Limited Availability: Manage macOS Permissions with MDM

Horizon Agent for macOS requires several macOS privacy and security permissions to function. Omnissa recommends that administrators deploy these permissions through Mobile Device Management (MDM) to eliminate manual user approval prompts in production environments.

Workspace ONE UEM is the recommended MDM platform for Omnissa Horizon deployments. Jamf Pro and Microsoft Intune can also deploy the required Privacy Preferences Policy Control (PPPC) profiles.

Required Permissions Overview

Grant the following permissions to the Horizon Agent process:

Access Settings

The Access value is not Allow for all permissions. Use the following:

Note: Apple blocks silent allow for Screen Capture and Listen Event. These permissions must be set to Only Allow Standard User to Set System Service so the user is prompted at first use.

Deploy the Required Permissions through Workspace ONE UEM

Procedure

1. Log in to the Workspace ONE UEM Console.

2. Navigate to Resources > Profiles & Baselines > Profiles.

3. Click Add > Add Profile > macOS.

4. Select Device Profile.

5. On the General payload, enter a profile name, for example, Horizon Agent Privacy.

6. Add the Privacy Preferences Policy Control (PPPC) payload.

7. Add an app entry for each permission, using the correct bundle identifier from the table above.

   a. For Identifier, enter the bundle identifier that corresponds to the permission: com.omnissa.horizon.blastworker for Accessibility and Input Monitoring, com.omnissa.horizon.agent for Screen and System Audio Recording, or com.omnissa.horizon.jre for Input Monitoring.

   b. For Identifier Type, select bundleID.

   c. For Code Requirement, enter the code signing requirement for the corresponding Horizon Agent binary. To retrieve this value, run the codesign command against each binary on a reference machine where Horizon Agent is already installed. See Retrieving Code Signing Requirements.

   d. For Service, select the appropriate service: ScreenCapture, Accessibility, or ListenEvent.

   e. For Access, set the value according to the Access Settings table above. Select Allow for Accessibility. Select Only Allow Standard User to Set System Service for Screen Capture and Listen Event.

8. Assign the profile to the device smart group that contains your enrolled macOS machines.

9. Publish the profile.

After the profile is deployed, the user launches a VDI session from Horizon Client. On first launch only, macOS prompts the user to approve each of the following permissions:

• BlastWorker for Input Monitoring
• HorizonJRE for Input Monitoring
• CaptureAgent for Screen and System Audio Recording

The user clicks Allow on each prompt. No further action is required in System Settings. macOS displays these prompts automatically the first time the agent requests each permission.

Retrieving Code Signing Requirements

The codesign command must be run against each individual binary, not the top-level .app:

codesign --display -r - /path/to/BlastWorker
codesign --display -r - /path/to/CaptureAgent
codesign --display -r - /path/to/HorizonJRE

Deploy with Jamf Pro

Jamf Pro deploys PPPC profiles through its Privacy Preferences Policy Control payload. Use the same configuration fields, bundle identifier values, and access settings described above. Refer to Jamf Pro documentation for the specific steps to create and deploy a configuration profile.

Deploy with Microsoft Intune

Microsoft Intune can deploy custom configuration profiles to macOS devices using property list (plist) payloads. Use the com.apple.TCC.configuration-profile-policy payload key to configure privacy preferences. Refer to Microsoft Intune documentation for the specific steps.

Validate the Configuration

After deploying MDM profiles, validate the configuration:

1. Enroll a test macOS machine in your MDM solution.
2. Apply the PPPC profile.
3. Open a Horizon Client session to the macOS desktop.
4. Confirm the following:
   • The remote session displays without a Screen Recording permission prompt.
   • Keyboard and mouse input work without an Accessibility permission prompt.
   • Permissions persist after logout and re-login.
5. Document the expected behavior difference between a UEM-managed machine and an unmanaged machine for your deployment records.