macOS uses strict, per‑app permissions to protect user privacy. Instead of allowing any application to record the screen, read files, or monitor network activity, macOS requires the user (or an administrator) to explicitly grant access for each function. Because of this, the Teramind Mac Agent can successfully install but still be unable to monitor activity until the correct permissions are granted.

The permissions requested by Teramind are not arbitrary - they directly map to specific monitoring features. Without them, Teramind cannot access the information macOS is protecting. For example, most activities will not be captured without the Accessibility permission, file rules will not work without File Monitoring and Full Disk Access permissions.

This article explains what each macOS permission is, why it’s required, and what it’s used for in Teramind. You can always check which permissions are enabled or disabled from the Computer's Details screen in the Dashboard.

The Accessibility permission lets Teramind monitor macOS user interface. Teramind uses it to detect which applications are active and in focus, track user activity/idle time, capture keystrokes and other activity tied to a specific app.

Without Accessibility, the Agent cannot reliably track application usage, website activity, keystrokes, or user behavior, even if it appears to be running.

Notes:

The Screen Recording permission controls whether an app can capture what is shown on the display. Teramind uses Screen Recording to capture standard screen video and screenshots of the user’s desktop and OCR.

If this permission is not granted, the Standard Video recordings will fail or appear blank.

Note: On Mac Agent 26.1 or higher, if you use Reconstructed Video instead of Standard Video, only Accessibility is required; Screen Recording can remain disabled.

Network Monitoring permissions are provided through the NetApp network extension. This extension allows Teramind to track web traffic, website visits, online communications.

If the NetApp network extension is not approved and enabled, the Agent cannot fully monitor network and web activity.

Note: Mac Agent 26.36 introduces a new MITM root certificate. When you update an existing agent to 26.36, macOS may ask you to trust the new certificate again (System Certificate Trust Settings). Uninstalling the agent does not remove the previous certificate from the System keychain; it can be removed manually from Keychain Access if needed.

File Monitoring is handled by the NetApp endpoint security extension together with Full Disk Access (the “Extension”/“FileMonitor” entry in Privacy & Security).

Teramind uses these to receive low‑level file system events (e.g., access, copy, write, rename, delete, move), monitor file transfers, and support file‑based rule.

If File Monitoring and Full Disk Access are not enabled, the Agent will have little or no visibility into file activity, and related rules will not trigger correctly.

Geolocation Monitoring permission relies on macOS Location Services. When both of these are enabled, Teramind can request the device’s current location and use that location data for geolocation‑based features and reporting.

If Location Services are turned off or access is denied for the Teramind Agent (or System Monitoring, for the Stealth agent), the geolocation command will be denied and no location data will be available in the Dashboard.

In the following sections of this article, you’ll find step‑by‑step instructions to enable each of these permissions for the Stealth Agent on supported macOS versions.

1. Open the Terminal: Open the Terminal application. Then, copy and paste the following command into the Terminal window and press Enter:

(Make sure to type the entire command in one single line)

This will open the Accessibility Access window.

2. Go to System Settings: Click the Open System Settings button. You'll be directed to the Accessibility tab in System Settings.

3. Enable Accessibility: Find "System Monitoring" in the list and click the toggle button next to it to enable accessibility. A Privacy & Security warning message will appear.

4. Confirm and Modify: Enter your Mac's password when prompted and click Modify Settings. You'll then be asked to enable Screen Recording permission.

5. Go to Screen Recording Settings: Click the Open System Settings button again. This time, you'll be taken to the Screen and System Audio Recording tab in System Settings.

6. Enable Screen and Audio Recording: Click the toggle button next to "System Monitoring" to allow screen and audio recording. You'll be prompted to restart the application.

7. Restart the Application: Click Quit & Reopen to apply the screen recording permission.

1. Run the Network Permissions Command: To monitor network activity, we need to enable permission for NetApp, which is used for monitoring network traffic. Open the Terminal and copy-paste this command and press Enter:

(Again, enter the whole command on one line.)

You'll see a security dialog for System Certificate Trust Settings.

2. Update Settings: Enter your password and click Update Settings. You'll then see a dialog saying, “NetApp would like to use a new network extension”.

3. Open Login Items & Extensions: Click Open System Settings. This will open the Login Items & Extensions tab in System Settings, showing a list of Network Extensions.

4. Enable NetApp Extension: Click the toggle button next to the .NetApp extension to enable it. A System Extensions dialog box will pop up.

5. Confirm System Extension: Enter your password and click OK. Another dialog will appear, saying “NetApp Would Like to Add Proxy Configurations”.

6. Allow Proxy Configuration: Click Allow to confirm adding proxy configurations by NetApp.

1. Run the File Monitor Command: To monitor file transfers, use this command in the Terminal:

(One single line.)

You'll see a dialog: “NetApp would like to use a new endpoint security extension”.

2. Go to Endpoint Security Settings: Click Open System Settings. This will open the Login Items & Extensions tab with a list of Endpoint Security Extensions.

3. Enable NetApp Security Extension: Click the toggle next to the .NetApp extension to enable it. A System Extensions dialog box will appear.

4. Confirm Extension: Enter your password and click OK.

5. Close Endpoint Security Extensions: Click the Done button to close the Endpoint Security Extensions settings pop-up.

6. Open Full Disk Access Settings: From the Privacy & Security settings, select Full Disk Access.

7. Enable Extension: Click the toggle next to Extension to enable it. A System Extensions dialog box will appear. A Privacy & Security dialog box will appear.

8. Confirm Unlock: Click the Unlock button to allow full disk access.

1. Run Geolocation Command: To monitor location data, use the following command in the Terminal:

(Enter the whole command on one line.)

You will see a dialog box saying, “System Monitoring would like to use your current location”.

2. Activate Geolocation: Click Allow. Geolocation will be activated.

3. Confirm Activation: You should see the location service is enabled for the “System Monitoring” in System Settings > Privacy & Security > Location Services.

Let's get your Stealth Agent installed and configured! These steps are similar to setting up the Revealed Agent.

1. Open Terminal and Run Command: Open the Terminal app on your Mac and copy and paste the following command, then press Enter:

(Make sure to type or paste the whole thing on one line!)

2. System Preferences: You'll see an Accessibility Access window. Click the Open System Preferences button. This will take you to the Security & Privacy window.

3. Enable Accessibility: In Security & Privacy, go to the Accessibility tab. Find and click on System Monitoring in the list and check the box to enable accessibility permission. You might see a warning message, don't worry, it's normal!

4. Open System Preferences Again: Click Open System Preferences again when prompted.

5. Enable Screen Recording: This time, you'll be asked to give System Monitoring permission for Screen Recording.

6. Restart the Application: Click Quit & Reopen to apply the screen recording permission.

1. Run Command in Terminal: To monitor network activities, we need to give permission to NetApp, which Teramind uses. Copy and paste this command into your Terminal and press Enter:

(Again, make sure it's all on one line!)

2. System Extension Blocked: You might see a System Extension Blocked message.

3. Allow in Security Preferences: Click Open Security Preferences. Then, click the Allow button next to the message about System software from application ".NetApp" was blocked from loading.

4. Confirm Proxy Configuration: Click Allow to confirm adding proxy configurations by NetApp.

1. Run Command in Terminal: To monitor file transfers, run this command in Terminal:

(One line, as always!)

2. Open Security Preferences: You'll see a NetApp permission request. Click Open Security Preferences.

3. Privacy Tab: Go to the Privacy tab.

4. Full Disk Access: Select Full Disk Access from the left panel.

5. Enable FileMonitor: Enable FileMonitor from the list on the right.

1. Run Command in Terminal: For geolocation data, use this command:

2. Allow Location Access: You’ll get a message saying “System Monitoring” would like to use your current location.

3. Click Allow: Simply click the Allow button to activate geolocation.

To ensure the Teramind Mac Agent works smoothly, it needs two essential permissions: Accessibility and Screen Recording. These permissions allow the agent to capture information like website visits, keystrokes, screen snapshots, and recordings.

Let's set these up together. Follow these steps:

1. Open Search: Click the Search icon (magnifying glass) on your Mac's menu bar.

2. Open Terminal: Type "terminal" in the search box. Select Terminal from the results and press Enter to open it. The Terminal is a tool where you can type commands to interact with your Mac.

3. Run the Command: In the Terminal window, carefully type or copy and paste the following command, then press Enter:

This command will trigger the Accessibility Access window to pop up.

4. Open System Preferences: In the Accessibility Access window, click the Open System Preferences button. This will take you to your Mac's Security & Privacy settings.

5. Unlock Settings: In the Security & Privacy window, click the Lock icon at the bottom. You might be asked to enter your Mac's password. This unlocks the settings so you can make changes.

6. Select Accessibility: On the left side panel, click on Accessibility.

7. Grant Accessibility Permission: Find System Monitoring in the list and click the checkbox next to it to grant the accessibility permission. Keep this window open; we'll need it again.

8. Select Screen Recording: Scroll up or down on the left panel and select Screen Recording.

9. Grant Screen Recording Permission: Again, find System Monitoring and click the checkbox next to it to grant the screen recording permission. A pop-up window will appear.

10. Restart the Agent: Click Quit & Reopen when you see the message: "“System Monitoring” will be able to record the contents of your screen until it is quit." This restarts the Teramind Agent, and it should now function correctly with the necessary permissions.

If you are configuring permissions for remote support applications (e.g., during troubleshooting):