Permitting user-controlled Agent functionality on macOS

Certain FortiDLP Agent functionality requires user approval on macOS devices:

• Screenshot actions: When the first screenshot action is executed on a node, the action fails and the associated user is prompted with a dialog box requesting access to take a screenshot of their computer display. Additionally, for macOS 15, after a user grants screenshot access, they will be prompted to reapprove screenshot access monthly. If the user denies access when prompted, the FortiDLP Agent will be unable to execute screenshot actions.
  

Apple provides the forceBypassScreenCaptureAlert key that is configurable using Mobile Device Management (MDM) to suppress the monthly screenshot access prompts on macOS 15.1+. User consent is still required for screenshot actions when this key is used. For details, refer to Apple's documentation here.

• Keystroke monitoring: When keystroke monitoring is enabled, the user is prompted with a dialog box requesting access to capture keystroke statistics. If the user denies access when prompted, the FortiDLP Agent will be unable to build that user's typing profile.

These permissions cannot be granted by a network administrator. Even if a user initially grants access, they can later deny it. If permissions are later denied by the user, they will need to be reapproved directly by the user.

You can check nodes' screenshot and keystroke monitoring permissions remotely by viewing the macOS Screenshot Monitor and Keystroke Monitor components in the Nodes module. For details, refer to the FortiDLP Console User Guide.

For instructions users can follow to grant these permissions, see Permitting user-controlled Agent functionality on macOS.