Apple released macOS 27 (Golden Gate) on September 14, 2026. It changes how MDM tools like Jamf, Mosyle, and Intune grant app permissions. With its release, Apple retired the older PPPC method that allowed silent, pre-approved permissions. It is replacing it with Declarative Device Management (DDM), which currently covers only some permissions.
| What changed | DDM can grant Device Control and Data Access (formerly Accessibility preferences in MDM) silently. It cannot yet grant Screen Recording or suppress the macOS notification shown when an MDM grants permissions. |
| What didn't change | The ActivTrak Agent works on Golden Gate (though we are still conducting full scenario testing, and no other issues have been reported so far). Nothing in the Agent changed. This is an Apple platform change that affects every MDM-managed app, not an ActivTrak-specific issue. |
| Net effect | Fully silent Mac deployments through MDM are not possible on Golden Gate. Apple has not published a timeline for closing this gap. |
Current status
We are running a full test pass against the newly released macOS 27 (Golden Gate). We expect to provide findings and step-by-step guidance by mid-November, including DDM setup steps for Jamf and Microsoft Intune.
Our recommendation: Delay the upgrade to Golden Gate until we complete full testing. If you cannot delay the upgrade, we recommend testing it yourself before upgrading.
How does this impact you?
| Your setup | Impact today | What to do |
|---|---|---|
| Silent MDM deployment (PPPC profile), upgrading to Golden Gate | Impacted. Previously granted permissions don't carry over. Without action, user-level activity capture stops on upgraded Macs. End users also see multiple macOS notifications and, if screenshots are enabled, a Screen Recording prompt. | Delay the upgrade until our guidance is available. If you can't, test on your own first. |
| MDM deployment already moved to DDM | Partially impacted. Activity capture continues, and end users still see multiple macOS notifications. If screenshots are enabled, end users see a one-time Screen Recording prompt. | Prepare end users for the notification and prompt. Test before upgrading broadly. |
| Manual or self-serve installs (users grant permissions themselves) | Not currently impacted. | No action needed. Validation of upgrades from older macOS versions is ongoing. |
| Macs on macOS 26 (Tahoe) or earlier | Not impacted until upgraded. | Delay the Golden Gate upgrade until we have guidance. |
| Windows devices | Not impacted. Silent deployment remains supported. | None |
What we recommend
- Delay the Golden Gate upgrade on ActivTrak-managed Macs until we complete testing and publish guidance. Most MDMs let you delay upgrading up to 90 days from release (through roughly mid-December).
- If you can't delay, test it yourself first. Validate the upgrade on a small group of devices before rolling it out.
- Consider a transparent deployment. It is the most sustainable path because Apple's direction suggests silent Mac deployment will keep running into restrictions. Our change-management guides and employee handbook language can help.
- Prepare your IT team and end users for the macOS notification and permission prompts so they aren't surprised.
- Monitor Agent Health Status in the Admin Panel. Affected devices show an accessibility-related error.
Frequently asked questions
When will ActivTrak have full guidance?
We are currently testing against the released version of Golden Gate. We expect to share findings and step-by-step guidance by mid-November. This page will be updated as testing progresses.
Should we upgrade to Golden Gate now?
We recommend delaying the upgrade until we have completed full testing. If you can't delay, test the upgrade yourself before rolling it out.
Is this an ActivTrak issue?
No. Apple changed how macOS handles MDM-granted permissions. We confirmed the same notification and prompt behavior with other vendors' MDM-managed tools on the same OS.
What will my end users see?
- A macOS notification that an MDM-managed app, named the ActivTrak process (scthostp), was granted device access. It dismisses automatically and needs no action. The wording is generic and appears for every MDM-managed app, regardless of vendor or permission.
- If screenshots are enabled, a one-time Screen Recording prompt.
Why did silent deployment work before?
Earlier macOS versions let MDM tools pre-approve permissions with PPPC profiles, with no user-facing prompt. Golden Gate replaces PPPC with DDM, which doesn't yet cover every permission ActivTrak needs.
What happens if we upgrade before moving to DDM?
For MDM-deployed devices where the user has not accepted the privacy prompt requests, the Agent loses user-level activity capture. The previous macOS permission grant doesn't carry over. System-level events continue. Capture resumes once permissions are granted through DDM or manually by the end user. You don't need to reinstall the Agent.
A device is already upgraded and stopped reporting. What do we do?
Deploy the Device Control and Data Access permission through DDM or manually accept the permissions on each device. Reinstalling the Agent alone won't fix it.
Will switching MDM tools help?
No. Any MDM (Jamf, Mosyle, Intune, or others) is subject to the same Apple limits.
Will the prompt and notification ever go away?
Possibly, if Apple extends DDM to Screen Recording and Background Notifications. Apple hasn't provided a timeline or communicated its plans. We're tracking it and testing each new build.
Does this affect earlier macOS versions?
No.
Is there step-by-step guidance for implementing this via DDM?
Our Jamf guide is undergoing full testing. Our support team can share it when ready or assist you now.
Who do I contact?
Reach out to your Customer Success team or support@activtrak.com.