Temporary Administrator Access on macOS

Deploying SAP Privileges for Temporary Administrator Access on macOS

Overview

SAP Privileges is an open-source macOS application that allows standard users to temporarily elevate their account to administrator status. This provides users with administrative access when needed without requiring their account to remain a permanent administrator.

This recipe uses FileWave to deploy:

SAP Privileges 2.5.3
A managed configuration profile
Notification and Privacy Preferences Policy Control settings
A FileWave Custom Field that reports the most recent privilege change

The supplied package contains Privileges 2.5.3, which SAP currently lists as the latest release. Privileges supports macOS 11 through macOS 26. SAP provides a separate build without launch constraints for macOS 13 because of a macOS 13 launch-constraint issue.

Included Files

The downloaded recipe contains the following items:

File	Purpose
`PKG - Privileges_2.5.3.fileset`	Installs SAP Privileges 2.5.3
`Profile - Privileges Config.fileset.zip`	Configures Privileges, notifications, and privacy permissions
`FileWave Custom Fields.customfields`	Reports the most recent Privileges elevation or revocation event
`Managing Privileges · SAP-macOS-enterprise-privileges Wiki · GitHub.webloc`	Opens SAP’s Privileges management documentation

Default Configuration

The supplied profile applies the following behavior:

Setting	Configured behavior
Elevation duration	Five minutes
Authentication	Password or Touch ID required
Reason required	Yes
Available reasons	Installing an App, Deleting Files, or Other
Revoke at login	Enabled
Menu bar icon	Enabled
Settings access	Hidden from the application, Dock menu, and status menu
Other windows	Hidden while the Privileges prompt is displayed
Notifications	Enabled
Privilege-change action	Configured to run an external script

The ExpirationInterval value determines how long the account remains an administrator. When the interval expires, the account returns to standard-user status. RequireAuthentication requires the user to authenticate, while ReasonRequired records the reason supplied by the user.

Important Security Consideration

Temporary administrator access is still full administrator access. During the elevation window, a user could install software, create another administrator account, alter security settings, or establish persistence that is not automatically reversed when the elevation expires.

Before deploying Privileges broadly:

Test the configuration with a small pilot group.
Use the shortest elevation interval that reasonably supports your users.
Maintain a separate managed or break-glass administrator account.
Review privilege-change activity regularly.
Do not treat the reason entered by the user as proof of what was performed.

Because the profile revokes administrator privileges at login, any permanent support or management account must be added to RevokeAtLoginExcludedUsers. Otherwise, that account may be converted to a standard user the next time it logs in.

Review the Profile Before Deployment

Several settings in the supplied profile should be reviewed before publishing the Filesets.

Remove the Deprecated DockToggleTimeout Key

The profile contains:

<key>DockToggleTimeout</key>
<integer>5</integer>

DockToggleTimeout applies to older Privileges 1.x releases and is deprecated for Privileges 2.x. The active five-minute limit is already configured through:

<key>ExpirationInterval</key>
<integer>5</integer>

Remove DockToggleTimeout from the managed preferences payload.

Remove or Supply the Post-Change Script

The profile is configured to run:

/var/scripts/Privileges/elevate.sh

However, elevate.sh is not included in the supplied package. Privileges silently skips the action when the configured executable does not exist or is not executable.

Unless a separate post-change workflow is planned, remove these keys:

<key>PostChangeActionOnGrantOnly</key>
<false/>

<key>PostChangeExecutablePath</key>
<string>/var/scripts/Privileges/elevate.sh</string>

The FileWave Custom Field does not require this script. It reads privilege-change events directly from the macOS unified log.

Review the Notification Bundle Identifier

The included notification payload targets:

corp.sap.privileges

SAP’s current Privileges 2 approval profile targets the Privileges agent:

corp.sap.privileges.agent

Update the notification payload to corp.sap.privileges.agent so notification settings are applied to the process responsible for user notifications.

Review the Privacy Permissions

The supplied profile grants Full Disk Access and Post Events access to:

corp.sap.privileges

SAP’s current approval example uses Full Disk Access for the Privileges system extension when tamper protection is enabled. Review the supplied permissions and remove any access that is not required for your chosen configuration.

Optional: Enable Tamper Protection

Privileges 2.5 includes a system extension that can prevent users from modifying, renaming, deleting, or disabling Privileges and its supporting services. Tamper protection requires macOS 13 or newer.

The supplied profile does not enable the system extension. To enable tamper protection, add:

<key>EnableSystemExtension</key>
<true/>

The profile must also include the following approvals:

Service Management approval for Team Identifier 7R5ZEU67FQ
System Extension approval for corp.sap.privileges.extension
Endpoint Security Extension approval
Full Disk Access for corp.sap.privileges.extension
A removable system-extension declaration to permit managed removal

SAP provides these settings in its current Example_ApprovePrivileges.mobileconfig profile.

Test system-extension activation and removal carefully before enabling it in production.

Import the Filesets

Extract macOS Privileges (GitHub).zip.
Open FileWave Central.
Navigate to the Filesets view.
Import or drag the following Fileset bundles into the Filesets pane:
- Profile - Privileges Config.fileset
- PKG - Privileges_2.5.3.fileset
Allow each Fileset to upload completely.
Open each imported Fileset and verify that its contents are present.
Do not deploy a Fileset if FileWave Central reports an incomplete upload or upload-validation warning.

Preserve the Profile Dependency

The Privileges package Fileset contains a requirement that checks for the included configuration profile before installing the package.

The requirement searches for this profile identifier:

MacBookPro.lan.0c87b280-9047-4fc9-a7a5-2be4fc8a8039.Configuration.0c87b280-9047-4fc9-a7a5-2be4fc8a8039

Editing the existing profile should preserve this identifier. However, duplicating or recreating the profile may generate a different identifier and prevent the package Fileset from activating.

When replacing the profile:

Open the package Fileset.
Review its Requirements settings.
Update the profile requirement to match the new profile identifier.

Alternatively, remove the requirement and control deployment order through a Fileset Group or Deployment.

Import the Custom Field

In FileWave Central, open:
Assistants → Custom Fields → Edit Custom Fields
Select Import.
Choose FileWave Custom Fields.customfields.
Review the script before completing the import.
Save the Custom Field configuration.
Assign the Custom Field to the required macOS devices or groups.

FileWave supports importing .customfields definition files through the Custom Fields assistant. Imported script-based fields must be assigned to devices before they begin reporting data.

Correct the Custom Field Name

The supplied Custom Field contains the misspelling:

Priviledges - Last Change

For a new deployment, consider correcting it to:

Privileges - Last Change

The supplied internal name is also misspelled:

priviledges_last_change

A suggested corrected internal name is:

privileges_last_change

If reports, Smart Groups, scripts, or API workflows already reference the original internal name, retain it to avoid breaking those references.

Custom Field Behavior

The Custom Field searches the previous 30 days of unified logs for events generated by PrivilegesDaemon.

Example results include:

jsmith: privilege=administrator reason="Installing an App"

jsmith: privilege=standard reason=""

jsmith: privileges expired

When no matching event is found during the 30-day window, the field remains blank.

Privileges 2.5.2 and newer write privilege changes to a persistent logging subsystem. SAP recommends querying the following subsystem and category:

/usr/bin/log show \
  --predicate 'subsystem == "corp.sap.privileges.daemon" AND category == "privchange"'

For improved reliability, the Custom Field script may also be updated to use the subsystem and category predicate rather than filtering only by the PrivilegesDaemon process name.

Associate the Filesets

For initial testing:

Create a small macOS pilot group.
Associate Profile - Privileges Config with the pilot group.
Associate PKG - Privileges_2.5.3 with the same group.
Assign the Privileges - Last Change Custom Field to the group.
Select Update Model.

A FileWave association connects a Fileset with a device or group. After the Model is updated, devices receive the new manifest and begin processing the associated Filesets.

The configuration profile should install first. The package Fileset’s requirement prevents package activation until the expected profile is detected.

Verify the Deployment

Confirm the Application Is Installed

On the test Mac, run:

/usr/bin/defaults read \
  /Applications/Privileges.app/Contents/Info \
  CFBundleShortVersionString

Expected result:

2.5.3

Confirm the Profile Is Installed

Run:

/usr/bin/profiles list

Locate the profile named:

Privileges Config

Confirm the User Starts as Standard

Run:

/usr/bin/id -Gn "$USER"

The output should not include the admin group before elevation.

Test Elevation

Sign in using a standard user account.
Open Privileges from the Applications folder or menu bar.
Select Request Privileges.
Authenticate with the account password or Touch ID.
Select or enter a reason.
Confirm that the account becomes an administrator.
Wait five minutes.
Confirm that the account returns to standard-user status.

Verify Group Membership

While elevated:

/usr/bin/id -Gn "$USER" | /usr/bin/tr ' ' '\n' | /usr/bin/grep '^admin$'

After expiration, the command should return no result.

Verify Privilege Logs

Run:

/usr/bin/log show \
  --last 1h \
  --style syslog \
  --predicate 'subsystem == "corp.sap.privileges.daemon" AND category == "privchange"'

The output should contain the elevation and revocation events.

Verify FileWave Inventory

After the next client inventory update:

Open the device in FileWave Central.
Locate Privileges - Last Change in the device’s Custom Fields.
Confirm that the latest privilege event appears.
Create an Inventory Query if administrators need centralized audit reporting.

Custom Field values can be included in FileWave Inventory Queries, Smart Groups, and API results.

Troubleshooting

The Package Does Not Install

Confirm that:

The profile Fileset installed successfully.
The expected profile identifier has not changed.
The package requirement is checking for the correct identifier.
The FileWave Client has received the latest Model.
The package Fileset uploaded without a validation warning.

Privileges Opens but Cannot Elevate the User

Confirm that:

The account is a local or supported mobile account.
Privileges and its launch services are installed.
The managed preference domain is corp.sap.privileges.
No conflicting profile applies EnforcePrivileges as user or none.
Authentication settings are compatible with the Mac’s available authentication methods.

The Five-Minute Timer Does Not Work

Confirm that the profile contains:

<key>ExpirationInterval</key>
<integer>5</integer>

Remove the deprecated DockToggleTimeout key to prevent confusion.

Notifications Do Not Appear

Confirm that:

The notification payload targets corp.sap.privileges.agent.
Notifications are enabled.
The profile is installed at the system scope.
Focus modes or other local notification restrictions are not suppressing the notification.

The Custom Field Is Blank

Confirm that:

The Custom Field is assigned to the device.
The Mac has completed an inventory update.
At least one privilege change occurred during the last 30 days.
Persistent logging was enabled by the Privileges installer.
The following command returns an event:

/usr/bin/log show \
  --last 30d \
  --predicate 'subsystem == "corp.sap.privileges.daemon" AND category == "privchange"'

A Support Administrator Was Changed to a Standard User

Add the account’s short name to:

<key>RevokeAtLoginExcludedUsers</key>
<array>
    <string>supportadmin</string>
</array>

Then redeploy the profile and restore the account to the administrator group.

Removal and Rollback

Removing the package association alone may not completely uninstall Privileges. The supplied package Fileset does not contain a FileWave pre-uninstallation or post-uninstallation script.

For a complete rollback:

Disable tamper protection first if the system extension was enabled.
Deploy SAP’s Privileges 2 uninstall script through a separate FileWave Fileset.
Remove the Privileges package association.
Remove the configuration-profile association.
Remove the Custom Field assignment if reporting is no longer required.
Update the Model.
Verify that the application and supporting components have been removed.

SAP identifies the following primary items as part of a complete removal:

/Applications/Privileges.app
/Library/LaunchAgents/corp.sap.privileges.*
/Library/LaunchDaemons/corp.sap.privileges.*
/Library/Application Support/Privileges
/private/etc/paths.d/PrivilegesCLI

User-specific Privileges containers, scripts, group containers, and preferences may also need to be removed.

Recommended Production Configuration

Before production deployment, the recommended configuration is:

Use ExpirationInterval or ExpirationIntervalMax, not DockToggleTimeout.
Require authentication.
Require a reason.
Consider enabling ReasonStrictPresetList when users must choose only approved reasons.
Exclude managed support accounts from login revocation.
Correct the notification bundle identifier.
Remove the missing post-change script reference.
Enable system-extension tamper protection only after testing.
Deploy a separate uninstall Fileset.
Test all changes on a pilot group before wider association.

Summary

This recipe deploys SAP Privileges through FileWave and provides users with controlled, five-minute administrator access. FileWave delivers the application and configuration while the included Custom Field provides administrators with visibility into the most recent privilege-change event.

The supplied content should be reviewed before production use, particularly the deprecated preference key, missing post-change script, notification identifier, profile dependency, support-account exclusions, and rollback process.