One of the management options Jamf Pro provides with Blueprints for macOS Golden Gate is using DDM declarations to manage Local Network access settings. On earlier versions of macOS, these settings had not been manageable and users needed to click Allow or Don’t Allow when prompted.

On macOS Golden Gate, these settings can be managed for specified apps using the privacy permissions available via the App Settings DDM declaration. The user will still be prompted to allow the requested privacy permissions, but now you can provide more information to the user as to why they should approve the privacy permission change. For more details, please see below the jump.

The App Settings declaration is managed on macOS at the user level, which like with user-level MDM profiles, means that they can be applied only to MDM-managed users. When dealing with local accounts, this means that only the local user account which installs the MDM enrollment profile becomes the MDM-managed user. For our purposes here, this means that the management declarations used for Local Network access settings can only be applied to the MDM-managed user and any other local accounts on the Mac cannot have their Local Network access settings managed.

In this example, I’m choosing to manage the Local Network access settings for Cyberduck, which is a free, open-source file transfer client and cloud storage browser available for macOS.

As of Jamf Pro 11.33.3, there is not a Blueprints template available for creating blueprints which manage Local Network access settings so the blueprint will need to be configured manually. To do this, use the following procedure:

1. Log into Jamf Pro.

2. Select Blueprints

3. Click the Create blueprint button.

4. You should see an unconfigured Blueprint. Click where it says Untitled blueprint and provide a name.

For this example, I’m using Local Network Access Management Settings.

5. Scroll down in the list on the left-hand side of the browser window to locate the App Settings component.

6. Click on the App Settings component and drag the App Settings component to the Components in this blueprint section.

7. Once added to the Components in this blueprint section, click anywhere on the App Settings component to open it for editing.

8. At this point, you will see the App Settings settings. From there, scroll down to the App privacy section and click the Configure button.

9. Click the Add key button.

For the Key name section, you will need to get the following information:

• The bundle identifier for the app in question
• The code signing information for the app in question

Note: The app in question must be code signed. The App Privacy settings use the Designated Requirement code signature information to identify the app.

To get the relevant code signature information, you would run a command similar to the one shown below:

For our example, the Cyberduck app is installed in the Applications directory. In that case, you would run the following command:

That should provide output similar to what’s shown below:

From this, we need the bundle identifier and everything following designated =>. For the Cyberduck app, that should be the following:

Bundle identifier:

Code signature:

For the key information, you would put them together like this:

For Cyberduck, that would look like this:

10. Once the key information has been added, click the Configure option.

11. In the Organization justification section, enter a message which will be displayed to the end user. This message should explain why the organization is asking the user to approve the app permissions.

For this example, I’m using the following explanation:

Please allow local network access for this app to enable it to work correctly.

12. Scroll down to the Local network permission section and select it, then set the value to Allow.

13. Once all the information has been entered and verified to be correct, click the Save changes button.

14. Verify that all information is correct, then click the Save changes button.

15. Verify once more that all information is correct then click the Save changes button.

16. At this point, you should have a blueprint which has all settings configured but where no target scope has been set. To scope this blueprint, go to the Scope section and click the arrow button.

17. Select a Jamf Pro smart or static group. For this example, I’m selecting a static group named Local Network Access Deployment Group. Once selected and verified, click the Save button.

18. Once everything has been configured, click the Deploy button to deploy the changes to the Macs you want to manage.

Once deployed, the Blueprints screen in Jamf Pro should show the newly-created Local Network Access Management Settings blueprint as being deployed.

On your managed devices, you can verify that the new Local Network access management configuration has been deployed by clicking on the enrollment profile, then scrolling to the bottom.

In the case of this example, you should see a User Declarations section with a listing for App Settings.

If you click on the App Settings listing, it should report the following:

For additional information on the configuration, you would need to launch the Cyberduck app. When it opens, you should be prompted to allow access with Local Network referenced for the Cyberduck app.

If the user chooses the Allow button, the Cyberduck app should appear listed as enabled in System Settings: Privacy & Security: Local Network.

Note: The user can choose to disable Local Network access for the app again, or even remove the entry for the app from the Local Network settings in System Settings.

If the entry is removed, the user will be prompted with the non-managed dialog window the next time they launch the app. In order to apply the DDM management settings again, the blueprint would need to be removed and then re-installed for this Mac.