The macOS Client User Interface

Introduction

The user interface is graphical and is accessed via the icon menu in the menu bar (top right) of the screen.

The color of the icon depends on the currently logged-in user: if the user is an administrator, the icon is red, whereas if the user is a standard user, the tray icon is black:

Click the icon to display the menu and select About Admin By Request for further information (Administrator and Standard User) or Request Administrator Access to carry out an admin task (Standard User only):

In this topic

About Admin By Request

Submitting Diagnostics

Using Run As Admin

Requesting Administrator Access

Setting-up a Break Glass Account

About Admin By Request

Once installed, Admin By Request is running in the background for as long as the endpoint is powered-on. Selecting the app from the menu bar or the dock launches the user interface, which comprises a simple window with four buttons down the left-hand side:

The default panel is About Admin By Request, which is accessed via the top button. It shows the current workstation edition, license details, website link, and copyright information.

Click the About button to get back to this panel if viewing one of the other panels.

Submitting Diagnostics

Diagnostic information is available on each endpoint that has Admin By Request installed. The details recorded help IT administrators and the Admin By Request support team to troubleshoot issues that might be occurring.

The following data is recorded and submitted:

  • Current system configuration

  • Errors from the system log

  • Admin By Request-related crash logs

  • Admin By Request service log

To send diagnostic information about how Admin By Request is running on this workstation, select the Diagnostics button on the About Admin By Request panel and click Submit Diagnostics Data.

The button changes to text Diagnostics submitted, indicating that diagnostics have been sent for analysis:

NOTE:

It's a good idea to submit diagnostics when raising a support ticket for a new issue. The Admin By Request support team will frequently ask for diagnostics when responding to tickets if the information is not already available.

Using Run As Admin

Run As Admin (also known as App Elevation) allows for the elevation of a single application.

This capability negates the need for users to initiate an Admin Session. Elevating privileges for execution of a single file is the much safer option compared to elevating the user’s privileges across the endpoint.

IMPORTANT:

Some Mac applications (e.g. Grammarly and Spotify) require wide-ranging permissions to install properly and can only be successfully installed via an Admin Session. Further, these applications almost always require the same wide-ranging permissions when they auto-upgrade, meaning that another Admin Session must be started before upgrading the app.

This is simply due to the nature of how processes work on the macOS operating system. When attempting to run an installation or upgrade via Run As Admin, a pop-up window prompting for admin credentials will be triggered by the OS whenever a separate executable that handles access to another area of the file system is invoked. At the time of writing, the only way around this is to carry out the installation or upgrade via an Admin Session.

A standard user executing a program that requires elevated privileges initiates the following sequence of events:

  1. Download the package or application file for installation.

  2. Start the installation (e.g., by double-clicking the downloaded package):

  3. Admin By Request suspends installation and asks for phone, email, and reason. Enter these details and click OK to continue.

  4. A notification now advises that the request for approval has been sent. When the request is approved, a further notification advises the request has been approved:

  5. Now the installer has the elevated privileges required to run, but it still needs authorization from the current user. Start the installation a second time, supply credentials for the current user (who will be a standard user) and click OK to start authorized installation with elevated privileges.

The elevated privileges last only for the duration of the install and apply only to the particular application or package authorized.

NOTE:

For any .app file, initiate Run As Admin by dragging and dropping the application file over the Admin By Request Dock icon. At the account control pop-up, enter credentials and hit OK to run the installer as an administrator. Note that this works only for .app files; it does not work for .pkg files.

Check the audit log in the portal for details on the user, the endpoint, the application run and execution history.

Requesting Administrator Access

Requesting administrator access is also known as requesting an Admin Session, which is a time-bound period during which a standard user has elevated privileges and can carry out administrator-level tasks..

As with About Admin By Request, click the menu bar icon to display the menu and select Request administrator access:

Submitting a request for administrator access is the primary mechanism for gaining elevated privileges.

A standard user making this selection where approval is required initiates the following sequence of events.

  1. A prompt asks “Do you want to start an administrator session?”. The user clicks Yes to continue:

  2. An empty Request Administrator Access form appears:

  3. The user enters email, phone and reason information into the form and clicks OK.

    NOTE:

    Settings in the portal control the full extent of what is displayed to the user:

    • If Code of Conduct is enabled, the user must acknowledge a Code of Conduct pop-up to continue (Portal > Settings > Workstation Settings > macOS Settings > Endpoint > INSTRUCTIONS).

    • If Require approval is OFF, the approval steps are skipped (Portal > Settings > Workstation Settings > macOS Settings > Authorization > AUTHORIZATION > Admin Session).

  4. The request is submitted to the IT administration team and the user is advised accordingly:

  5. The IT administration team is notified via the Admin By Request portal that a new request for administrator access has arrived.

    The following example shows how two new requests might appear in the portal:

  6. One of the team either approves or denies the request. If approved, the user is advised accordingly:

  7. The user clicks Yes, which starts the session and displays a countdown timer:

  8. The duration of an admin session is set via the portal (15 minutes in this example) and the countdown timer ticks down to zero, at which time the session ends. The user can optionally end the session at any time once it has started by clicking Finish.

See Changing Admin Session Duration for more information on changing the duration of the countdown timer.

During an Admin Session, users can install programs requiring admin rights, install drivers and change system settings other than user administration. All activity during the elevated session is audited, so you can see in the audit log the reason why the person needs the elevation; anything installed, uninstalled, or executed.

IMPORTANT:

During an Admin Session, users cannot uninstall Admin By Request, or add, remove or modify user accounts.

Setting-up a Break Glass Account

The Break Glass feature extends the functionality of MS LAPS. It creates a new, temporary, one-time-use Administrator account on an endpoint, that works on domains, Azure AD, and stand-alone, which audits all elevated activity, and terminates within a pre-defined amount of time or on log out.

Using the Break Glass feature

Setting-up and using a Break Glass account comprises three tasks:

Refer to Features > Break Glass / LAPS for more information on the feature.