Temporary Administrator Access on macOS

Deploying

Overview

SAP Privileges lets a standard macOS user request administrator rights for Temporarya Administratorlimited Accessperiod. onThis macOSarticle

Overview

explains

SAPhow to deploy Privileges is2.5.3, anconfigure open-sourceadministrator macOSrights applicationto thatexpire allowsafter standardfive minutes, require users to temporarilyauthenticate elevateand their account to administrator status. This provides users with administrative access when needed without requiring their account to remainprovide a permanent administrator.

This recipe uses FileWave to deploy:

SAP Privileges 2.5.3

A managed configuration profile

Notificationreason, and Privacyoptionally Preferences Policy Control settings

A FileWave Custom Field that reportsreport the most recent change in privilege changestatus through a FileWave Custom Field.

Administrator access cannot be made risk-free. While elevated, a user or process can change security settings, install persistent software, unload management components, or interfere with later revocation. Privileges cannot undo those changes or guarantee that administrator rights will be removed on schedule. Keep a separate recovery or management account, test the workflow on representative devices, and treat the timer as a policy control rather than a security boundary.

Requirements and compatibility

FileWave Central and enrolled macOS devices with the FileWave client. A

Theuser suppliedaccount packagethat containsnormally runs as a standard user.

A protected administrator account or another recovery method that does not depend on Privileges. Privileges 2.5.3, which SAP currently lists as the latest release. Privileges3 supports macOS 11 through macOS 26. Tamper protection requires macOS 13 or later.

On affected macOS 13 devices, macOS may report a false launch constraint violation and terminate the standard build. SAP provides a separatenoLC build without launch constraintspackage for macOSthose 13devices becausebut ofrecommends athe macOSstandard 13package launch-constraintwhenever issue.it works.

Included FilesDownloads

The downloaded recipe contains the following items:

FileItem	Purpose
PKG - Privileges_2.5.3.fileset

Installs SAP Privileges 2.5.3 installer package Official signed and notarized SAP installer. The SHA-256 digest is 5948b4b809d05796ff09d4f064a72f049a3f895af194c146d3937f005d34401d. Profile - Privileges Config.fileset.zip ConfiguresExample Privileges,FileWave notifications,Profile Fileset with the five-minute policy, authentication, reason prompts, menu bar access, and privacynotification permissionsapproval. FileWave Custom Fields.customfields ReportsOptional theclient-script mostCustom recentField named Privileges elevation- orLast revocation eventChange. ManagingSAP Privilegesapproval · SAP-macOS-enterprise-privileges Wiki · GitHub.weblocprofile OpensOfficial SAP’reference profile for notifications, Service Management, the system extension, and the system extension's PrivilegesFull managementDisk documentationAccess grant.

DefaultDeploy ConfigurationPrivileges

1. Download and verify the installer

Download the official 2.5.3 package. Before importing it, confirm the digest and Apple signature:

shasum -a 256 Privileges_2.5.3.pkg
pkgutil --check-signature Privileges_2.5.3.pkg

The suppliedshasum profileoutput appliesshould match the followingdigest behavior:listed above. pkgutil should report a Developer ID Installer signature from SAP SE (7R5ZEU67FQ) and a notarization status trusted by the Apple notary service.

2. Create the PKG Fileset

In FileWave Central, open Filesets. Drag Privileges_2.5.3.pkg into the Filesets view, or choose New Fileset and select the PKG Fileset type. Name the Fileset clearly, such as PKG - Privileges, and put 2.5.3 in the revision name.

See Create and Update PKG and MSI Filesets for the standard package workflow.

3. Import and review the Profile Fileset

Download and extract Profile - Privileges Config.fileset.zip. Drag the extracted Profile - Privileges Config.fileset into FileWave Central. Open the imported Profile Fileset and review every setting before assigning it.

Setting	ConfiguredExample behaviorvalue and effect
Elevation durationExpirationInterval	Five5. minutesAdministrator rights are scheduled to expire after five minutes. Do not also configure ExpirationIntervalMax; a fixed interval takes precedence.
AuthenticationRequireAuthentication	Passwordtrue. Requires the current user to authenticate with a password or Touch ID requiredbefore requesting administrator rights. This verifies user presence; it is not manager approval and does not require separate administrator credentials.
ReasonReasonRequired requiredand ReasonPresetList	YesRequires a stated reason. The example includes Installing an App and Deleting Files; Privileges adds its own Other… entry for free text. A reason records intent but does not restrict what the user can do.
Available reasonsRevokePrivilegesAtLogin	Installingtrue. anRevokes App,administrator Deletingrights Files,at orlogin. OtherBefore deployment, add the short names of all permanent local administrator accounts to RevokeAtLoginExcludedUsers. If login-time revocation does not fit your account design, remove this setting.
RevokeNotification atbundle loginidentifier	Enabledcorp.sap.privileges.agent. The notification payload must target the agent, not the main application bundle.
Menu bar iconEnableSystemExtension	Enabled

Not included Settings access Hidden fromin the application,example. Dock menu, and status menu Other windows Hidden whileConfigure the Privilegesapproval promptpayloads isdescribed displayedbelow before enabling Notificationstamper Enabled Privilege-change action Configured to run an external scriptprotection.

The ExpirationIntervalexample valueintentionally determines how longomits the account remains an administrator. When the interval expires, the account returns to standard-user status. RequireAuthentication requires the user to authenticate, while ReasonRequired records the reason supplied by the user.

Important Security Consideration

Temporary administrator access is still full administrator access. During the elevation window, a user could install software, create another administrator account, alter security settings, or establish persistence that is not automatically reversed when the elevation expires.

Before deploying Privileges broadly:

Test the configuration with a small pilot group.

Use the shortest elevation interval that reasonably supports your users.

Maintain a separate managed or break-glass administrator account.

Review privilege-change activity regularly.

Do not treat the reason entered by the user as proof of what was performed.

Because the profile revokes administrator privileges at login, any permanent support or management account must be added to RevokeAtLoginExcludedUsers. Otherwise, that account may be converted to a standard user the next time it logs in.

Review the Profile Before Deployment

Several settings in the supplied profile should be reviewed before publishing the Filesets.

Remove the Deprecated DockToggleTimeout Key

The profile contains:

<key>DockToggleTimeout</key>
<integer>5</integer>

DockToggleTimeout applies to older Privileges 1.x releases and is deprecated for Privileges 2.x. The active five-minute limit is already configured through:

<key>ExpirationInterval</key>
<integer>5</integer>

Remove DockToggleTimeout fromkey, the managed preferences payload.

Remove or Supply the Post-Change Script

The profile is configured to run:

/var/scripts/Privileges/elevate.sh

However, elevate.sh is not included in the supplied package. Privileges silently skips the action when the configured executable does not exist or is not executable.

Unless a separate post-change workflow is planned, remove these keys:

<key>PostChangeActionOnGrantOnly</key>
<false/>

<key>PostChangeExecutablePath</key>
<string>/var/scripts/Privileges/elevate.sh</string>

The FileWave Custom Field does not require this script. It reads privilege-change events directly from the macOS unified log.

Review the Notification Bundle Identifier

The included notification payload targets:

corp.sap.privileges

SAP’s current Privileges 2 approval profile targets the Privileges agent:

corp.sap.privileges.agent

Update the notification payload to corp.sap.privileges.agent so notification settings are applied to the process responsible for user notifications.

Review the Privacy Permissions

The supplied profile grantsbroad Full Disk Access and Post Events access to:

corp.sap.privileges

SAP’s current approval example uses Full Disk Accessgrants for the Privilegesmain systemapplication, extensionand whena post-change executable. If you add PostChangeExecutablePath, deploy the executable at that exact path and use PostChangeExecutableChecksum to verify it.

4. Assign the Filesets

Associate both the PKG Fileset and Profile Fileset with a small test group. Update the FileWave model. Confirm that both Filesets install successfully on the test devices before widening the assignment.

Optional tamper protection is enabled. Review the supplied permissions and remove any access that is not required for your chosen configuration.

Optional: Enable Tamper Protection

Privileges 2.5 includesintroduced aan Endpoint Security system extension that canhelps prevent usersattempts to remove Privileges or unload its launch services. To use it, build a separate Profile Fileset from modifying,SAP's renaming,2.5.3 deleting, or disabling Privileges and its supporting services. Tamper protection requires macOS 13 or newer.

The suppliedapproval profile. doesIt not enable the system extension. To enable tamper protection, add:

<key>EnableSystemExtension</key>
<true/>

The profile must also include the following approvals:contains:

• Service Management approval for Team Identifier 7R5ZEU67FQ

  .
• Endpoint

  SystemSecurity Extensionsystem extension approval for the same team.

A removable system extension entry for corp.sap.privileges.extension, which allows managed removal later.

Endpoint Security Extension approval

Full Disk Access for corp.sap.privileges.extension

A removable system-extension declaration to permit managed removal

.

SAP provides these settings in its current Example_ApprovePrivileges.mobileconfig profile.

Test system-extension activationDeploy and removalconfirm carefullythose approvals before enablingsetting EnableSystemExtension to true. Do not substitute Full Disk Access for corp.sap.privileges; SAP's profile grants it in production.

Import the Filesets

Extract macOS Privileges (GitHub).zip.

Open FileWave Central.

Navigate to the Filesetsextension view.bundle.

Optional

inventory

Import or drag the following Fileset bundles into the Filesets pane:

Profile - Privileges Config.fileset

PKG - Privileges_2.5.3.fileset

Allow each Fileset to upload completely.

Open each imported Fileset and verify that its contents are present.

Do not deploy a Fileset if FileWave Central reports an incomplete upload or upload-validation warning.

Preserve the Profile Dependencyreporting

The Privilegesattached packageCustom FilesetField containsreports athe requirementmost recent change to administrator or standard-user status that checksremains forin the includedlocal configurationunified profile before installing the package.

The requirement searches for this profile identifier:

MacBookPro.lan.0c87b280-9047-4fc9-a7a5-2be4fc8a8039.Configuration.0c87b280-9047-4fc9-a7a5-2be4fc8a8039

Editing the existing profile should preserve this identifier. However, duplicating or recreating the profile may generate a different identifier and prevent the package Fileset from activating.

When replacing the profile:log.

1. Download

   OpenFileWave theCustom package Fileset.

   Fields.customfields.

2. Review its Requirements settings.

Update the profile requirement to match the new profile identifier.

Alternatively, remove the requirement and control deployment order through a Fileset Group or Deployment.

Import the Custom Field

In FileWave Central, open:
open Assistants →> Custom Fields →> Edit Custom Fields

.

SelectClick Import.

, select the downloaded file, and review the macOS script. Associate

ChoosePrivileges FileWave- CustomLast Fields.customfields.

Change

Review the script before completing the import.

Save the Custom Field configuration.

Assign the Custom Field towith the required macOS devicesdevices.

After the next client verification and inventory update, add the field to the Clients view or groups.an Inventory Query.

FileWave supports importing .customfields definition files through the Custom Fields assistant. Imported script-based fields must be assigned to devices before they begin reporting data.

Correct the Custom Field Name

The supplied Custom Field contains the misspelling:

Priviledges - Last Change

For a new deployment, consider correcting it to:

Privileges - Last Change

The supplied internal name is also misspelled:

priviledges_last_change

A suggested corrected internal name is:

privileges_last_change

If reports, Smart Groups, scripts, or API workflows already reference the original internal name, retain it to avoid breaking those references.

Custom Field Behavior

The Custom Field searches the previous 30 days of unified logs for events generated by PrivilegesDaemon.

Example results include:values:

jsmith: privilege=administrator reason="Installing an App"

jsmith: privilege=standard reason=""

jsmith: privileges expired
expired"

WhenThe noscript matchingsearches eventup isto foundseven duringdays of the 30-daylocal window,unified log using the fielddedicated remains blank.

Privileges 2.5.2 andor newer write privilege changes to a persistent logging subsystem. SAP recommends querying the followinglater subsystem and category:

/usr/bin/log show \ --predicate 'subsystem == "corp.sap.privileges.daemon" AND category == "privchange"' --last 7d

For improved reliability, theThis Custom Field scriptis maya alsoreporting aid, not an audit log. macOS decides when unified log entries are removed, so the field can be updatedblank even when Privileges was used. For durable records, configure Privileges remote logging to use the subsystem and category predicate rather than filtering only by the PrivilegesDaemon process name.

Associate the Filesets

For initial testing:

Create a smallmanaged macOS pilot group.

Associate Profile - Privileges Config with the pilot group.

Associate PKG - Privileges_2.5.3 with the same group.

Assign the Privileges - Last Change Custom Field to the group.

Select Update Model.

A FileWave association connects a Fileset with a devicesyslog or group.webhook After the Model is updated, devices receive the new manifest and begin processing the associated Filesets.

The configuration profile should install first. The package Fileset’s requirement prevents package activation until the expected profile is detected.destination.

Verify the Deploymentdeployment

Confirm the Applicationreceipt Isand Installedinstalled

On the test Mac, run:

version:

/usr/bin/defaultspkgutil read--pkg-info \
  /Applications/Privileges.app/Contents/Info \
  CFBundleShortVersionString
corp.sap.privileges.pkg

Expected result:

Launch

2.5.3

Confirm the Profile Is Installed

Run:

/usr/bin/profiles list

Locate the profile named:

Privileges Config

Confirm the User Starts as Standard

Run:

/usr/bin/id -Gn "$USER"

The output should not include the admin group before elevation.

Test Elevation

Sign in using a standard useruser, account.

authenticate, and

Open Privileges from the Applications folder or menu bar.

Select Request Privileges.

Authenticate with the account password or Touch ID.

Selectselect or enter a reason.

Confirm that the account becomes an administrator.

Wait five minutes.

Confirm thatenters the accountlocal admin group, then returns to standard-user status.

status after the

Verifyconfigured Group Membership

While elevated:

interval:

CONSOLE_USER=$(stat -f '%Su' /usr/bin/dev/console)
id -Gn "$USER" | /usr/bin/tr ' ' '\n' | /usr/bin/grep '^admin$'
CONSOLE_USER"

After

expiration,Confirm the commandlocal shouldevent returnis no result.

Verify Privilege Logs

Run:

present:

/usr/bin/log show \
  --last 1h \
  --style syslog \ --predicate 'subsystem == "corp.sap.privileges.daemon" AND category == "privchange"' --last 30m

The output should contain the elevation and revocation events.

Verify FileWave Inventory

After the next client inventory update:

Open the device in FileWave Central.

If

Locatetamper protection is enabled, confirm the system extension is active:

systemextensionsctl list | grep -F 'corp.sap.privileges.extension'

If you assigned the optional Custom Field, run another FileWave client verification and confirm Privileges - Last Change inis the device’s Custom Fields.

Confirm that the latest privilege event appears.

Create an Inventory Query if administrators need centralized audit reporting.

populated.

Custom Field values can be included in FileWave Inventory Queries, Smart Groups, and API results.

Troubleshooting

The

PackageDoesNotSymptom InstallCheck

Confirm

that:

• The

  Privileges profileimmediately Filesetexits installedon successfully.macOS 13
• Test

  TheSAP's expectedPrivileges_2.5.3_noLC.pkg. profileUse identifierthe hasstandard package on other systems unless you reproduce the launch constraint problem.

Notifications do not changed.appear

The package requirement is checking for the correct identifier.

The FileWave Client has received the latest Model.

The package Fileset uploaded without a validation warning.

Privileges Opens but Cannot Elevate the User

Confirm that:

The account is a local or supported mobile account.

Privileges and its launch services are installed.

The managed preference domain is corp.sap.privileges.

No conflicting profile applies EnforcePrivileges as user or none.

Authentication settings are compatible with the Mac’s available authentication methods.

The Five-Minute Timer Does Not Work

Confirm that the profile contains:

<key>ExpirationInterval</key>
<integer>5</integer>

Remove the deprecated DockToggleTimeout key to prevent confusion.

Notifications Do Not Appear

Confirm that:

The notification payload targets corp.sap.privileges.agent.

and that

Notifications are enabled.

Thethe profile isinstalled installedsuccessfully.

A permanent administrator becomes a standard user at login Add the systemaccount's scope.short name to

Focus modesRevokeAtLoginExcludedUsers, or otherremove localRevokePrivilegesAtLogin notification restrictions are not suppressingfrom the notification.

policy.

The Custom Field Is Blank

Confirm that:

The Custom Field is assignedblank toRun the device.log command above

locally. The Macdevice hasneeds completedPrivileges an2.5.2 inventoryor update.

later

At least one privilege change occurred duringfor the lastdedicated 30subsystem, days.

and macOS may

Persistentalready logginghave was enabled byremoved the event.

The system extension prompts for approval or remains inactive Deploy SAP's Service Management, system extension, removable extension, and Full Disk Access payloads before enabling EnableSystemExtension.

Remove Privileges installer.

TheDo followingnot commandassume returnsthat an event:

/usr/bin/log show \
  --last 30d \
  --predicate 'subsystem == "corp.sap.privileges.daemon" AND category == "privchange"'

A Support Administrator Was Changed to a Standard User

Addbreaking the account’sPKG short name to:

<key>RevokeAtLoginExcludedUsers</key>
<array>
    <string>supportadmin</string>
</array>

Then redeploy the profile and restore the account to the administrator group.

Removal and Rollback

Removing the packageFileset association aloneremoves mayevery notPrivileges completelycomponent. uninstall Privileges. The supplied package Fileset does not contain a FileWave pre-uninstallation or post-uninstallation script.

For a complete rollback:

DisableIf tamper protection is enabled, first ifremove or disable the systemmanaged EnableSystemExtension setting, update the model, and confirm the extension wasis enabled.

disabled before continuing.

DeployThen SAP’deploy SAP's current Privileges 2 uninstall script throughas a separate FileWave Fileset.root.

Related information

SAP Privileges 2.5.3 release

Remove theManaging Privileges package association.

SAP

Removeuninstallation the configuration-profile association.

guidance Importing

Removeand theExporting Custom Field assignment if reporting is no longer required.

Files Custom

Update the Model.

Verify that the application and supporting components have been removed.

SAP identifies the following primary items as part of a complete removal:

/Applications/Privileges.app
/Library/LaunchAgents/corp.sap.privileges.*
/Library/LaunchDaemons/corp.sap.privileges.*
/Library/Application Support/Privileges
/private/etc/paths.d/PrivilegesCLI

User-specific Privileges containers, scripts, group containers, and preferences may also need to be removed.

Recommended Production Configuration

Before production deployment, the recommended configuration is:

Use ExpirationInterval or ExpirationIntervalMax, not DockToggleTimeout.

Require authentication.

Require a reason.

Consider enabling ReasonStrictPresetList when users must choose only approved reasons.

Exclude managed support accounts from login revocation.

Correct the notification bundle identifier.

Remove the missing post-change script reference.

Enable system-extension tamper protection only after testing.

Deploy a separate uninstall Fileset.

Test all changes on a pilot group before wider association.

Fields

Summary

This recipe deploys SAP Privileges through FileWave and provides users with controlled, five-minute administrator access. FileWave delivers the application and configuration while the included Custom Field provides administrators with visibility into the most recent privilege-change event.

The supplied content should be reviewed before production use, particularly the deprecated preference key, missing post-change script, notification identifier, profile dependency, support-account exclusions, and rollback process.