macOS uses strict, per‑app permissions to protect user privacy. Instead of allowing any application to record the screen, read files, or monitor network activity, macOS requires the user (or an administrator) to explicitly grant access for each function. Because of this, the Teramind Mac Agent can successfully install but still be unable to monitor activity until the correct permissions are granted.

The permissions requested by Teramind are not arbitrary - they directly map to specific monitoring features. Without them, Teramind cannot access the information macOS is protecting. For example, most activities will not be captured without the Accessibility permission, file rules will not work without File Monitoring and Full Disk Access permissions.

This article explains what each macOS permission is, why it’s required, and what it’s used for in Teramind. You can always check which permissions are enabled or disabled from the Computer's Details screen in the Dashboard.

The Accessibility permission lets Teramind monitor macOS user interface. Teramind uses it to detect which applications are active and in focus, track user activity/idle time, capture keystrokes and other activity tied to a specific app.

Without Accessibility, the Agent cannot reliably track application usage, website activity, keystrokes, or user behavior, even if it appears to be running.

Notes:

The Screen Recording permission controls whether an app can capture what is shown on the display. Teramind uses Screen Recording to capture standard screen video and screenshots of the user’s desktop and OCR.

If this permission is not granted, the Standard Video recordings will fail or appear blank.

Note: On Mac Agent 26.1 or higher, if you use Reconstructed Video instead of Standard Video, only Accessibility is required; Screen Recording can remain disabled.

Network Monitoring permissions are provided through the NetApp network extension. This extension allows Teramind to track web traffic, website visits, online communications.

If the NetApp network extension is not approved and enabled, the Agent cannot fully monitor network and web activity.

Note: Mac Agent 26.36 introduces a new MITM root certificate. When you update an existing agent to 26.36, macOS may ask you to trust the new certificate again (System Certificate Trust Settings). Uninstalling the agent does not remove the previous certificate from the System keychain; it can be removed manually from Keychain Access if needed.

File Monitoring is handled by the NetApp endpoint security extension together with Full Disk Access (the “Extension”/“FileMonitor” entry in Privacy & Security).

Teramind uses these to receive low‑level file system events (e.g., access, copy, write, rename, delete, move), monitor file transfers, and support file‑based rule.

If File Monitoring and Full Disk Access are not enabled, the Agent will have little or no visibility into file activity, and related rules will not trigger correctly.

Geolocation Monitoring permission relies on macOS Location Services. When both of these are enabled, Teramind can request the device’s current location and use that location data for geolocation‑based features and reporting.

If Location Services are turned off or access is denied for the Teramind Agent (or System Monitoring, for the Stealth agent), the geolocation command will be denied and no location data will be available in the Dashboard.

In the following sections of this article, you’ll find step‑by‑step instructions to enable each of these permissions for the Revealed Agent on supported macOS versions.

1. Launch the Teramind Agent: Open Launchpad and find the Teramind Agent app. Open it. You'll see a window about Accessibility Access.

2. Open System Settings: Click the Open System Settings button. This will take you to the Privacy & Security settings window.

3. Configure Accessibility: Select Accessibility from the list of settings.

4. Allow Accessibility: Click the toggle button next to the Teramind Agent app to allow it access. A Privacy & Security warning message will appear.

5. Confirm and Modify: Enter your Mac's password when prompted and click Modify Settings. You'll then be asked to enable Screen Recording permission.

6. Go to Screen Recording Settings: Click the Open System Settings button. You'll be taken to the Screen and System Audio Recording settings.

7. Enable Screen and Audio Recording: Click the toggle button next to "Teramind Agent" to allow screen and audio recording. You'll be prompted to restart the application.

8. Restart the Application: Click Quit & Reopen to apply the screen recording permission.

1. Run the Network Permissions Command: To monitor network activity, we need to enable permission for NetApp, which is used for monitoring network traffic. Open the Terminal and copy-paste this command and press Enter:

(Enter the whole command on one line.)

You'll then see a dialog saying, “NetApp would like to use a new network extension”.

2. Open Login Items & Extensions: Click Open System Settings. This will open the Login Items & Extensions tab in System Settings, showing a list of Network Extensions.

3. Enable NetApp Extension: Click the toggle button next to the .NetApp extension to enable it. A System Extensions dialog box will pop up.

4. Confirm System Extension: Enter your password and click OK. Another dialog will appear, saying “NetApp Would Like to Add Proxy Configurations”.

5. Allow Proxy Configuration: Click Allow to confirm adding proxy configurations by NetApp.

1. Run the Command: Open Terminal and paste this line, then press Enter:

(Enter the whole command on one line.)

You'll see a dialog: “NetApp would like to use a new endpoint security extension”.

2. Go to Endpoint Security Settings: Click Open System Settings. This will open the Login Items & Extensions tab with a list of Endpoint Security Extensions.

3. Enable NetApp Security Extension: Click the toggle next to the .NetApp extension to enable it. A System Extensions dialog box will appear.

4. Confirm Extension: Enter your password and click OK.

5. Close Network Extensions: Click the Done button to close the Network Extensions settings pop-up.

6. Open Full Disk Access Settings: From the Privacy & Security settings, select Full Disk Access.

7. Enable Extension: Click the toggle next to Extension to enable it. A System Extensions dialog box will appear. A Privacy & Security dialog box will appear.

8. Confirm Unlock: Click the Unlock button to allow full disk access.

1. Run Geolocation Command: To monitor location data, use the following command in the Terminal:

(Enter the whole command on one line.)

You will see a dialog box saying, “Teramind Agent would like to use your current location”.

2. Activate Geolocation: Click Allow. Geolocation will be activated.

3. Confirm Activation: You should see the location service is enabled for “Teramind Agent” in System Settings > Privacy & Security > Location Services.

1. Launch the Teramind Agent: Open Launchpad and find the Teramind Agent app. Open it. You'll see a window about Accessibility Access.

2. Open System Preferences: Click the Open System Preferences button. This will take you to the Security & Privacy settings.

3. Allow Accessibility: Click the Accessibility tab and check the box next to the Teramind Agent app to allow it access.

4. Allow Screen Recording: Click the Screen Recording tab and check the box next to the Teramind Agent app to allow it access.

5. Restart (if prompted): If you're asked to restart the application, go ahead and do so.

1. Run the Command: Open Terminal and paste this exact line, then press Enter:

You might see a "System Extension Blocked" message.

2. Open Security Preferences: Click Open Security Preferences. This will take you back to the Security & Privacy settings.

3. Allow NetApp: Click Allow next to the message about ".NetApp" being blocked. A small window will appear.

4. Confirm: Click Allow again to let NetApp configure the network settings.

1. Run the Command: Open Terminal and paste this line, then press Enter:

You might see another "System Extension Blocked" message.

2. Open Security Preferences: Click Open Security Preferences again.

3. Go to Privacy: Click the Privacy tab.

4. Select Full Disk Access: From the left, choose Full Disk Access.

5. Enable FileMonitor: On the right, find FileMonitor and check the box to enable it.

1. Run the Command: Open Terminal and paste this, then press Enter:

A box will pop up saying "Teramind Agent" would like to use your current location:

2. Click Allow: Click Allow to activate the geolocation feature.

The Revealed Agent will prompt you to add the permissions. You don't have to use the sudo command. However, you will still have to uncheck and recheck the two permission settings from your System Preferences and restart the Agent.

If you are configuring permissions for remote support applications (e.g., during troubleshooting):