macOS provides a powerful subsystem called the I/O Kit — a collection of frameworks and tools the OS uses to communicate with hardware. It maintains a registry of all hardware and devices connected to or built into the Mac.
IT administrators can query the I/O Kit registry to gather detailed system information such as hardware model, serial numbers, and platform identifiers. This is commonly used for asset management, warranty lookups, and device provisioning during MDM enrolment.
The ioreg command-line utility is the standard way to access this registry. By querying a specific device class (such as IOPlatformExpertDevice), admins can retrieve structured hardware information. This is a read-only, non-destructive operation used routinely in IT workflows.
TCC is one of macOS's most important privacy frameworks, introduced in macOS Mojave (10.14). It controls which applications are allowed to access sensitive system resources and user data. Every time an app tries to access the camera, microphone, contacts, or location, TCC steps in to request the user's permission.
These permissions are stored in a SQLite database maintained by the OS. There are two separate TCC databases — one for the current user and one system-wide — each storing a record of which applications have been granted or denied access to specific services.
For IT admins: In managed environments, TCC permissions can be pre-approved and pushed via MDM using Privacy Preference Policy Control (PPPC) profiles. This prevents permission prompts appearing when deploying corporate tools like endpoint agents, screen sharing utilities, or monitoring software.
Every macOS application is packaged as a .app bundle — a directory that appears as a single file in Finder but contains a structured hierarchy of resources. Understanding this structure is essential for IT admins who deploy, troubleshoot, or audit applications.
The Info.plist is particularly important — it declares the app's bundle identifier, entitlements, minimum OS version, and the privacy usage descriptions shown in TCC prompts. Admins should inspect this file before deploying unfamiliar software.
The macOS Keychain is the OS's built-in secure credential store. It holds passwords, certificates, encryption keys, and secure notes in an encrypted database, accessible only to authorised applications with the correct entitlements and user consent.
For IT admins: The Keychain Access app (in /Applications/Utilities/) and the security CLI tool are the standard ways to inspect and manage keychains. Common use cases include certificate management, Wi-Fi troubleshooting, and PKI administration. Jamf Pro can push certificates directly into the System Keychain via Configuration Profiles.
macOS uses a layered trust system to verify that software is legitimate before allowing it to run. Understanding these layers helps IT admins manage approved software, troubleshoot installation errors, and set the right MDM policies.
macOS provides structured mechanisms for software to run automatically at login or in the background. IT admins need to understand these to manage startup behaviour, troubleshoot slow logins, and audit what is running persistently on managed devices.
For IT admins: Jamf Pro and other MDM platforms can audit LaunchAgent and LaunchDaemon directories via extension attributes and scripts, helping identify unexpected persistence or unwanted software.
Modern macOS is defended by several overlapping security frameworks that restrict what software can do, even with admin privileges. Understanding these is essential for IT admins deploying security tools, kernel extensions, or system-level agents.
IT support teams regularly need to locate browser data and system diagnostic logs when troubleshooting user issues. Below is a reference for where macOS stores this data.