Deploy Glean Tau on macOS

Deploy Glean Tau with your mobile device management (MDM) service. Configure app policy and macOS privacy permissions separately so users receive the features and access your organization permits.

Prerequisites

Before you deploy, complete the following:

• Obtain the Glean Tau release and managed installer approved for your rollout from your Glean representative
• Confirm support for your macOS versions and Mac architectures
• Have access to your MDM service to assign app packages and configuration profiles
• Prepare a standard-user test device and a policy for its intended workload, starting from an example in Glean Tau configuration reference

For manual installation, see Set up Glean Tau. Confirm that any installer you use contains the Glean Tau release you intend to test. An existing Glean for Desktop package doesn't by itself establish support for the new policy format.

Separate the deployment controls

A rollout can include three independent items:

Item	Purpose
App package	Installs the signed app
Glean managed preferences	Sets Glean Tau behavior through the com.glean.desktop preference domain
Privacy Preferences Policy Control (PPPC) profile	Manages supported macOS privacy decisions through com.apple.TCC.configuration-profile-policy

A PPPC profile doesn't set approval modes or filesystem limits. A Glean settings profile doesn't grant screen capture, microphone, or Accessibility access.

Deploy a configuration profile

Use an application settings payload for the production preference domain com.glean.desktop. Place the administrator policy inside a desktopSettings dictionary. Use property list dictionaries, arrays, integers, and Boolean values, rather than a JSON string.

This payload fragment applies an approval-only policy:

Application settings payload fragment

<key>PayloadType</key>
<string>com.glean.desktop</string>
<key>desktopSettings</key>
<dict>
  <key>schemaVersion</key>
  <integer>1</integer>
  <key>settings</key>
  <dict>
    <key>core.authority.requirements</key>
    <dict>
      <key>allowedApprovalPolicies</key>
      <array>
        <string>untrusted</string>
        <string>on-request</string>
      </array>
    </dict>
  </dict>
</dict>

Download the complete example profile. Replace its example payload identifiers and UUIDs with identifiers unique to your deployment. Preserve com.glean.desktop and desktopSettings.

Assign the profile through your MDM service. User-channel preferences take priority over device-channel preferences for ordinary settings. Security restrictions from both channels combine.

Glean Tau reads the managed preferences macOS delivers at these locations:

/Library/Managed Preferences/com.glean.desktop.plist
/Library/Managed Preferences/<username>/com.glean.desktop.plist

Use these paths for inspection. Manage the profile through MDM instead of editing the generated files. Ordinary preferences under ~/Library/Preferences aren't an administrator policy source.

Other app preferences can coexist with desktopSettings. A valid preference dictionary that has no desktopSettings entry supplies no Glean Tau policy. If the entry is present, it must contain a valid policy. Removing it doesn't clear prior enrollment.

Deploy the managed settings file

As an alternative to a profile, deploy a JSON document at:

/etc/glean/managed-settings.json

Use the same administrator document as the profile's desktopSettings value. The file itself doesn't need a desktopSettings wrapper.

Protect the file and its path:

• Make the file and its parent directories owned by root.
• Prevent group and other users from writing to the file or its parent directories.
• Check access control lists (ACLs) as well as Unix mode bits. An ACL that grants another user write access can make the source unsafe.
• Use a regular file rather than a symlink, and keep the document under 1 MiB.
• Write a complete replacement in the same protected directory, set its ownership and permissions, then rename it into place.

Don't edit a live policy in place. A partial write can temporarily make the policy invalid. Glean Tau reads the file at startup and checks for changes while running. Verify acceptance after every update.

A missing or blank legacy file supplies no new policy. It doesn't clear retained enrollment or retained security restrictions. See Remove managed policy.

Configure macOS privacy permissions

Grant only the permissions needed by enabled features. The following table separates app capability from user consent.

Capability	macOS permission	Deployment guidance
Company search and text chat	No screen, microphone, or Accessibility permission	Don't grant capture permissions for these tasks alone
Screen capture and Computer Use	Screen recording or Screen & System Audio Recording, depending on macOS	A supported PPPC setting can let a standard user approve access. It doesn't silently grant capture access.
Computer Use and system-wide input	Accessibility	Configure access for the signed app where the macOS version supports it. Verify the result on the target device.
Dictation, voice, and meeting microphone capture	Microphone	The user must approve access. MDM can restrict it.
Meeting system audio	The capture permissions requested by that macOS release	Have the user complete the prompts and restart Glean if requested
Access to privacy-protected folders	The applicable file privacy permission	Grant only the access required by the approved workload

warning

Don't grant Full Disk Access as a general fix for policy errors. It changes macOS access and doesn't repair a malformed Glean Tau policy or override a Glean Tau denial.

Apple controls which permissions MDM can grant, deny, or let a standard user approve. Check the current PPPC payload guidance for each macOS release in your fleet.

Verify the app identity

The production direct-download app uses the bundle identifier com.glean.desktop and Developer Team ID 877XN49FUQ. Verify the signed app that you distribute before building a PPPC rule.

For an app installed at /Applications/Glean.app, inspect its designated code requirement:

codesign -dr - /Applications/Glean.app
codesign -dv --verbose=4 /Applications/Glean.app

Use the requirement reported by the signed package in your MDM profile. Don't substitute a development app or identify the app only by its display name.

For screen capture, a supported ScreenCapture entry with Authorization set to AllowStandardUserToSetSystemService lets a standard user complete consent. It doesn't approve recording automatically. Keep the PPPC payload separate from the Glean settings payload.

Download the screen-capture consent profile as a starting point. Replace its example payload identifiers and UUIDs, and compare its code requirement with your signed app. This profile contains only the standard-user screen-capture consent setting. Add other privacy services only when the enabled features and macOS release require them.

Verify the deployment

Test with the same account type users will have:

1. Confirm the installed app version and signature.
2. Confirm that MDM assigned the Glean policy and any required PPPC profile.
3. Open Glean Tau, sign in, and complete user-consent prompts.
4. Confirm a managed preference and the available approval modes.
5. Run a permitted task, then verify that an out-of-policy operation is refused.
6. Update policy, restart the app, and confirm that restrictions still apply.
7. Test recovery and policy removal before expanding the rollout. See Remove managed policy.

A successful MDM assignment proves delivery. It doesn't prove that the app accepted the policy or that a particular command satisfies the sandbox requirements.

See also

• Glean Tau security and permissions — how approvals, sandboxing, and operating-system permissions combine
• Deliver server-managed settings — apply organization policy to signed-in accounts