Permitting user-controlled Agent functionality on macOS

Certain FortiDLP Agent functionality requires user approval on macOS devices:

• Screenshot actions: When the first screenshot action is executed on a node, the action fails and the associated user is prompted with a dialog box requesting access to take a screenshot of their computer display. Additionally, for macOS 15, after a user grants screenshot access, they will be prompted to reapprove screenshot access monthly. If the user denies access when prompted, the FortiDLP Agent will be unable to execute screenshot actions.
  

Apple provides the forceBypassScreenCaptureAlert key that is configurable using Mobile Device Management (MDM) to suppress the monthly screenshot access prompts on macOS 15.1+. User consent is still required for screenshot actions when this key is used. For details, refer to Apple's documentation here.

• Keystroke monitoring: When keystroke monitoring is enabled, the user is prompted with a dialog box requesting access to capture keystroke statistics. If the user denies access when prompted, the FortiDLP Agent will be unable to build that user's typing profile.

These permissions cannot be granted by a network administrator. Even if a user initially grants access, they can later deny it. If permissions are later denied by the user, they will need to be reapproved directly by the user.

You can check nodes' screenshot and keystroke monitoring permissions remotely by viewing the macOS Screenshot Monitor and Keystroke Monitor components in the Nodes module. For details, refer to the FortiDLP Console User Guide.

The following instructions describe how users can approve and reapprove these permissions.

How to permit user-controlled Agent functionality on macOS 13+

1. In the Apple menu, go to System Settings > Privacy & Security.
2. Optionally, to permit screenshot actions:
1. Do one of the following:

• On macOS 15 or 14, in the right-hand panel, click Screen & System Audio Recording.
• On macOS 13, in the right-hand panel, click Screen Recording.

Turn the FortiDLP Agent toggle on.

Enter your password and then click Unlock.

Click Quit & Reopen.

Because the first executed screenshot action always fails, you may also want to execute an initial screenshot action.

Optionally, to permit keystroke monitoring:

1. In the right-hand panel, click Input Monitoring.
2. Turn the FortiDLP Agent Helper toggle on.

In some cases, a User Monitor option may also display in the list. This option can be ignored.

3. Click Quit & Reopen.

How to permit user-controlled Agent functionality on macOS 12

1. In the Apple menu, go to System Preferences > Security & Privacy.
2. Select the Privacy tab.
3. Optionally, to permit screenshot actions:
   1. In the left-hand panel, click Screen Recording.
   2. Select the FortiDLP Agent Helper checkbox.

   Because the first executed screenshot action always fails, you may also want to execute an initial screenshot action.

4. Optionally, to permit keystroke monitoring:
   1. In the left-hand panel, click Input Monitoring.
   2. Select the FortiDLP Agent Helper checkbox.

   In some cases, a User Monitor option may also display in the list. This option can be ignored.

   3. Log out and then log back in to the device.

   This step is required to initiate keystroke monitoring.