422: Full Access
Disk Access, Keychains, and updates
Full Disk Access changes thanks to AI, conference news and videos, KeyChains and updates
Sponsor
Deliver the software your team needs, securely and at scale.
Homebrew makes it easy to install software fast.
So fast that most installs never get reviewed until after they have consequences.
Workbrew closes that gap: instant visibility, zero-touch deployment via MDM, built-in user support, and fleet-wide default packages. All with SOC 2 and ISO 27001 compliance.
Start free at workbrew.com/free
Full Access
Apple has announced that they will update how the Full Disk access privilege works, because “some developers are using Full Disk Access in ways that could put users at risk.” This has Mac Admins somewhat concerned. Be sure to file feedback.
Reminder: Mac Admins Slack Migration this week-end
Mac Admins Slack moves to Slack’s Enterprise plan starting Friday 9 October 2026 at 11:30 p.m. EDT. Slack will be fully down for about 18 hours, and direct messages need roughly 10 more hours to catch up.
Save the date: Mac Admins Europe 2027
Mac Admins Europe will return to Leiden in the Netherlands for a one-day Mac Admins conference on April 15, 2027. Save the date!
📰 News and Opinion
AI helps Mac admins ship changes quickly, but rollback often takes days
Allen Houchins, Fleet Blog:
Mac admins now use AI to write scripts, troubleshoot problems, and author configuration profiles, and most of them deploy that output to production. Few of them can undo a bad change quickly.
Year Six: The Mac Admins Slack Needs an Exit Plan
Jack-Daniyel "JD” Strong:
I also have a proposal: a member-staffed working group with a written charter and one deliverable. That deliverable is a platform evaluation and exit plan. It is not a migration.
⚙️ Apple Updates
What changed in macOS Tahoe 26.4? (Take 2)
Howard Oakley:
It’s not very often we have the wisdom of hindsight and can go back to document changes made in macOS over six months ago. This brief article adds information on some of the more consequential changes made in macOS Tahoe 26.4
🔨 Support and Tutorials
What controls access to files?
Howard Oakley:
Read and write access to files in macOS has become complicated by its combination of Unix permissions, security and privacy protections.
Smart Card Mapping in macOS
The Terminal Blogger:
Smart card authentication in macOS is both extremely complicated and extremely simple at the same time.
Explainer: Keychains
Howard Oakley:
Keychains are specialised database files used by every Mac since the introduction of Mac OS X to store and protect passwords, security certificates and other secrets.
Upcoming Full Disk Access Changes
Adam Selby:
Apple announced upcoming Updates to Full Disk Access in macOS that have potential impact for Mac Admins. While currently the details are light, this is a perfect time to file feedback on this topic, to help influence what these changes ultimately become.
See also Michael Tsai’s summary.
Privacy, Full Disk Access and AI agents
Howard Oakley:
You’ll probably have heard that Apple is urgently reviewing privacy protection in macOS, and intends enforcing stricter use of Full Disk Access in Privacy & Security settings. This article explains what’s going on, and why we all need to be concerned.
🤖 Scripting and Automation
Securing Bash Environment Variables in macOS
The Terminal Blogger:
utilizing the security binary to find a password in our login keychain associated with the service name “Test Item” and account “SomeAccount.”
Monocle: Initial Commit
Dan K. Snelson:
Monocle inspects scripts and small repos (local or on GitHub), plus diagnostic and support bundles, and produces four audience-specific summaries (Executive, Security, Manager, Engineer) plus a Monocle Score.
Mac Installer Plug-Ins Bug
anonymoussingh via Michael Tsai (summary):
Starting with macOS 27 beta 6, all of our plugins stopped loading in Installer.app
Jamf Migrator
Jordy Thery:
Jamf Migrator is a macOS app that copies a source tenant to a destination tenant — everything, or any selection down to a single object — shows exactly what it would change before writing anything, and picks up where it left off if a run is interrupted.
You can also use jamf-cli or Jamf Replicator
♻️ Updates and Releases
- Script Debugger 8.0.11
- TaskExplorer 3.0
- super 6.0.0-beta2
- Third Party Patcher 1.5.0
- Mac Health Check 5.0.0
- MunkiReport 5.8.2
- SYM-Lite 1.5.1, 1.6.0b3, blog post
- Nudge 2.1.4.81863
- JamfCheck v2.4.0
- MACE v1.2.1
- Microsoft 365 Reset 2.0.1
- Munki 7.4 Beta 2
- jamf-cli v1.33.0
- DDM OS Reminder 5.0.0, blog post
- Terraform Provider Jamf Platform v1.2.2
- AxMJamfSync v3.1
- Contour 0.5.0-beta.2
- ASBMUtil v2026.10.04.1719
- App Auto-Patch 3.7.2
- Jamf Reports Community v2.9.0 (blog post)
- Installomator Mate 1.4.0
📺 Watch
MacSysAdmin 2026 Session Videos
🎧 Listen
Stitches, Switches, and Sketchy Devices: A Podcast Nose Dive
Command Control Power:
Joe discusses costly RV maintenance and how machines (including hard drives) can fail when left idle, leading into Mac maintenance routines. They debate slang like “cooked,” then talk Apple’s new iPhone lineup, including Jerry’s iPhone 13 Pro Max purchase and their mixed expectations for the first-gen iPhone Duo
Way too many apps are sitting outside SSO protection
Apple @ Work:
Christophe Frenet, Dashlane's CPO, joins the show to talk about the challenges around managing apps that live outside SSO and how Dashlane Vault Enforcement aims to solve that problem.
The 27 Version Report
Mac Admins Podcast:
The new 27 series of Apple’s operating systems are now out! We’re going to spend a bit time talking through what’s new, what’s exciting, and what we all have to look forward to!