Since the introduction of system extensions in macOS Catalina, Apple has been adding controls for both individual users and Mac admins to allow management of system extensions. For individual users who manage their own Macs without using MDM management, Apple asks the user to approve the system extensions functions. In turn, for managed environments, Apple has provided management profile options to allow Mac admins to pre-approve or block system extensions from running on the Macs in that environment.

As part of the release of macOS Sequoia, Apple has added new user functionality for managing system extensions, as well as management profile options for Mac admins. For more details, please see below the jump.

The new functionality is the ability to manage installed system extensions via System Settings, with the relevant controls being found in System Settings: General: Login Items & Extensions. As an example, let’s look at the LuLu open-source firewall app. This app uses a network extension and a content filter.

On macOS Sonoma, the following management profiles can be deployed to allow LuLu’s network extension to be deployed and removed without the user being prompted.

Profile to allow deployment and removal:

Profile to configure the content filter:

On macOS Sequoia, the new functionality referenced earlier is not managed by either profile. Instead, if you look at System Settings: General: Login Items & Extensions, you should see a Network Extensions entry in the Extensions section.

When you click on the (i) option for the Network Extensions entry, you should see controls like what’s shown below. These controls include the ability to disable the system extension.

To manage this new functionality, Apple has added a new NonRemovableFromUISystemExtensions key to the existing com.apple.system-extension-policy payload for managing system extensions. The following management profile can be deployed to macOS Sequoia Macs to prevent the user from being able to disable the LuLu network extension.

Once deployed, the user controls available via the Network Extensions entry will be grayed out and the user will not be able to change those settings.

Note: Something to be aware of is that the NonRemovableFromUISystemExtensions key only works on macOS Sequoia and older versions of macOS, including macOS Sonoma, will ignore it. This means that deploying profiles which use this NonRemovableFromUISystemExtensions key to older versions of macOS will not result in the new management settings being applied to macOS Sequoia when the Mac is upgraded to run macOS Sequoia. Instead, profiles which use this NonRemovableFromUISystemExtensions key should only be deployed to macOS Sequoia as of this time.