Tamper Protection: When enabled, the Agent is shielded from unauthorized removal, file deletion, or modification by local users, even those with administrator privileges.

Supports both Stealth and Revealed Agents: Protection works identically regardless of Agent type.

Zero-Configuration Operation: Protection arms automatically once the installer runs. No post-install setup, no policy files or complex configurations required. Disarming and re-arming are handled entirely through authorized uninstall flows.

Kernel-Level Enforcement: Protection is enforced by the Endpoint Security framework, ensuring it remains active even if other Agent components are interrupted.

Owner-Based Access Control: Only the user who originally installed the Agent can perform updates or uninstalls without a password. All other local users must provide a valid password to uninstall.

Seamless Maintenance: Server-driven updates, and auto-updates continue to work without interruption.

MDM-Ready: Fully compatible with MDM solutions. Deploy the protected installer package silently with no console user required - protection arms automatically and management is restricted to server-driven flows.

How to protect your Agent installation from tampering (Mac)

How to uninstall a Protected Agent (Mac)