In many organizations Macs are the blind spot of endpoint security. Mac users are used to working as admins and install apps by dragging them to the Applications folder, and developers work with Terminal, Homebrew and sudo every day.
The technical side is harder too. macOS protects itself with layers such as SIP, TCC and System Extensions, changes to system settings require admin authentication, and Apple changes things with every release. Many EPM solutions were built for Windows first and adapted to Mac later, and it shows.
So many organizations leave Mac users with standing admin rights, even after removing them on Windows.
Admin By Request for Mac
In Admin By Request, Mac isn't an add-on to Windows but a product that develops on its own track, with dedicated releases and support for new macOS versions. Version 6.0 supports macOS 15, 26 and 27.
The agent is under 3MB and runs in the background without slowing the Mac down. It's managed from the same portal as your Windows and Linux endpoints, with the same policy and the same audit log. You can deploy it through Jamf, Intune or any other MDM.
In our experience at OnCloud, the product works very well for customers with many Macs, including large development environments, where the requirements are the most complex.
What it does on macOS
Installing and updating apps
- Run As Admin: install a pkg file with a double-click, or an app by dragging it to Applications, exactly the way Mac users are used to.
- Updates without an Admin Session: a pre-approved app can update itself when it asks to, including updates for Slack, Cloudflare WARP and apps that update through Squirrel and ShipIt.
- Removing apps: a standard user can remove apps from the Applications folder with Admin By Request's approval.
Approving and blocking
- Pre-approval by vendor (Team ID), by app (Bundle ID) or by checksum. When a rule combines Team ID and Bundle ID, both must match.
- Version range: a minimum and maximum version for each rule, so you don't approve old versions with vulnerabilities or new versions you haven't tested.
- Blocking apps by Team ID, Bundle ID or checksum, including blocking the App Store for standard users.
- Machine-learning auto-approval for apps that have already been approved enough times.
System settings
- System Settings: you can pre-approve changes per pane, such as printers, date and time, Time Machine, energy settings, software updates and System Extensions. Panes that aren't approved behave the way macOS intends: the user sees them but can't change them.
Security
- Every file scanned with OPSWAT MetaDefender.
- Owner: block elevation for anyone who isn't the Mac's primary user.
- Intune compliance: block elevation on a Mac that doesn't meet the compliance policy.
- MFA before elevation, including Platform SSO identity.
- Account Separation: elevation through an account separate from the user's everyday account, as Cyber Essentials Plus requires.
- During an Admin Session the user can't remove Admin By Request or add, remove or change user accounts.
Support and emergencies
- Support Assist: a technician gets temporary rights on the Mac, without standing admin rights.
- Break Glass: a temporary local admin account, in the spirit of Microsoft's LAPS.
- Secure Remote Access: remote support and unattended access, including passwordless access with a temporary account created for the session.
Management
- Settings by group from Entra, Okta or Jamf, including Smart Groups.
- Removing local admin accounts directly from the portal.
- A full audit log of every event, including sudo commands.
What's new in version 6.0
Version 6.0 came out on October 26, 2026, and it's a major release (release notes):
- Managed sudo: a standard user can run specific pre-approved sudo commands without an Admin Session. You can also block specific sudo commands even inside an Admin Session. Every command, approved or blocked, is logged. For local admins, sudo keeps working as usual.
- Remote Kill: a portal admin can remotely end an Admin Session or an elevated run, and temporarily block new requests on the Mac.
- Extending an Admin Session: users can extend an active session from the timer, if the organization allows it.
- Per-setting System Settings pre-approval: every pane in System Settings gets its own approved / not approved toggle.
- A new interface: a more modern, native design, and one window that shows every active session.
- Remote support inside an Admin Session: users can ask for remote support even while a session is active.
- Platform SSO for MFA: identifying the user by their Platform SSO identity.
- Support for macOS 27.
The release also improves installing Electron apps from dmg files and fixes issues with apps such as Postman.
Developers on Mac
Development environments are the real test of EPM on Mac. Developers work in Terminal all day, install tools through Homebrew, run Docker and change network settings.
Until version 6.0, every sudo command needed a full Admin Session. Now, with Managed sudo, you can pre-approve the commands developers actually need, and they run without opening a session. You can also block dangerous commands, such as editing sudoers files or turning off system protections, even inside an Admin Session.
Combined with pre-approving development tools by Team ID, separate settings for the developer group and Admin Session for complex tasks, you can remove standing admin rights from developers too, without stopping their work.
Summary
Mac is a harder environment for EPM, but that's no longer a reason to leave users with standing admin rights. Admin By Request offers a small agent, management from the same portal as Windows and Linux, and capabilities built specifically for macOS. Version 6.0, with Managed sudo, closes the last gap in development environments.
At OnCloud we implement Admin By Request in large Mac environments and development environments too. Want to try it in yours? You can start with a free pilot on up to 25 Macs.
Book a technical demo