macOS Big Sur Beta 1: Standard user cannot add or approve apps for Screen Recording

App & System Services Core OS macOS Privacy

Created Jun ’20

Replies 25

Boosts 0

Views 7.0k

Participants 21

I noticed the following issue in macOS Big Sur Beta 1:
Popular video conferencing tools such as Zoom that allow screen sharing will request approval for Screen Recording before someone can share their screen.

Expected behavior:
In macOS 10.15, as a standard user I was able to go into System Preferences > Security & Privacy > Privacy > Screen Recording and add an app without needing to unlock the preference pane with admin credentials.

Actual behavior:
As of macOS 10.16 Beta 1 (20A4299v), as a standard user when I go to System Preferences > Security & Privacy > Privacy > Screen Recording, I need to unlock the preference pane with admin credentials.

This is a regression from macOS 10.15 behavior. In our environment, our users do not have admin credentials to be able to unlock that preference pane. This will severely impact our users who rely on web conferencing tools and need to share their screen. With many of our users working from home, this will severely impact us and affect our ability to also provide remote support. In fact, we rely on Zoom's screen sharing feature for our end-users to show us their screens during remote support sessions. If they do not have admin credentials to unlock the preference pane, they cannot possibly provide screen recording to Zoom and other similar apps. We kindly request that the behavior go back to how it was in macOS 10.15.

Apple at the moment is not providing an alternative way for standard users to be able to approve prompts for Screen Recording access. If you are impacted by this, I sincerely suggest you supply feedback to Apple at https://feedbackassistant.apple.com/.

If you haven't already, please join AppleSeed https://appleseed.apple.com/ and supply feedback to Apple.

Boost

captam3rica OP

Jun ’20

Yeah ... not so hot ...

 please at the very least make this setting manageable on a per user basis if enrolled in MDM and supervised via ABM.

dng-ucsf OP

Jun ’20

I just submitted my feedback and looking forward to find out what Apple's reply to my feedback will be.

apmcp OP

Jun ’20

This creates a very unpleasant scenario for e.g. MSPs, who rely on remote connections to their customers. Additionally, things like password managers cannot be configured to easily add MFA - resulting in users skipping the setting or worst case.

This will literally cost a significant amount of money to companies using macOS due to loss of productivity through hours spend on configuring the settings/implementing workarounds.

Systems Engineer OP

Apple

Jun ’20

The screen capture service is a system-wide service (not a per-user service) and system-wide services should only be modifiable by an administrator. Starting with macOS Big Sur, granting access to screen recording will require admin authentication. We do understand how important this control is, and we expect to have an alternate solution for many organizational use cases in a later seed.

Thank you all for your feedback!

theirongiant OP

Jun ’20

Thank you, nameless  Systems Engineer!

The community has discussed asking for a 'recording light' in macOS 10.16 / macOS 11, similar to what iOS 14 is shown to have. This icon in the menu bar would show users when their screen is being recorded, and what app(s) are doing that (in a menu).

See FB7801822 for an example.

CarlW OP

Jun ’20

This is great news!

That said, I believe users should be able to approve the requests for Screen Recording per their own user account. Even though Screen Recording might be system wide, allowing a single user to approve it system wide doesn't give other users of the same Mac the opportunity to not allow an app Screen Recording permission. This aligns more closely with what appears to be the push towards "user choice" for Security & Privacy.

dan.snelson OP

Jul ’20

Just filed FB7835962.

Thank you, Systems Engineer  , for your comment posted 1 day ago:

"The screen capture service is a system-wide service (not a per-user service) and system-wide services should only be modifiable by an administrator. Starting with macOS Big Sur, granting access to screen recording will require admin authentication. We do understand how important this control is, and we expect to have an alternate solution for many organizational use cases in a later seed. "

bp8 OP

Jul ’20

In the latest Beta 3 release notes it states:
"Admin user credentials are now required to allow Screen Recording in System Preferences > Security & Privacy > Privacy."

This was not in the release notes in Beta 1 or 2 for Big Sur. Is this an indication that Apple is planning on going through with this change and is now changing the tactic by trying to warn admins in advance instead of providing a viable alternative or going back to macOS 10.15's behavior?

dimaorlov OP

Aug ’20

Do you know if there are any changes being planned for beta 4 in terms of managing "Screen Capture" from MDM or providing any alternatives for sysadmin ?

Noelmo OP

Oct ’20

Beta 9 addresses this issue with a new MDM key.