Apple released macOS 27 (Golden Gate) on September 14, 2026. Golden Gate changes how MDM tools grant app permissions, which affects silent deployments of the ActivTrak Agent on Mac. This article explains what we know today, what we recommend, and when to expect full deployment guidance.
Important: The ActivTrak Agent works on macOS 26 (Tahoe) and earlier. ActivTrak does not require an upgrade to macOS 27. We recommend delaying the upgrade until we complete testing and publish guidance. We will update this article as testing progresses. For more information, see macOS 27 Golden Gate’s Impact on ActivTrak Deployments.
macOS only
This method deploys the macOS agent. For Windows or ChromeOS, see our installation and deployment guide.
Important: If you manage Macs with an MDM, we recommend delaying the upgrade to macOS 27 (Golden Gate) until we complete testing. If you can’t delay, test on a small group of devices first. See our macOS 27 Golden Gate’s Impact on ActivTrak Deployments for current guidance.
Contents
- What we know
- Impact by deployment type
- What we recommend
- What end users will see
- Transparent deployment
- Check Agent health
- When to expect full guidance
- Best practices
What we know
Apple has replaced the Privacy Preferences Policy Control (PPPC) method that MDM tools such as Jamf, Mosyle, and Intune used to pre-approve app permissions. The replacement is Declarative Device Management (DDM), which Apple has enabled for only some permissions so far.
| Permission | Status on macOS 27 |
|---|---|
| Accessibility (title bar and browser URL capture) | Can be granted silently through DDM. |
| Screen Recording (screenshot features) | Cannot be pre-approved through MDM. Users see a permission prompt. |
| Background notifications | Cannot be suppressed through MDM. Users see a one-time macOS notification. |
Key points:
- This is an Apple platform change, not an ActivTrak change. The same behavior affects every MDM-managed app on macOS 27, and applies regardless of MDM vendor.
- The ActivTrak Agent itself works on macOS 27.
- Permissions previously granted through PPPC profiles do not carry over after an upgrade to macOS 27.
- Fully silent Mac deployments through MDM are not possible on macOS 27.
Impact by deployment type
| Deployment scenario | What to expect | What we recommend |
|---|---|---|
| Silent MDM deployment using PPPC profiles, upgrading to macOS 27 | Accessibility permission no longer applies after the upgrade, so user-level activity capture stops on upgraded Macs. System-level events continue. Users also see multiple macOS notifications and, if screenshot features are enabled, a Screen Recording prompt. | Delay the upgrade until our guidance is available. If you can't delay, test the upgrade on your own first. |
| MDM deployment with Accessibility granted through DDM | Activity capture continues. Users see multiple macOS notifications and, if screenshot features are enabled, a one-time Screen Recording prompt. | Prepare end users for the notification and prompt. Test before upgrading broadly. |
| Manual or self-serve installation | Not currently impacted. Permissions are granted by the user during installation. | No action needed. We are still validating upgrades from earlier macOS versions. |
| Macs on macOS 26 (Tahoe) or earlier | Not impacted until upgraded. | N/A |
What we recommend
- Delay upgrading to macOS 27 on Macs running the ActivTrak Agent until we complete full testing and publish guidance. Most MDM platforms let you defer major OS upgrades for up to 90 days from release, which is through roughly mid-December.
- If you can't delay the upgrade, test it yourself first. Validate the upgrade on a small group of devices and confirm the Agent continues to report data before rolling out more broadly.
- Plan for a transparent deployment. Apple no longer supports a completely silent deployment.
- Prepare your IT team and end users for the notification and permission prompts described below.
What end users will see
- A macOS notification that an MDM-managed app, shown as the ActivTrak process (scthostp), was granted device access. It dismisses automatically and requires no action. macOS uses the same generic wording for every MDM-managed app, regardless of vendor or the permissions involved.
- A Screen Recording prompt, only if screenshot features such as Screen Details are enabled. Users must respond to this prompt themselves.
Transparent deployment
Use transparent deployment whenever possible to communicate the installation to end users. Users acknowledge permissions during installation, and no additional action is required. These resources can help you plan the change:
- Semi-transparent Change Management & Communications Guide
- Transparent Change Management & Communications Guide
- Employee Handbook Recommended Language
- Introducing ActivTrak to your organization
Check Agent health
If a Mac upgrades to macOS 27 without the required permissions, the Agent can stop capturing user-level activity without an obvious error on the device. Check Agent Health Status in the ActivTrak Admin Panel to identify affected devices. Affected devices show an accessibility-related error.
To restore capture on an affected device, grant the Accessibility permission to the Agent on the local device. Reinstalling the Agent alone does not fix the issue.
When to expect full guidance
We are running a full test pass against the released version of macOS 27. We expect to provide guidance and step-by-step deployment procedures, including DDM setup steps for Jamf and Microsoft Intune, by mid-November 2026.
We will update this article as testing progresses and as Apple releases changes.
Best practices
- Delay the macOS 27 upgrade until ActivTrak guidance is available
- If you can't delay, test the upgrade in a small group first
- Prepare user communication for transparent deployment
- Monitor Agent Health Status after any macOS upgrade
Need help?
For additional assistance or questions about your deployment or early preview of Jamf guides to implement these changes, contact ActivTrak Support at support@activtrak.com or reach out to your Customer Success Manager.