SecurityAgent taking focus for plugin in macOS 26.1

Privacy & Security General Security Security Interface

Created 3w

Replies 21

Boosts 3

Views 2.1k

Participants 5

We have a custom SecurityAgentPlugin that is triggered by multiple authorizationdb entries. Some customers report that the SecurityAgent process takes window focus even though no UI or windows are displayed.

Our plugin explicitly ignores the _securityAgent user and does not show any UI for that user. However, in macOS 26.1, it appears that the plugin still causes the SecurityAgent to take focus as soon as it is triggered.

Is this a change in macOS 26.1 or a bug? Can we do anything to prevent "focus stealing"?

Boost

Afogh OP

@DTS Engineer I've discovered more information. The process /usr/libexe/mdmclient runs every so often to check if the machine is enrolled in MDM (I believe). This process seems to invoke our security agent plugin to check the right com.apple.ServiceManagement.daemons.modifywhich is the same right we are already modifying when this happens. I have tried to return early in our security agent's invoke method if it is the mdmclient process, but that didn't seem to work. I am going to see if I can return even earlier, or, ignore it altogether.

We are seeing the same thing. We can reproduce the SecurityAgent focus steal by killing the mdmclient process and making our Intune Company Portal app do a resync.

@DTS Engineer Could we please get some feedback on this? This is affecting a lot of our Mac users.

DTS Engineer OP

Apple

Afogh, ehale, Thanks both you for the extra info.

Have either of your filed a bug about this yet? If so, please post the bug number.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Afogh OP

Have either of your filed a bug about this yet? If so, please post the bug number.

Yes, I have reported a bug with this number: FB20987979

domidetres OP

Hey Guys,

any information about that? Please see the following discussion:

https://discussions.apple.com/thread/256192312?cid=em-com-apple_watches_email_thread_owner-view_the_full_discussion-en-us-11282023&sortBy=newest_first&page=1

Afogh OP

Yes, I have reported a bug with this number: FB20987979

@DTS Engineer Any update on this? Is this being fixed?

DTS Engineer OP

Apple

Any update on this?

No.

If anything changes here, you’ll be notified via Feedback Assistant.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"