---
title: "macOS agent"
description: "What the Outpost agent does on a Mac, the macOS privacy permissions it needs, and how to install the unsigned preview package."
url: "https://support.outpostplatform.com/agent/macos/"
product: "agent"
type: "concept"
status: "draft"
ai_summary: "macOS agent preview, macOS 14 and later, Apple silicon and Intel. Inventory, metrics, terminal, scripts, remote desktop, softwareupdate patching, Homebrew and pkg or dmg installs, policy with FileVault, admin password rotation, menu bar tray. No Outpost Sync. Remote desktop needs Screen Recording and Accessibility. Package is unsigned and offered only when macOS installers are on."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["macos"]
  permission: "enroll:manage"
  preview: true
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/agent/macos.md"
license: "CC BY 4.0"
---

# macOS agent

The Outpost agent runs on Macs as a preview. It manages a Mac much as it
manages a Windows or Linux computer: inventory, scripts, patching, software,
policy, and remote desktop, with the tray app in the menu bar. This page
covers what works, the permissions macOS asks for, and how the preview package
installs.

## What works

The agent supports macOS 14 and later, on Apple silicon and Intel Macs.

| Area | On macOS |
| --- | --- |
| Inventory | Hardware, software, patches, certificates, browser extensions, USB devices, drivers, services, users and sessions, security state, and more. Windows-only items, such as optional features and activation, are reported as not applicable. |
| Live metrics and process list | Yes |
| Remote terminal | Yes |
| Scripts | `sh`, `bash`, `zsh`, and Python, as root or as the signed-in user, and at sign-in |
| Remote desktop | Yes, with the Screen Recording permission. Input needs the Accessibility permission. |
| Patching | macOS Software Update |
| Software deployment | Homebrew formulas and casks, and `.pkg` and `.dmg` installers |
| Policy | Password policy, firewall, Gatekeeper, screen lock, guest account, Remote Login, automatic updates, and FileVault, with the recovery key escrowed to your Outpost |
| Local administrator password rotation | Yes |
| Restart, shut down, lock screen, sign out, and message a user | Yes |
| Outpost Sync | No |
| Tray app | Yes, in the menu bar |

Homebrew installs need Homebrew on the Mac. A Homebrew package sent to a Mac
without it fails with a reason rather than installing anything else.

See [Supported platforms](/get-started/platform-support/) for the full
comparison with the other platforms.

## Privacy permissions

macOS protects the screen, input, and some folders with privacy permissions
that root does not bypass. Each one is granted to `outpost-agent` once, by
someone at the Mac, unless your MDM grants it.

| Permission | Needed for | Without it |
| --- | --- | --- |
| Screen Recording | Seeing the screen in a remote desktop session | The session does not open, with **Screen Recording permission is not granted to Outpost on this Mac** |
| Accessibility | Mouse and keyboard input in a remote desktop session | The session is view only |
| Files and Folders (Desktop, Documents, Downloads, and removable and network volumes) | Browsing and transferring files in those folders during a remote session | The person at the Mac is asked to allow access. Until they do, the transfer stops with a message asking them to select **Allow** |
| Full Disk Access | Optional. Grants every protected folder at once | Folder access is asked for per folder, as above |

With an MDM, you can pre-approve Accessibility and folder access with a
Privacy Preferences Policy Control profile. MDM cannot grant Screen Recording.
It can only let a standard user turn it on. Someone at the Mac still has to
allow it.

## Install the preview package

The macOS options in **Enroll a device**, **macOS Apple silicon** and **macOS
Intel**, appear only when macOS installers are turned on for your Outpost.

The download is a `.zip` holding the package and `agent.json`:

1. Extract the whole `.zip` into one folder. `agent.json` must stay beside the
   `.pkg`.
2. Open the `.pkg` from that folder, or install it from Terminal:

   ```sh
   sudo installer -pkg outpost-agent-darwin-arm64.pkg -target /
   ```

The package installs the agent to `/usr/local/outpost` and the tray app to
`/Applications/Outpost Tray.app`, applies `agent.json`, and starts the agent
as the LaunchDaemon `com.outpost.agent`.

:::caution
The preview package is not signed or notarized by Apple. Gatekeeper blocks it
until an administrator on the Mac allows it in **Privacy and Security**
settings. Install it only from a download you made yourself in the console.
:::

To check the agent:

```sh
sudo launchctl print system/com.outpost.agent
```

The agent's log is `/var/log/outpost-agent.log`.

## Related

- [Install and enroll the agent](/agent/install-and-enrollment/)
- [Retire or uninstall the agent](/agent/retire-and-uninstall/)
- [The Outpost tray app](/tray/)
- [Remote access](/remote-access/)