We develop a third-party endpoint security agent (DLP / device control). It needs kTCCServiceBluetoothAlways to enumerate paired Bluetooth devices and disconnect them selectively based on policy — without user interaction, since this runs unattended on managed fleets.
Until recently we granted this silently via a com.apple.TCC.configuration-profile-policy (PPPC) profile pushed by MDM, or by writing directly to the TCC database — the latter no longer possible starting with macOS 27 (Golden Gate). As of macOS 27, tccd also ignores the PPPC profile approach:
Override: skipping kTCCServiceBluetoothAlways ... as it is defined in deprecated PPPC profile
As a result, end users now hit the standard Bluetooth access consent popup, which we have no way to suppress or pre-answer with Allow.
** Questions: **
-
Is there any currently supported MDM mechanism — profile-based, DDM, or otherwise — to pre-approve kTCCServiceBluetoothAlways for a specific managed app, so the popup never appears?
-
If direct pre-approval is gone for good, is there any supported way to auto-answer the popup on the user’s behalf via policy (as exists for some other TCC services)?
-
Is this now permanently interactive by design, or is a replacement mechanism planned for MDM-managed Bluetooth access?