In creating MDM profiles for Apex One (Mac), the following items are required to ensure no pop-ups will show on the macOS endpoint after initial installation of Apex One (Mac) agents:

   
<key>AllowedKernelExtensions</key>
<dict>
	<key>E8P47U2H32</key>
	<array>
		<string>com.trendmicro.kext.KERedirect</string>
		<string>com.trendmicro.kext.filehook</string>
		</array>
</dict>
<key>AllowedTeamIdentifiers</key>
<array>
	<string>E8P47U2H32</string>
</array>
<key>PayloadType</key>
<string>com.apple.syspolicy.kernel-extension-policy</string>

   
<key>AllowedSystemExtensionTypes</key>
<dict>
	<key>E8P47U2H32</key>
		<array>
			<string>EndpointSecurityExtension</string>
			<string>NetworkExtension</string>
		</array>
</dict>
<key>AllowedSystemExtensions</key>
<dict>
	<key>E8P47U2H32</key>
	<array>
		<string>com.trendmicro.icore.es</string>
		<string>com.trendmicro.icore.netfilter</string>
	</array>
</dict>
<key>PayloadType</key>
<string>com.apple.system-extension-policy</string>
<key>PayloadDisplayName</key>
<string>System Extension</string>

   
<key>FilterBrowsers</key>
<true/>
<key>FilterDataProviderBundleIdentifier</key>
<string>com.trendmicro.icore.netfilter</string>
<key>FilterDataProviderDesignatedRequirement</key>
<string>identifier "com.trendmicro.icore.netfilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32</string>
<key>FilterGrade</key>
<string>firewall</string>
<key>FilterPackets</key>
<false/>
<key>FilterSockets</key>
<true/>
<key>FilterType</key>
<string>Plugin</string>
<key>PayloadType</key>
<string>com.apple.webcontent-filter</string>
<key>PluginBundleID</key>
<string>com.trendmicro.icore</string>

Different products have different bundle identifiers, so different ".mobileconfig" files need to be generated for different IDs. Below are some examples:

This section is mainly used by people who have already understood the basics of Workspace One UEM (Vmware Airwatch) and want to use "Custom Profiles" to enable Apex One for Mac to obtain the necessary permissions for normal operation without being on duty.

Step 1: Agent Enrollment

1. Log in to Airwatch/Workspace One, and go to Devices page, add a device, push mail notification to Mac Agent, Install and enroll this agent.

    

   For detailed steps, please refer to Workspace One guide.

    

   

   

Step 2. Create Profile

Add a profile. Do the following:

1. Click the Add button in the top bar, then choose Profile.

   

2. Select macOS.

   

3. Click Device Profile.

   

4. Set the profile as General Information.

   

Step 3. Create Kernel Extension Profile

As Mac OS release 11.x Big Sur edition, its settings are different with 10.15.x Catalina, we need to generate 2 profiles:

Create Profile1 (For 10.15.x Catalina)

1. Generate "Kernel Extension" profile.

   

   Allowed Team Identifiers	Allowed Kernel Extensions
   E8P47U2H32	Team Identifier: E8P47U2H32 Bundle ID: com.trendmicro.kext.KERedirect
   	Team Identifier: E8P47U2H32 Bundle ID: com.trendmicro.kext.filehook

2. Generate “Privacy Preferences“ for ”Full Disk Access”, "Apple Events", etc. profile.

   

   Identifier	Allowed Content	Apple Events-1	Apple Events-2	Apple Events-3
   Identifier: com.trendmicro.tmsm.MainUI Identifier Type: BUNDLEID Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Accessibility: Allow System Policy All Files: Allow System Policy Sys Admin Files: Allow	Apple Events Allow Receiver Identifier: com.apple.finder Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemuiserver Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemevents Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32
   Identifier: com.trendmicro.icore Identifier Type: BUNDLEID Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Accessibility: Allow System Policy All Files: Allow System Policy Sys Admin Files: Allow	Apple Events Allow Receiver Identifier: com.apple.finder Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemuiserver Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemevents Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32
   Click to enlarge	Click to enlarge	Click to enlarge	Click to enlarge	Click to enlarge

Step 4. Create System Extension Profile

Create Profile2 (For 11.x Big Sur)

1. Generate "System Extension" profile.

   

   Allowed System Extension Types	Allowed System Extensions
   Team Identifier* E8P47U2H32 Endpoint Security:checkmark Network: checkmark	Team Identifier: E8P47U2H32 Bundle ID: com.trendmicro.icore.es
   	Team Identifier: E8P47U2H32 Bundle ID: com.trendmicro.icore.netfilter

2. Generate “Privacy Preferences“ for ”Full Disk Access”, "Apple Events", etc. profile.

   

   For the configuration details, please refer to the following table:

   Identifier	Allowed Content	Apple Events-1	Apple Events-2	Apple Events-3
   Identifier: com.trendmicro.tmsm.MainUI Identifier Type: BUNDLEID Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Accessibility: Allow System Policy All Files: Allow System Policy Sys Admin Files: Allow	Apple Events Allow Receiver Identifier: com.apple.finder Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemuiserver Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemevents Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32
   Identifier: com.trendmicro.icore Identifier Type: BUNDLEID Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Accessibility: Allow System Policy All Files: Allow System Policy Sys Admin Files: Allow	Apple Events Allow Receiver Identifier: com.apple.finder Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemuiserver Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemevents Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32
   Identifier: com.trendmicro.icore.es Identifier Type: BUNDLEID Code Requirement: identifier "com.trendmicro.icore.es" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Accessibility: Allow System Policy All Files: Allow System Policy Sys Admin Files: Allow	Apple Events Allow Receiver Identifier: com.apple.finder Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore.es" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemuiserver Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore.es" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemevents Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore.es" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32
   Identifier: com.trendmicro.icore.netfilter Identifier Type: BUNDLEID Code Requirement: identifier "com.trendmicro.icore.netfilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Accessibility: Allow System Policy All Files: Allow System Policy Sys Admin Files: Allow	Apple Events Allow Receiver Identifier: com.apple.finder Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore.netfilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemuiserver Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore.netfilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32	Apple Events Allow Receiver Identifier: com.apple.systemevents Receiver Identifier Type: BUNDLEID Receiver Code Requirement: identifier "com.trendmicro.icore.netfilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32

3. Generate "Web Content Filter" profile.

   

   **The 2 Key/Value pairs are:

   Key	Value
   FilterDataProviderBundleIdentifier	com.trendmicro.icore.netfilter
   FilterDataProviderDesignatedRequirement	identifier "com.trendmicro.icore.netfilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32

Others

1. Generate installation profile

   Click the image(s) to enlarge.

   • Identifier Type: /System/Library/CoreServices/Installer.app
   • Code Requirement: identifier "com.apple/installer" and anchor apple
2. Install the browser extensions. Refer to the following links:
   • Google Chrome Extension
   • Mozilla Firefox Extension

1. Log in to the Jamf Now console, and go to Devices page to see the enrolled or active Mac devices.

   

   ^{Click the image to enlarge.}

    

   If there's no device in your device list, you have two ways to enroll your device

   • Auto: Use ADE to enroll device automatically
   • Manual: Click "Enroll This Device", then download the configuration profile to start the enrollment.

    
2. Click Blueprints and select your target blueprint.

   

   ^{Click the image to enlarge.}

3. Select Custom Profiles tab, then add or upload your profiles.

   

   ^{Click the image to enlarge.}

4. Upload all ".mobileconfig" files.

   

   ^{Click the image to enlarge.}

5. Verify if all profiles have been configured.

   

   ^{Click the image to enlarge.}

Troubleshooting Common Issues

1. Log in to Jamf Pro, click Computers at the top of the page, and then go to Configuration Profiles > New.

   

   ^{Click the image to enlarge.}

2. Use the General payload to configure basic settings and look for Privacy Preferences Policy Control > App Access.

   

   ^{Click the image to enlarge.}

3. Add the following configurations:

   ---

   App Access

   Identifier: com.trendmicro.tmsm.MainU	Identifier Type: Bundle ID Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32 App or Service: SystemPolicyAllFiles Allow Click the image to enlarge.
   Identifier: com.trendmicro.icore	Identifier Type: Bundle ID Code Requirement: identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32 App or Service: SystemPolicyAllFiles Allow Click the image to enlarge.
   Identifier: com.trendmicro.icore.es	Identifier Type: Bundle ID Code Requirement: identifier "com.trendmicro.icore.es" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32 App or Service: SystemPolicyAllFiles Allow Click the image to enlarge.
   Identifier: /Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService	Identifier Type: PATH Code Requirement: identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32 App or Service: SystemPolicyAllFiles Allow Identifier: /Applications/TrendMicroSecurity.app Click the image to enlarge.

   ---

   Extensions

   Kernel Extensions	Display Name: Trend Micro Team ID: E8P47U2H32 Kernel Extension Bundles: E8P47U2H32,com.trendmicro.kext.filehook,1,"Trend Micro, Inc.",8 E8P47U2H32,com.trendmicro.kext.KERedirect,1,"Trend Micro, Inc.",8 E8P47U2H32,com.trendmicro.kext.iTMKernAPI,1,"Trend Micro, Inc.",8 Click the image to enlarge.
   System Extensions	Display Name: Trend Micro Sytem Extension Types: Allowed System Extension Types Team Identifier: E8P47U2H32 Allowed System Extensions: com.trendmicro.icore.es com.trendmicro.icore.netfilter Click the image to enlarge.

1. Login in to Microsoft Intune.
2. Click Devices > macOS to enter macOS devices setting page.

   

   ^{Click the image to enlarge.}

3. Select Configuration profiles > Create profile, then select Templates on the "Create a profile" pane.

   

   ^{Click the image to enlarge.}

   Below are the two ways to create a profile:

   • Select Custom, and upload the self-created ".mobileconfig" file. In this way, all types of profiles can be deployed.
   • Select Extensions. In this way, only "Kernel Extension" and "System Extension" can be deployed.
4. Configure the "Custom" settings of the macOS Profile:

   Below is an example for System Extensions:

   1. Provide the name and description of the macOS Profile.

      

      ^{Click the image to enlarge.}

   2. Add the Configuration profile name and upload the "SystemExtension.mobileconfig" file.

      

      ^{Click the image to enlarge.}

   3. Set the Included groups or Excluded groups according to your needs.

      

      ^{Click the image to enlarge.}

   4. You can view the progress of deployment, if there is no update for a long time, you can click the Assignments button below to execute again.

      

      ^{Click the image to enlarge.}

   5. Once finished, the Deployment Status will show "Deploy succeeded".

      

      ^{Click the image to enlarge.}

   6. Repeat the above operation to deploy all ".mobileconfig" profiles.

      

      ^{Click the image to enlarge.}

   7. Check status on the mac machine, and verify if the Full Disk Access is already present on the Profiles.

      

      ^{Click the image to enlarge.}

To create an Apex One (Mac) profile using FileWave MDM:

1. Go to the FileWave Console to get started.
2. On the dashboard console, create a new desktop fileset:

   

   ^{Click the image to enlarge.}

3. Under System Extensions, provide the Apex One (Mac) agent identifiers to allow access to the Mac machines:

   Team Identifier	E8P47U2H32
   BundleID	com.trendmicro.icore.es,com.trendmicro.icore.netfilter

   

   ^{Click the image to enlarge.}

4. Add the allowed Security and Privacy settings as follows:
   • Full Disk Access:

     IDENTIFIER	com.trendmicro.icore
     CODE REQUIREMENT	identifier "com.trendmicro.icore" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32
     Receiver Identifier	com.apple.systemevents
     Receiver Code Requirement	identifier "com.apple.systemevents" and anchor apple

   • Apex One (Mac) agent UI:

     IDENTIFIER	com.trendmicro.tmsm.MainUI
     CODE REQUIREMENT	identifier "com.trendmicro.tmsm.MainUI" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32
     Receiver Identifier	com.apple.systemevents
     Receiver Code Requirement	identifier "com.apple.systemevents" and anchor apple

   • Apex One (Mac) Endpoint Sensor:

     Receiver Identifier	com.trendmicro.icore.es
     Receiver Identifier Type	Bundle ID
     Receiver Code Requirement	identifier "com.trendmicro.icore.es" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32

   • Apex One (Mac) Network Filter:

     Receiver Identifier	com.trendmicro.icore.netfilter
     Receiver Identifier Type	Bundle ID
     Receiver Code Requirement	identifier "com.trendmicro.icore.netfilter" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E8P47U2H32

   • Apple System Events:

     Receiver Identifier	com.apple.systemevents
     Receiver Identifier Type	Bundle ID
     Receiver Code Requirement	identifier "com.apple.systemevents" and anchor apple

   

   ^{Click the image to enlarge.}

5. Deploy the FileWave profile to the Mac machine and then deploy the Apex One (Mac) agents after. A restart is needed for the profile to take effect on the machines.