1. If you haven't already, login to the Admin By Request portal.

2. In the portal, click the Download menu link to download the Mac endpoint client and store the file in a suitable location:
   

   

3. Click (or double-click) the downloaded package to begin the installation.

   The package runs a check to determine if Admin By Request can be installed:

   

4. Allow and Continue with the installation, providing Administrator credentials if necessary:

   

5. When done, close the installer and (optionally) move the installer package to the bin:

   

   The user experience on first-time use

   A number of things occur once Admin By Request is installed:

   1. The Admin By Request icon will be red initially (indicating elevated rights), but it will then change color (to black or white) as admin rights are removed.

      This occurs without needing a restart. An important consequence is that any operations requiring elevated privileges from now on need admin credentials, including responding to the Login Items & Extensions prompt coming up next (only a consideration for single endpoint installs - does not apply to MDM installations).

      Also does not apply if local admin rights are not revoked or if the user installing is listed in the excluded accounts (see portal setting Endpoint Privilege Management > Settings > Mac Settings > Lockdown > ADMIN RIGHTS).

   2. Several prompts appear, requesting authorization from the logged-in user.

      The first of these is the endpoint security extension prompt. When this appears, click Open System Settings:

      

   3. In Login Items & Extensions, enable the Admin By Request System Extension and click Done:

      

   4. From Admin By Request version 5.2, if the endpoint is enrolled in Secure Remote Access (portal setting Settings > Product Enrollment > SECURE REMOTE ACCESS - see Product Enrollment Example 2 for a scope example), an Accessibility Access prompt will appear:

      

      When this appears, click Open System Settings, go to Privacy & Security > Accessibility and enable Admin By Request SRA:

      

      This is a first-use, one-time-only prompt raised by the macOS operating system that allows Admin By Request SRA to run on the endpoint.

      NOTE
      

      • If installing Admin By Request via MDM and the endpoint is enrolled in Secure Remote Access at the time of installation, this prompt will not appear.

      • If the endpoint is not enrolled in Secure Remote Access, this prompt will not appear. However, if the endpoint is enrolled at some point in the future, the prompt will appear the first time a user logs in after enrollment.

   5. When the Screen Recording prompt appears, click Open System Settings:

      

      In Screen & System Audio Recording, enable Admin By Request:

      

Installation is now complete. Keep System Settings open and go to the next step, which is to ensure that Full Disk Access (FDA) is enabled for Admin By Request.

Following installation of the endpoint client, both the adminbyrequest executable and the Admin By Request System Extension need full disk access.

• adminbyrequest - The main app for enabling Admin By Request endpoint client features, including the ability to drag a file over the ABR icon in the dock to elevate privileges.

• Admin By Request System Extension - The extension app provides a range of functionality; the main feature being the ability to install an app by dragging its icon over the Applications folder (which also requires operating system version macOS 11+).

The installation process should correctly configure Full Disk Access for both - if it does not, or if you wish to check, use the following procedure.

The procedure to enable FDA is slightly different for different macOS versions. The following steps describe how to enable FDA on endpoints running macOS 11 (Big Sur) and macOS 12 (Monterey), and then for endpoints running macOS 13 (Ventura) through macOS 26 (Tahoe).

macOS 11 (Big Sur) and macOS 12 (Monterey)

1. On your Mac device, navigate to System Preferences > Security & Privacy > Privacy tab and select Full Disk Access from the list. You’ll need to supply your password to unlock and make changes.

2. Select both adminbyrequest and Admin By Request System Extension in the list of apps (i.e. ensure the boxes are checked):

   

3. Lock the tab to save changes and close the System Preferences window.

macOS 13 (Ventura) through macOS 26 (Tahoe)

1. On your Mac device, navigate to System Settings > Privacy & Security tab and select Full Disk Access from the list. You’ll need to supply your password to unlock and make changes.

2. Enable the Admin By Request System Extension:

   

3. Drag and drop the adminbyrequest executable from Finder into the Full Disk Access list in System Settings. Note that this step is not required in macOS 26.3 or above.

That completes the requirements for enabling both the Endpoint Privilege Management and Secure Remote Access components of Admin By Request.

To test that Admin By Request is working properly, login to a Mac as a standard user and attempt a task that requires elevated privileges (such as modifying Users/Groups) to test that the product is working.

Refer to Using Run As Admin and Requesting Administrator Access for more information on tasks that require elevated privileges.

The important step in this procedure is the last one - deploy the config profile. Skip the rest of this procedure unless you want to understand how the Admin By Request config files were created.

The config files supplied were built in Jamf as follows:

1. In Jamf, go to Computers > Configuration Profiles.

2. Create a new profile and configure it as follows:

   1. Name: give the profile a name that helps explain what application it is giving rights to. In this example, we use ABR - PPPC.

   2. Category, select Applications.

   3. Distribution Method, select Install Automatically.

   4. Level, select Computer Level.

3. Navigate from the General tab to the Privacy Preferences Policy Control tab:

   1. Identifier, enter /Library/adminbyrequest/adminbyrequest.

   2. Identifier Type, select Path.

   3. For Code Requirement, enter the following line of code:

      Copy

      anchor apple generic and identifier "com.fasttracksoftware.adminbyrequest.extension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = AU2ALARPUP)

      IMPORTANT

      The code snippet is all one line. Use the Copy button in the top right corner of the code box to copy the code to the clipboard.

      For example:

      

   4. Under App or Service, select SystemPolicyAllFiles and under Access, select Allow:

      

      Under App or Service, select Accessibility and under Access, select Allow.

   5. For Code Requirement, enter the following line of code:

      Copy

      identifier "com.fasttracksoftware.adminbyrequest" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = AU2ALARPUP

      IMPORTANT

      The code snippet is all one line. Use the Copy button in the top right corner of the code box to copy the code to the clipboard.

      For example:

      

   6. Save the profile.

4. Deploy the profile using Jamf (or your MDM) to allow the System Extension and enable FDA for all your macOS endpoints.

This procedure describes how to create and deploy an Admin By Request installation package.

Make sure that deployment of the installation package comes after deployment of the Admin By Request config files.

1. Sign-in to your Admin By Request account at https://www.adminbyrequest.com/Login.

2. Download the Mac client from the Download page and store the client file in a suitable temporary location.

3. In Jamf, go to Settings > Computer Management > Packages.

4. Click New and enter a Display Name (e.g. ABR 5.0.0).

5. Click Choose File and browse for the PKG downloaded from the ABR portal:

   

6. Click Save.

7. Now create a new policy in Jamf.
   Enter the Display Name from step 3 above and choose the relevant trigger for your deployment:

   

8. Open Packages, and click Configure.

9. Select the package just created and click Save.

10. In Scope, choose the devices to which you want to deploy the ABR client.

11. Deploy the package.

To test that Admin By Request is working properly, login to a Mac as a standard user and attempt a task that requires elevated privileges (such as modifying Users/Groups) to test that the product is working.

Refer to Using Run As Admin and Requesting Administrator Access for more information on tasks that require elevated privileges.