nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Changes in Mobile Device Management (MDM) on macOS 27 affecting TeamViewer

JenW

Hi all,

With macOS 27, Apple has introduced changes related to Privacy Preferences Policy Control (PPPC) configuration for applications managed through Mobile Device Management (MDM). These changes may affect certain TeamViewer functionalities on managed macOS devices if the required permissions are not configured.

What this means for you

If your macOS devices running TeamViewer are enrolled in an MDM solution and you currently roll out an Accessibility Privacy Preferences Policy Control (PPPC) payload for TeamViewer, you must additionally roll out a PostEvent PPPC payload when using macOS 27. If your devices are not enrolled in an MDM, or if your MDM does not roll out Accessibility PPPCs for TeamViewer, you are not affected by this change.

To help administrators prepare for this change, we've compiled the FAQ below covering the impact, required permissions, and recommended configuration.

FAQ

What happens if I don't roll out a PostEvent PPPC and devices upgrade to macOS 27?

If you do not roll out a PostEvent PPPC, any functionality involving TeamViewer posting or intercepting events will not work until one of the following happens:

the PPPC allowing PostEvent is rolled out, or
a local user on the device permits Device Control and Data Access (Events) for TeamViewer when prompted by macOS.

Users will see a dialog prompting them to permit Device Control and Data Access (Events) when TeamViewer accesses such functionality, for example, on the server side during a remote control session. If they dismiss the dialog, they can later enable the permission in System Settings ➜ Privacy & Security ➜ Device Control and Data Access.

As of macOS 27.0, once an Accessibility PPPC is rolled out, any user, including non-admins, can grant the Device Control and Data Access (Events) consent.

What functionality is affected by the missing PostEvent PPPC?

Moving the mouse or typing during a remote control session (PPPC required on the remote side).
Using hotkeys (keyboard shortcuts) on the supporter side that should be sent to the remote side (PPPC required on the supporter side).
Input blocking (PPPC required on the remote side).

Does this affect non-MDM users?

No. If a device is not enrolled in an MDM, or has never had an Accessibility PPPC for TeamViewer rolled out, macOS behavior remains unchanged.

What's the difference between "Accessibility" and "Device Control and Data Access"?

In macOS 27, Apple renamed the Accessibility setting in System Settings ➜ Privacy & Security to Device Control and Data Access. The new name more accurately reflects the capabilities this permission grants to an application.

When devices are managed through an MDM solution, the Accessibility and PostEvent PPPCs are grouped under the Device Control and Data Access setting. Because of this, the status displayed in System Settings may be misleading if only one of these PPPCs has been deployed.

How can I verify that both PPPCs have been rolled out correctly on macOS 27?

1. Go to System Settings ➜ General ➜ Device Management and double-click the profile containing your PPPCs.
Make sure both entries, “Control the computer by generating UI events” and “Control the computer” are there:

Note: For TeamViewer Host, the bundle identifier must be com.teamviewer.TeamViewerHost instead of com.teamviewer.TeamViewer.

2. Go to System Settings ➜ Privacy & Security ➜ Device Control and Data Access, locate the TeamViewer entry, verify that it is managed by a profile (checkmark), and ensure the switch is turned on.

Doesn't the documentation say that the Accessibility PPPC is deprecated/removed in macOS 27?

The Accessibility PPPC is currently marked as deprecated in the latest Apple documentation. However, despite previous announcements, it has not been removed in macOS 27.0.

What about the new Declarative Device Management (DDM) application settings in macOS 27?

At this time, we cannot yet recommend switching to the newly available DDM Privacy AppSettings for use with TeamViewer.

What other PPPCs should I roll out so TeamViewer works for my users?

If your users work with standard (non-admin) macOS accounts, roll out a ScreenCapture PPPC with Authorization set to AllowStandardUserToSetSystemService. This allows non-admin users to grant Screen Recording consent. Please note that Screen Recording consent must still be granted interactively by the user and cannot be approved through MDM.

To prevent periodic warnings that TeamViewer can record the screen, roll out the forceBypassScreenCaptureAlert restriction and set it to true. If your users have admin accounts on macOS, they can alternatively grant Remote Desktop consent to TeamViewer manually, which also suppresses these warning dialogs.