Apple released macOS 27 (Golden Gate) on September 14, 2026. Golden Gate changes how MDM tools grant app permissions, which affects silent deployments of the ActivTrak Agent on Mac. This article explains what we know today, what we recommend, and when to expect full deployment guidance.
Important: The ActivTrak Agent works on macOS 26 (Tahoe) and earlier. ActivTrak does not require an upgrade to macOS 27. We recommend delaying the upgrade until customers have completed preparatory steps to deploy macOS 27. For more information, see macOS 27 Golden Gate’s Impact on ActivTrak Deployments.
macOS only
This method deploys the macOS agent. For Windows or ChromeOS, see our installation and deployment guide.
Important: If you manage Macs with an MDM, we recommend delaying the upgrade to macOS 27 (Golden Gate) until we complete testing. If you can’t delay, test on a small group of devices first. See our macOS 27 Golden Gate’s Impact on ActivTrak Deployments for current guidance.
Contents
- What is changing
- Impact by deployment type
- What we recommend
- What end users will see
- Transparent deployment
- Check Agent health
- Best practices
- Need help?
What is changing
Apple has replaced the Privacy Preferences Policy Control (PPPC) method that MDM tools such as Jamf, Mosyle, and Intune used to pre-approve app permissions. The replacement is the Declarative Device Management (DDM) framework.
| Permission | Change |
|---|---|
|
Accessibility (title bar and browser URL capture) |
MDM deployments will need to leverage DDM framework to grant permissions and suppress any prompts. End user notification pop-ups will still occur once per app. |
|
Screen Recording (screenshot features) |
Cannot be pre-approved through MDM. Users see a permission prompt and must accept in order for the feature to work. |
| Background notifications | Cannot currently be suppressed through MDM. Users see a one-time macOS notification per application. |
Key points:
- This is an Apple platform change, not an ActivTrak change. The same behavior affects every MDM-managed app on macOS 27, and applies regardless of MDM vendor.
- The ActivTrak Agent has been tested on macOS 27 and is fully supported.
- Permissions previously granted through PPPC profiles (used in MDM) do not carry over after an upgrade to macOS 27. Customers must utilize Apple’s DDM framework.
- Fully silent Mac deployments through MDM are not currently possible on macOS 27.
Impact by deployment type
| Deployment scenario | What to expect | What we recommend |
|---|---|---|
| Silent MDM deployment using PPPC profiles, upgrading to macOS 27 | Accessibility permission no longer applies after the upgrade, so user-level activity capture stops on upgraded Macs. System-level events continue. Users also see multiple macOS notifications and, if screenshot features are enabled, a Screen Recording prompt. | Prepare end users for the notification(s). |
| MDM deployment with Accessibility granted through DDM | Activity capture continues. Users see multiple macOS notifications and, if screenshot features are enabled, a one-time Screen Recording prompt. | Prepare end users for the notification and prompt. |
| Manual or self-serve installation | Not currently impacted. Permissions are granted by the user during installation. | No action needed. |
| Macs on macOS 26 (Tahoe) or earlier | Not impacted until upgraded. | N/A |
What we recommend
- Prepare for a transparent deployment. Apple does not support MDM silent deployments.
- Prepare your IT team and end users for the notification and permission prompts described below.
What end users will see
- A Screen Recording prompt, only if screenshot features such as Screen Details are enabled. Users must respond to this prompt themselves.
- A macOS notification that an MDM-managed app, shown as the ActivTrak process (scthostp), was granted device access. It dismisses automatically and requires no action. macOS uses the same generic wording for every MDM-managed app, regardless of vendor or the permissions involved.
Transparent deployment
If you are deploying the Agent via MDM, make sure to inform end users in advance.
- Semi-transparent Change Management & Communications Guide
- Transparent Change Management & Communications Guide
- Employee Handbook Recommended Language
- Introducing ActivTrak to your organization
Check Agent health
If a Mac upgrades to macOS 27 without the required permissions, the Agent can stop capturing user-level activity without an obvious error on the device. Check Agent Health Status in the ActivTrak Admin Panel to identify affected devices. Affected devices show an accessibility-related error.
To restore capture on an affected device, grant the Accessibility permission to the Agent on the local device. Reinstalling the Agent alone does not fix the issue.
Best practices
- Prepare user communication for transparent deployment
- Monitor Agent Health Status after any macOS upgrade
Need help?
For additional assistance or questions about your deployment, contact ActivTrak Support at support@activtrak.com or reach out to your Customer Success team.