOS version 15 Sequoia
FCT version 7.2.6 GA
In our organization we are deploying a MDM profile for FortiClient. I am wondering if the Full Disk Access is properly granted for the application. I cannot see the fctservctl2 and FortiClient in the GUI Full Disk Access System Settings. Also from the command 

" /usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' | awk -F'|' ' { print $2 } ' | grep -Ev "com.apple|System" | sed 's/\/Library\/Application Support\///g' " I still cannot retrieve the information that the application has full disk access. In conclusion I am not sure if the Full Disk access is properly granted. If I check the "Device Management" settings and click on the "Configuration Profile for FortiClient" there I can see

""" Access All Application Data """ : "com[.]fortinet.forticlient.macos.antivirus- Allowed" "com[.]fortinet.FortiClient - Allowed" "/Library/Application Support/Fortinet/FortiClient/bin/fctservctl2 - Allowed". 

Can you share your thoughts about this ? Is it the same behaviour for you guys too or ?

BR

[Cajuntank]

Ok, so my answer will be somewhat tied to the MDM we use (Jamf) in regards to how we deploy this. Jamf has a utility called PPPC (Privacy Preferences Policy Control) that I use for this. I am thinking this is somewhat agnostic as all MDMs have to adhere to the Apple Framework for the OS, so without a whole explanation into how this works on that side of things, this allows me to push this resulting profile out from my MDM (with the profile created from the PPPC utility). The allowance will NOT show up in the GUI, even though the profile delivery shows completed from the MDM. The command I use to check what bundleIDs that have full disk access from the client itself is

system_profiler SPConfigurationProfileDataType | grep -A 3 -B 1 "SystemPolicyAllFiles" | grep -o 'identifier \\"[^\\"]*' | sed 's/identifier \\"//g'

So a typical output for me might be something like:

com.jamfsoftware.Composer

com.jamfsoftware.jamf

com.lanschool.lsutil

com.bomgar.bomgar-scc

This helps me confirm that the ID set in the profile for the app does have full disk access. The command is macOS inherent and not part of Jamf. Hope that helps.

[milanminchevext]

Hello and thanks for the explanation. 

When I execute the command I only get this output 

com.fortinet.forticlient.macos.antivirus
Shouldn't I have as entries also these two ?
com.fortinet.forticlient
Library/Application Support/Fortinet/FortiClient/bin/fctservctl2
which are missing from the output of the command.

BR

[Cajuntank]

I'd have to test this out, but it might only show those bundle identifiers delivered via MDM, so the ones manually enabled might not show up as output via that command. I cannot 100% recall for sure as I've slept since then. 

[pathofbuilding]

you're trying to confirm whether Full Disk Access has been properly granted to FortiClient through your MDM deployment. Based on the command you used, it's normal not to see the application listed directly under Full Disk Access in the GUI, especially when using MDM profiles. However, the fact that you see entries like "com.fortinet.FortiClient - Allowed" and "/Library/Application Support/Fortinet/FortiClient/bin/fctservctl2 - Allowed" in the Device Management settings indicates that the necessary permissions have been granted through the MDM configuration.

This behavior is generally expected with MDM deployment, where Full Disk Access isn't always shown in the GUI, but the required permissions are granted via the configuration profile. You can verify this by checking FortiClient functionality — if it's working as expected, the access should be properly granted.

[milanminchevext]

Hello and thanks for the response.
Here is the thing that the FortiClient is not always working as expected :D So I want to verify all the things are correctly installed and configured.
BR