Installing Symantec Endpoint Protection Agent on MacOS without MDM pre-approval in place.

Products

• Endpoint Protection
• Endpoint Security Complete

Issue/Introduction

When installing Symantec Endpoint Protection (SEP) on macOS without MDM pre-approval, users must manually enable several system permissions; otherwise, they will be stuck in the "Setup Incomplete" stage of the SEP macOS Agent installation. These permissions are required for SEP to function properly and vary based on macOS version and SEP release.

You might see the following below:

Environment

Operating System: macOS 15.3 (24D60)

Product Version: Symantec Endpoint Protection 14.3.11240.9000

Cause

When MDM pre-approval is not in place, macOS requires manual configuration of security permissions for SEP to function correctly. These permissions vary by macOS version.

Resolution

To install and configure SEP without MDM, manually grant the following permissions:

Required Permissions:

1. Notifications – Enable SEP notifications in System Settings > Notifications.
   

2. System Extensions (macOS 15.3+) – Navigate to System Settings > Login Items & Extensions, locate SEP, click the "i" icon, and enable it.
   

3. Full Disk Access (macOS 15.3+) – Go to System Settings > Privacy & Security > Full Disk Access and enable SEP.
   

4. Network Content Filtering (macOS 15.3+) – Access System Settings > Network > Filters, then ensure SEP’s network filter is enabled.
   

Additional Information

Apple frequently updates its security models to align with industry standards. For example, macOS 15 introduces small UI changes that require familiarity with System Settings for proper configuration. Understanding these adjustments is essential when working with third-party applications.