Install Requirements for DLP Mac Agent

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

The DLP agent for Mac OS requires additional access privileges or configuration at the OS and DLP server level for full functionality. 

These steps will vary depending on the Mac OS version and DLP agent version. An overview is provided below.

Cause

Mac OS security updates or architecture changes have driven the need to develop MDM profiles and other security system integrations. 

Resolution

Mac Agent Requirements

 

Full Disk Access MDM:

• The DLP agent requires full disk access for the edpa process. This can be done from an Mac OS server or SMS such as JAMF, or individually on each endpoint. 
• For how-to steps see: Configuring MDM profiles for Full Disk Access for macOS 10.15 and DLP Agent support
• It is also necessary to grant SEHA.app full disk access 

 

Firefox Browser Extension:

• As of Firefox 74, the Firefox extension needs its own MDM configuration to load successfully
• For how-to steps see How to enable mdm profile for firefox plugins on OSX 10.15.x

 

Outlook extension MDM:

• The previous hooking process that DLP uses for Mac Outlook was deprecated. Broadcom has developed an agave extension that requires an MDM profile to load. 
• See Deploying the on-send web add-in for Outlook

References

MDM profiles may need the following details:

 

• Broadcom Team ID: Y2CCP3S9W7
  
  If you are using JAMF you can try the following command from terminal to see what MDM profiles are loaded:
  echo "<result>profiles -C -v | awk -F": " '/attribute: name/{print $NF ","}' | sort</result>