Pre-approve permissions

Screenshot needed

System Settings on a managed Mac, Privacy & Security, then Profiles, with SalesEQ Desktop Privacy Preferences selected so its Privacy Preferences payload is visible. No browser chrome: this is a native macOS window.

/docs/account/pre-approve-permissions-hero.webp

During setup, the desktop app asks each member for several macOS permissions. If your company manages its Macs with an MDM tool such as Jamf, Kandji, Intune, or Rippling, you can approve some of them ahead of time. Members then see fewer prompts.

This page is for IT administrators. To limit the desktop app to your organization's accounts, see Device management.

Before you startCopy Anchor Link

• Admin access to your MDM tool.
• Know which browser your members use for Google Meet. The profile on this page covers Google Chrome. Another default browser needs one more entry, described in Add another browser.

Deploy the profileCopy Anchor Link

What the profile approvesCopy Anchor Link

macOS doesn't let an MDM tool turn on the microphone or Screen & System Audio Recording for an app. Leave the microphone out of your profile: an MDM tool can only deny it, and a denied microphone stops the desktop app from recording.

What members still doCopy Anchor Link

• Allow the microphone, and turn on Screen & System Audio Recording, when the desktop app asks.
• Select the Google Meet and Microsoft Teams steps once. Google Meet setup restarts the member's default browser, and Microsoft Teams setup restarts Teams. With the profile in place, neither step shows a macOS prompt.
• Finish the Zoom step. macOS asks twice for the member's Mac password, to allow access to Zoom's Zoom Safe Meeting Storage item in their keychain. An MDM tool can't approve this.

The Google Meet, Microsoft Teams, and Zoom steps appear only on Macs with Apple silicon, and only for apps installed on that Mac.

Add another browserCopy Anchor Link

The Google Meet step sets up each member's default browser. For every other browser your members use, add an Automation entry to the profile:

1. On a Mac with the browser installed, run codesign -dr - "/Applications/Microsoft Edge.app", with that browser's app name in the path.
2. Copy everything after designated =>. This is the browser's code requirement.
3. Find the first quoted identifier in it. This is the browser's bundle ID. For Microsoft Edge, it is com.microsoft.edgemac.
4. Copy the Google Chrome entry in the profile, and replace its receiver bundle ID and code requirement with the browser's.

Enter the values yourselfCopy Anchor Link

Some MDM tools build PPPC profiles in their own interface instead of taking a file. Your MDM tool calls Automation Apple Events. Each entry below is for the desktop app:

• Identifier: com.electron.saleseq
• Identifier type: Bundle ID
• Code requirement: identifier "com.electron.saleseq" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "8Q55YVQX9M"

Add these four entries:

1. Accessibility: Allow.
2. Apple Events to Google Chrome: Allow. Receiver bundle ID com.google.Chrome. Receiver code requirement identifier "com.google.Chrome" and anchor apple generic and certificate leaf[subject.OU] = EQHXZ8M8AV.
3. Apple Events to Microsoft Teams: Allow. Receiver bundle ID com.microsoft.teams2. Receiver code requirement identifier "com.microsoft.teams2" and anchor apple generic and certificate leaf[subject.OU] = UBF8T346G9.
4. Screen Capture: Allow Standard User to Set System Service.

Check it workedCopy Anchor Link

1. On a managed Mac, open System Settings, then Privacy & Security, then Profiles. Confirm SalesEQ Desktop Privacy Preferences is listed.
2. On a Mac with Apple silicon, Chrome as the default browser, and Microsoft Teams installed, go through setup in the desktop app. Accessibility is already on, and the Google Meet and Microsoft Teams steps finish without a "wants access to control" prompt.
3. Sign in to that Mac with an account that has no admin rights, and confirm you can turn on Screen & System Audio Recording for SalesEQ.

NextCopy Anchor Link

• Device management covers locking the desktop app to your organization's accounts.
• Desktop app covers installing and using the desktop app.