We’ve got a single, overarching goal when it comes to our local admin rights solution for macOS: we want to provide just as much protection, customization, and abilities for our Mac users, that we provide for our Windows users.
macOS devices are continuing to gain traction in the enterprise space – Jamf claims one in four users will choose a Mac if given the choice – so we want our solution to reflect the growing popularity of macOS endpoints in the workforce and offer the same comprehensive feature set to all our customers, regardless of operating system.
Our latest release adds a stack of core features to Admin By Request for macOS, making it the most feature-packed Privileged Access Management solution for Mac on the market, and bringing it closer than ever before to our Windows solution.
Here’s the latest on Admin By Request 3.2 for macOS.
New in 3.2
Version 3.2 introduces four more core features:
1. Break Glass / LAPS replacement feature – Break Glass creates a new, temporary, one-time-use Administrator account on an endpoint, that works on domains, Azure AD, and stand-alone, Audits all elevated activity, and terminates within a pre-defined amount of time or on log out.
2. Events and Alerting capabilities – Major events on endpoints are reported to the User Portal Inventory under a new ‘Events’ tab in the left-hand menu, such as updating Admin By Request, tampering attempts and administrative logons. Suspicious activity instigates an alert on the User Portal.
3. OPSWAT MetaDefender’s Cloud API malware protection – When a user requests to run a file, malware checks are performed on the file using 35+ anti-virus engines (including CrowdStrike Falcon ML, BitDefender, McAfee, and Kaspersky) before it is executed.
4. Application Blocklisting – Blocking / Blocklisting (previously ‘Blacklisting’) is now back on the feature menu for Admin By Request 3.2, now with the possibility to block based on application vendor within your User Portal.
The following minor updates have also been added:
- Diagnostics for technical support can be submitted from the Inventory without accessing the endpoint. Support will instruct users on how to do this when required.
- Universal time is collected from endpoints to show a unified time in your User Portal.
- Compatibility issues with Monterey v12.3. Monterey 12 were fixed in version 3.1.
- Also in v3.1, functionality was added to enable the Inventory to automatically update when a device is renamed.
How-To:
This section covers the steps involved to use the new core features on a macOS endpoint.
- Run as Admin – This feature is invoked when only single apps need administrative privileges to run, such as installer packages. Upon executing an installer package, the ‘Run as’ feature appears as a pop up in the install wizard and asks for the user’s credentials. With this feature, the installation can be completed without the need for an IT administrator’s credentials or an Admin Session:
- Admin Session – To gain full administrator privileges on the endpoint for a period of time, either select the Admin By Request icon from the top toolbar, or locate and click the app icon from the Dock or Launchpad. Follow the prompts, wait for approval (if configured), and the session will commence, indicated by the timer in the bottom right-hand corner of your desktop.
- Events & Alerting – Events are automatically sent to your User Portal; navigate to Inventory from the top menu, and select Events from the left-hand menu of the Inventory page.
- PIN Code Uninstall – In your User Portal, navigate to the Inventory page and select the device you want to perform the uninstall on. Select PIN Code from the left-hand menu, and choose the Uninstall Pin tab from the top menu in this page. Click the Generate PIN button, and copy the PIIN that is displayed. On the device you want uninstall Admin By Request on, select the Admin By Request icon from the top toolbar, and click About Admin By Request. In the System window, paste the PIN copied from your User Portal, and select Uninstall.
- Break Glass Account – See documentation here.
Technical Info
Visti the following two pages for technical information.
Coming Next
Our next Mac release will bring our latest Windows feature, Device Owner, to the macOS endpoint. This feature adds another layer of security by setting a user as the device owner, and providing the ability to lock down the device to only that person. Read the full documentation here.
Summary
This latest update for macOS brings a heap of our staple Admin By Request features – previously only available for Windows users – to the table for macOS.
Download Admin By Request 3.2 for Mac for a comprehensive, flexible, simple, and effecting Privileged Access Management experience, unified across multiple operating systems. Existing customers can find it in their User Portal, under Top Menu > Download > Download Client for Mac. New users can get it for free on our lifetime Free Plan at this link.
Questions?
If you have any questions that haven’t been answered on this page, please contact us using the chat or the contact menu at the top of the page.
