The Outpost agent runs on Macs as a preview. It manages a Mac much as it manages a Windows or Linux computer: inventory, scripts, patching, software, policy, and remote desktop, with the tray app in the menu bar. This page covers what works, the permissions macOS asks for, and how the preview package installs.
What works
Section titled “What works”The agent supports macOS 14 and later, on Apple silicon and Intel Macs.
| Area | On macOS |
|---|---|
| Inventory | Hardware, software, patches, certificates, browser extensions, USB devices, drivers, services, users and sessions, security state, and more. Windows-only items, such as optional features and activation, are reported as not applicable. |
| Live metrics and process list | Yes |
| Remote terminal | Yes |
| Scripts | sh, bash, zsh, and Python, as root or as the signed-in user, and at sign-in |
| Remote desktop | Yes, with the Screen Recording permission. Input needs the Accessibility permission. |
| Patching | macOS Software Update |
| Software deployment | Homebrew formulas and casks, and .pkg and .dmg installers |
| Policy | Password policy, firewall, Gatekeeper, screen lock, guest account, Remote Login, automatic updates, and FileVault, with the recovery key escrowed to your Outpost |
| Local administrator password rotation | Yes |
| Restart, shut down, lock screen, sign out, and message a user | Yes |
| Outpost Sync | No |
| Tray app | Yes, in the menu bar |
Homebrew installs need Homebrew on the Mac. A Homebrew package sent to a Mac without it fails with a reason rather than installing anything else.
See Supported platforms for the full comparison with the other platforms.
Privacy permissions
Section titled “Privacy permissions”macOS protects the screen, input, and some folders with privacy permissions
that root does not bypass. Each one is granted to outpost-agent once, by
someone at the Mac, unless your MDM grants it.
| Permission | Needed for | Without it |
|---|---|---|
| Screen Recording | Seeing the screen in a remote desktop session | The session does not open, with Screen Recording permission is not granted to Outpost on this Mac |
| Accessibility | Mouse and keyboard input in a remote desktop session | The session is view only |
| Files and Folders (Desktop, Documents, Downloads, and removable and network volumes) | Browsing and transferring files in those folders during a remote session | The person at the Mac is asked to allow access. Until they do, the transfer stops with a message asking them to select Allow |
| Full Disk Access | Optional. Grants every protected folder at once | Folder access is asked for per folder, as above |
With an MDM, you can pre-approve Accessibility and folder access with a Privacy Preferences Policy Control profile. MDM cannot grant Screen Recording. It can only let a standard user turn it on. Someone at the Mac still has to allow it.
Install the preview package
Section titled “Install the preview package”The macOS options in Enroll a device, macOS Apple silicon and macOS Intel, appear only when macOS installers are turned on for your Outpost.
The download is a .zip holding the package and agent.json:
-
Extract the whole
.zipinto one folder.agent.jsonmust stay beside the.pkg. -
Open the
.pkgfrom that folder, or install it from Terminal:Terminal window sudo installer -pkg outpost-agent-darwin-arm64.pkg -target /
The package installs the agent to /usr/local/outpost and the tray app to
/Applications/Outpost Tray.app, applies agent.json, and starts the agent
as the LaunchDaemon com.outpost.agent.
To check the agent:
sudo launchctl print system/com.outpost.agentThe agent’s log is /var/log/outpost-agent.log.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.