Mac Agent 26.36 introduces a consent pop-up in the standard agent installer, behavior-rule monitoring for Microsoft Copilot Web, and website monitoring on macOS 27 without the Accessibility permission - plus security hardening and a set of fixes.
New: Website Monitoring without the Accessibility Permission on macOS 27
On macOS, the Teramind agent can now track the active website's URL and page title without the Accessibility permission.
Before this release, active website monitoring on macOS needed the Accessibility permission, which can't be granted silently. Now the agent can get website activity through its network monitoring component. That makes it easier to deploy and keeps website tracking working on endpoints where Accessibility isn't granted.
How to turn it on:
Grant the agent the permissions it needs. At minimum, this is Network Monitoring.
Set this agent configuration parameter: website-monitor-inject=1
Recommendations:
Enable Full Disk Access for the agent's System Monitoring component (manually in System Settings or via MDM using a .mobileconfig profile - see the article link below). This prevents local network permission prompts on browsers like Google Chrome.
Your browsing experience shouldn't change noticeably with this feature turned on.
To learn more:
New: Consent Pop-Up in the Standard Agent Installer
The Standard Agent's new installer shows a consent pop-up on first installation, so end users are clearly informed when monitoring is installed on their Mac.
New: AI Usage Rules for Microsoft Copilot Web
We’ve added support for behavior rule enforcement for Microsoft Copilot Web on macOS endpoints. Admins can now create LLM content-sharing rules with Copilot Web as the selected LLM Source, matching on prompt body text and AI model, with Block, Warn, and Lock Screen actions. Outgoing prompts are intercepted on Copilot Web's real-time channel and file attachments are blocked on the upload path before data reaches the AI server. Enforcement works across all Copilot account types.
Note: You can use the “Text” content type from the Content tab when using this rule.
Security Fixes
Remote Control Hardening: A remote control session now starts only after an explicit, authorized command from the Teramind server; all other incoming keyboard/mouse control input is ignored.
Installer Permission Hardening: File and directory permissions set by the installer are now locked down on fresh installations and upgrades.
Bug Fixes:
Fixed an issue where the updated network monitoring certificate (introduced in 26.30) was not installed when upgrading from a version with the legacy certificate - the agent kept using the old certificate authority.
Fixed an issue where uninstalling the agent did not remove the legacy network monitoring root certificate from the System keychain.
Fixed a Chrome crash when opening the bookmarks bar.
Fixed a sporadic agent crash related to browser monitoring.
Fixed an issue where keyboard and mouse activity was reported as zero while time was still tracked, until the Mac was put to sleep or the agent was restarted.
Fixed a one-time "Allow System Monitoring to find devices on local networks?" pop-up appearing when accessing a local IP address in a browser, even though the permission was already granted via the MDM profile (regression since 26.12).
Also in This Release
Action Required for MDM Deployments
The certificate used by Network Monitoring has been updated and is now distributed as a new .mobileconfig profile. If you deploy the Mac agent through an MDM such as Jamf, you must replace your existing MDM configuration with the new TLS certificate profile on agents running version 26.30 or newer. To update, download the new TLS Certificate mobileconfig file and deploy it via your Configuration Profiles. For the profile download and step by step instructions, see the updated guide: How to install the Mac agent remotely using Jamf.