Help, there’s a Mac on my network (5): I clicked Don’t Allow

Episode 5 of the series Help, there’s a Mac on my network.

What happened

It didn’t stop with Marieke. A week earlier Karin from reception had been given a MacBook too, “so I can help Marieke when she gets stuck”. A noble plan. The only problem was that Karin was now stuck herself, and she was on the first floor while Ruud was downstairs.

No problem, Ruud thought. He had been doing this for twenty years. Karin could install TeamViewer, read out the code, Ruud would type it in and lean back with his “Have you tried turning it off and on again?” mug.

He got a desktop. A gorgeous photo of a mountain lake. Nothing else. No windows, no Dock, no Karin.

“Karin, can you see your email open?”

“Yes, of course. Can’t you?”

“I can see a lake.”

After some back and forth Ruud did get a picture. Progress. But clicking did nothing. He moved his mouse and Karin’s cursor stayed exactly where it was. It felt like operating a computer through a shop window.

“Did you happen to see any pop ups when you started TeamViewer?”

A short silence on the other end. “There were a few little windows. Something about recording and something about accessibility. I thought, I’m not letting anything record my screen. So I clicked Don’t Allow on all of them.”

Ruud put his mug down. He couldn’t blame her. He had spent three years telling her never to just click Allow.

“In Windows this was just under…” he started, but Sam was already in the doorway. “Mind if I take this one? I’ll pop upstairs.”

What’s really going on

Karin did exactly what she should have done. macOS asks for permission per app before it can do anything sensitive, and she said no. The system behind it is called TCC (Transparency, Consent and Control). Think of the camera and microphone privacy settings in Windows 11, but much broader and much stricter. Even if you are an admin on the Mac, every app needs its own permission for every sensitive capability.

For remote support, three of them matter:

• Screen & System Audio Recording. Without it, an app is not allowed to read the screen. TeamViewer, AnyDesk and Splashtop then show you only the desktop wallpaper, or a black screen. Hence Ruud’s lake.
• Accessibility. This lets an app control the mouse and keyboard. Without it you can watch, but you are clicking into thin air.
• Full Disk Access. Not needed to watch, but it is needed if you want to transfer files through the support tool or reach folders such as Mail and Messages.

A few things that tend to catch Windows admins out:

• Click Don’t Allow once and the app usually won’t ask again. The switch simply stays off in System Settings, and that’s where you have to turn it on yourself.
• After enabling screen recording, the app has to restart. macOS offers this itself with a button like Quit & Reopen. Dismiss that and you keep your black screen until the app is restarted.
• Since macOS Sequoia (15) there is also a periodic reminder: apps that can record the screen have to be confirmed again every so often, with a button like Allow For One Month. During the beta it was weekly, Apple changed it to monthly. Click the wrong button on that reminder and next time you’re back at the lake.

Apple isn’t doing this to annoy you. An app that can see your screen and drive your mouse can do anything you can do. Apple wants the user to know that. Karin saying no at first is really just the system working.

How to fix it

On the Mac itself

1. Open System Settings > Privacy & Security.
2. Go to Screen & System Audio Recording and turn on the switch for TeamViewer (or whatever tool you use). If the app isn’t listed, add it with the plus button.
3. Do the same under Accessibility.
4. Only if you want to transfer files: also under Full Disk Access.
5. Choose Quit & Reopen when macOS asks, or restart the app yourself.

Note: by default macOS asks for an administrator password here. If Karin uses a standard account, she needs you or Sam. Unless you sort it out in advance, which is the better plan.

Sorting it out in advance with Intune

With a PPPC profile (Privacy Preferences Policy Control) in the Intune Settings catalog you can set these permissions per app. There is one Apple rule you need to know:

• Accessibility and Full Disk Access can be set to Allow by MDM. The user never sees a thing.
• Screen recording can never be switched on by MDM. The most you can do is Allow Standard User To Set System Service: the user still has to flip the switch, but no longer needs an admin password to do it.

For the monthly reminder, macOS 15.1 and later recognise a management key, forceBypassScreenCaptureAlert, which suppresses the repeat prompt on managed Macs. The first approval is still required, only the monthly nagging goes away. Test it on a few Macs first, as it was poorly documented for a long time.

Which tool, then?

• Quick Assist is out. It’s a Windows app and there is no Mac version.
• Intune Remote Help does work on the Mac, with its own app (Microsoft Remote Help) that can both view and take control. There’s also a web version, but it can only view. Remote Help is a paid add-on (or part of the Intune Suite) and needs the same two permissions. Microsoft documents the exact PPPC profile you need for it.
• TeamViewer, AnyDesk and Splashtop work fine on the Mac, once the permissions are right. They all publish a guide with the correct bundle IDs for your PPPC profile.
• Built in: under System Settings > General > Sharing you’ll find Screen Sharing and Remote Management. The latter is what Apple Remote Desktop uses. Handy for Mac to Mac on your own network, less handy for a Windows admin working from his sofa.

Upstairs at Karin’s desk it took exactly four minutes. Sam let her flip the switches herself, “so you’ll know next time”, and explained that Don’t Allow is a perfectly good reflex, as long as you know who’s asking. When Ruud reconnected, he saw Karin’s email instead of a lake. He clicked a folder. It worked. Meanwhile Sam had written on a sticky note: “Build PPPC profile for TeamViewer. Before the next Mac.”

Ruud’s lesson

On a Mac, Don’t Allow isn’t a user mistake, it’s security doing exactly what it was built for. If you don’t want to climb the stairs every time, set the permissions in advance with a profile. And the one Apple won’t let you set, screen recording, you simply explain. Karin gets it. To be honest, she got it before I even called.

Further reading: Apple Business, Entra ID and Intune and Mac in a Windows network.

This is episode 5 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.