macOS direct-download apps prompt standard users for admin credentials during updatesSolved

Hello,

Thanks for reaching out to Hexnode Connect.

For macOS apps installed through Hexnode, the initial installation is performed with elevated privileges. However, some direct-download apps only install their helper tools, perform update checks, or replace application files when the app is actually launched by the user. When this happens, the updater runs in the standard user’s context, which is why macOS prompts for administrator credentials.

Here is a breakdown of the best approaches depending on the type of app:

1. VPP / App Store Apps

Yes, for apps available through Apple Business Manager or the App Store, assigning them as VPP apps and deploying them through a Required Apps policy is the recommended approach. In this workflow, Hexnode sends the app install and update commands through Apple’s native MDM framework. Since the update is managed by the MDM with elevated privileges, the end-user is never prompted for admin credentials.

2. Non-VPP / Direct-Download Apps

For non-VPP macOS apps, there is no universal Hexnode setting that can suppress every app’s built-in updater prompt, as the updater behavior is designed by the individual app vendors. However, you have two primary ways to handle them:

• Option A: Custom Configuration Profiles

  As you suggested, deploying a custom configuration profile is a highly effective and scalable alternative—if the application supports Apple’s managed preference framework. If the app reads settings through Apple’s standard preference system (such as NSUserDefaults), you can deploy the required preference keys using Hexnode’s Deploy Custom Configuration policy to disable auto-update prompts or configure updater behavior. Just note that these keys are app-specific, and not all vendors provide supported ways to disable their updaters via profiles.

• Option B: Custom Scripts

  If an app does not support managed preferences, your fallback option is to use app-specific commands or scripts to manually disable the built-in updater or install the required helper tools system-wide. These can be pushed using Hexnode’s Execute Custom Script action or via a policy-based script deployment.

In short: Stick to VPP with Required Apps wherever possible. For direct downloads, use app-supported managed preferences via a .mobileconfig first, and fall back to custom scripts only if the app lacks configuration profile support.

I hope this helps streamline your app update process. If you find any more issues or need further assistance, feel free to reach out.

Best regards,
George,
Hexnode UEM