Americas

  • United States

Asia

Apple has improved Mac MDM with this important feature

how-to
Nov 23, 20224 mins
AppleEnterprise Mobile ManagementMobile Device Management

Mac admins now have more control over login and background items, thanks to improvements in macOS Ventura.

MacBook Pro 14in and 16in

The ever growing numbers of Mac users have always been able to set apps to launch when they log in to their computers, but this has changed in macOS Ventura. Login items are now managed in a different place, and Apple has also made it possible for Mac admins to manage them using MDM software.

Where are my login items?

Traditionally on a Mac, login items were managed in the Users & Groups section of System Preferences. This changes with Ventura — not only have System Preferences become System Settings, but they have been quietly shifted to a new section found in the General category.

Login items are usually applications you’ve asked your Mac to launch automatically at login, but also include other processes such as launch agents or launch daemons that are required for certain applications to work consistently.

If you’re an IT manager running Macs, then you’ll already know that the MDM service you use will have installed launch agents to run on enrolled Macs. These are also found in Login Items.

What changes in macOS Ventura?

The two biggest changes to this approach are as follows:

  • Migrating the setting from Users & Groups to General
  • Making more items that launch at login more visible

The latter means that software components, installer packages, and other items individual applications need that must be launched on startup are now visible.

When installed, users will receive a notification to warn them the installation has taken place and these items can also be disabled in Login Items. This is a big change, as until now such items were frequently invisible to the end user.

[Also read: Apple’s DeskView and Continuity Camera come to Webex]

The Login Items section has also been changed. It now offers two broad categories: Open at Login and Allow in the Background.

  • The former will be home for any application (such as your browser) you want your Mac to open automatically when you log in.
  • The latter will include any background items, such as MDM software.

Users can check and uncheck a box beside these background processes to prevent them working automatically if they wish. They cannot, however, disable MDM system agents; only admins can do that from within the console of their chosen system.

What about admins?

Mac admins can now manage login and background items on their Mac fleets remotely via their choice of MDM software. That means they can insist on some items running on every Mac or disable items that don’t meet security policy requirements.

Apple has also introduced a new SMAppService API, which MDM systems use to manage these items, which is explained here. This is essential as admins attempt to secure Macs in use beyond the standard security perimeter. Apple maintains its mission to make Macs more secure than before.

Are there other changes?

These are not the only changes Apple made in System Settings (Ventura) in comparison to System Preferences (previous iterations of macOS). Not only have these been redesigned to echo Settings on iPads and iPhones, but they feature new sections for:

  • Game Controllers
  • Game Center
  • Lock Screen (which has moved out of Security & Privacy)
  • Desktop & Dock (previously in Desktop & Screen Saver and Dock & Menu Bar)
  • Screen Saver (once available in Desktop & Screen Saver)
  • Wallpaper (also once available in Desktop & Screen Saver)

If you can’t find a specific control because it has been moved, you can use the improved search facility to track it down.

Additional improvements in macOS Ventura

Please follow me on Twitter or Mastodon, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Jonny Evans

Hello, and thanks for dropping in. I'm pleased to meet you. I'm Jonny Evans, and I've been writing (mainly about Apple) since 1999. These days I write my daily AppleHolic blog at Computerworld.com, where I explore Apple's growing identity in the enterprise. You can also keep up with my work at AppleMust, and follow me on Mastodon, LinkedIn and (maybe) Twitter.