Overview

The AutoElevate macOS agent brings privilege management to your Macs: it registers the device with AutoElevate, applies your policy, and brokers elevation requests from standard users. It installs as a signed .pkg and runs as a system-wide launch daemon with a small per-user menu app.

Before You Install

• macOS 14 (Sonoma) or later. The installer checks the version first and stops with AutoElevate requires macOS 14 or later on anything older.
• Administrator rights on the Mac. The package installs a root launch daemon, so the install must run as an admin (or under sudo from your RMM).
• Your AutoElevate license key, plus the client company and location the machine belongs to. If either name does not already exist in the Admin Portal, it is created for you.
• Outbound HTTPS (port 443) to the AutoElevate endpoints. If you filter outbound traffic, see Firewall Whitelisting (AutoElevate).
• No portal setting to switch on. The Mac installer and the Mac install command are always available in the portal.

Get the Installer

The download always resolves to the current released Mac build, so you never need to hunt for the newest file — bookmark either path and you get today's installer.

From Settings

1. In the Admin Portal, open the Settings tab.
2. In General Info at the top of the page, find Mac Agent and click Download.

From a location's Installer Information

1. Open the Companies tab and click the View (eye) icon next to a company.
2. Click View Installer Information (the papers icon next to the location).
3. Expand For Mac Installation. You get Download PKG, Copy Download Link, and the ready-made install command with Copy Command.

Installation Methods

Scripted install (recommended)

Use this for RMM deployment and for any at-scale rollout. The copied command is self-contained: it downloads the installer, supplies the license key, company and location, installs the package, and cleans up after itself. There is nothing to open by hand.

1. From the Admin Portal, open the Companies tab.
2. To create a new company, click the + button at the top of the screen, enter a Company Name and initials, and click Save.
3. To create a new location, click the + button and enter a location name, then click Save. Locations are machine groups — they can be actual sites or any other grouping, such as Laptops or Desktops.
4. Once the location exists, click View Installer Information (papers icon next to the selected location) → For Mac Installation → Copy Command.
5. Run the command on the target Mac, or paste it into your RMM's script runner.

To read the command for a company that already exists, go to Companies → View (eye icon) next to the company → View Installer Information (papers icon next to the location) → For Mac Installation → Copy Command.

Treat the copied command as a secret. It contains your organization's license key. Keep it out of tickets, chat and shared documents, and store it in your RMM the way you store other credentials.

Manual install

Use this for a handful of machines, a test box or a demo. It is also the fastest way to verify a company and location before you script anything.

1. Download the PKG (see above) and copy it to the Mac.
2. Double-click the package and follow the macOS installer.
3. When the Configure AutoElevate dialog appears, fill in all three fields and click Link:
   • License Key — from the Admin Portal, Settings → General Info → License Key → Copy to Clipboard.
   • Company Name — the client company, for example Contoso, Inc.
   • Location Name — the machine group, for example Laptops, Denver or Main Office.

Note: If the company or location does not already exist in the Admin Portal, it is created automatically. Link stays disabled until all three fields have a value, and Cancel ends the install without enrolling.

Unattended install with a configuration file

Use this when your management tool copies files and then installs a package, and you would rather not paste a shell command. Write /tmp/AEInstaller.conf before the install with one Key=Value per line:

LicenseKey=YOUR-LICENSE-KEY
CompanyName=Contoso, Inc.
LocationName=Laptops

Then install the package normally, for example sudo installer -pkg AEInstaller.pkg -target /. When the file is present and complete, the installer reads it and never prompts. If it is missing or a value is blank, the Configure AutoElevate dialog appears instead — which will stall an unattended run, so verify the file first. Keep the file readable only by root; it holds your license key.

Existing Addigy partners

Addigy is no longer part of installing the Mac agent. The setting formerly called macOS Support still exists as Settings → Agent Customizations & Behavior → Legacy Addigy Integration (previously macOS Support), and it only matters if you already use the Addigy integration — leave it alone for new deployments. To configure or review that integration, see Existing Addigy Customers in macOS Support & Elevated Sessions

After Installation

The install puts three things on the Mac:

• The launch daemon in /Library/Application Support/CyberFOX/AutoElevate/, loaded from /Library/LaunchDaemons/com.cyberfox.AutoElevate.plist and set to start at boot.
• The AutoElevate menu app at /Applications/AutoElevate.app, registered per user so it appears in the menu bar for whoever logs in. Standard users can request an elevated session from it.
• One AutoElevate entry in System Settings → Login Items & Extensions — both the daemon and the menu app group under it, so users see a single row with the AutoElevate icon rather than two technical names.

To confirm the agent is healthy:

1. On the Mac, run sudo launchctl list | grep com.cyberfox.AutoElevate — a listed job means the daemon is loaded.
2. Look for the AutoElevate icon in the menu bar of a logged-in user session.
3. In the Admin Portal, open the Computers grid. The Mac appears alongside your Windows machines; the Platform and Operating System columns identify it.

For what technicians and end users do next — requesting, approving and cancelling elevated sessions — see macOS Support & Elevated Sessions.

Keeping Agents Updated

You do not re-run the PKG to update. Once a Mac is enrolled, the agent updates itself: on check-in, AutoElevate works out which build the machine should be running for its release channel and pushes the update.

• Channels are Stable (the default) and Beta. The organization-wide default is the Agent Update Channel setting under Settings → Agent Customizations & Behavior, and the Computers grid has an Agent Update Channel column showing what each machine follows. A computer with no channel set anywhere follows Stable.
• The channel is resolved most specific first: a per-computer override wins, then location, then company, then the organization-level setting.
• Updates are released in stages, so a new version may not reach every company or computer at the same time, and the newest version may not be installed at the next check-in. Agents are never automatically downgraded to an older version.
• To change the Agent Update Channel from the Computers screen, your role needs both Computer Edit and Setting Edit permissions.

Uninstallation

Uninstalling is straightforward, from the Admin Portal or from the command line.

Method 1: Using the Admin Portal

1. Open the Admin Portal.
2. In the Computers section, find the computer you want to uninstall.
3. Click the Trash Can icon next to the computer's entry.

For bulk uninstallation:

1. Filter or group computers by a specific company or type.
2. Select the checkboxes next to the computers you want to uninstall, or use the top checkbox to select all computers.
3. Click the Actions button at the top.
4. Choose the Delete action and confirm when prompted.

This removes the computer from the Admin Portal and triggers each agent to perform a silent uninstall.

Method 2: Using a command line

You must be an admin. Run:

sudo "/Library/Application Support/CyberFOX/AutoElevate/uninstall"

The command returns immediately — it asks the agent to uninstall itself rather than doing the removal inline. The daemon then revokes any active elevated-session admin rights, removes the menu app, tells the portal the machine is gone, and deletes the launch daemon, its preferences, the /Library/Application Support/CyberFOX tree and the package receipt. Give it up to a minute to finish.

Deleting /Applications/AutoElevate.app is not an uninstall. The daemon puts the menu app back on its next pass. Use one of the two methods above.

Addigy and MDM: uninstalling AutoElevate leaves the Addigy agent and the Mac's MDM enrollment in place. AutoElevate first removes the temporary admin privileges it granted; if those privileges cannot be removed, the uninstall stops.

Troubleshooting

The installer stops immediately with a macOS version error

The package requires macOS 14 (Sonoma) or later, and refuses to install on anything earlier. Check the version with sw_vers -productVersion.

A double-clicked install failed and there was no error

A GUI install writes its failures to /var/log/install.log rather than showing them. Run sudo installer -pkg AEInstaller.pkg -target / from Terminal instead — the same failure is printed to the screen.

The setup dialog appeared during an unattended install

That is the fallback when /tmp/AEInstaller.conf is missing, unreadable by root, or missing one of LicenseKey, CompanyName or LocationName. Fix the file and re-run. A scripted install from Copy Command writes the file for you, so this points at a hand-built script.

Install was cancelled from the dialog

Clicking Cancel — or the dialog having no display to draw on, as in a headless SSH session — ends the install without enrolling. Use the scripted command or the configuration file for any install where nobody is at the screen.

The Mac does not appear in the Computers grid

Confirm the daemon is loaded with sudo launchctl list | grep com.cyberfox.AutoElevate, then check outbound 443 access (Firewall Whitelisting (AutoElevate)). Then check the enrollment details:

• Missing License Key, Company Name or Location Name: during a new installation the installer asks you to enter any missing information, and installation cannot complete without those values. If you are deploying through an RMM tool, use the Mac installation command from the Admin Portal.
• Wrong License Key: installation may finish, but the agent cannot register with AutoElevate if the license key is invalid. Re-run the installer with the correct key, and check the diagnostic logs if registration still fails.

Reading the agent's own logs

The agent writes to the macOS unified log under the subsystem com.cyberfox.AutoElevate. Open Console and filter by that subsystem, or view the last 15 minutes from Terminal:

sudo /usr/bin/log show --last 15m --style compact \
  --predicate 'subsystem == "com.cyberfox.AutoElevate"'

Note: Some diagnostic details may be hidden for privacy. For logs from an elevated session, see macOS Support & Elevated Sessions.

Stopping and starting the agent by hand

sudo launchctl bootout system "/Library/LaunchDaemons/com.cyberfox.AutoElevate.plist"
sudo launchctl bootstrap system "/Library/LaunchDaemons/com.cyberfox.AutoElevate.plist"

The uninstall did not complete

The agent will not tear itself down while it cannot safely revoke an active elevated session's admin rights — it stays installed and retries the same request the next time the daemon starts, rather than leaving a user with admin rights and no agent to take them away. If a machine stays enrolled after an uninstall request, check the agent's logs for a revoke failure and open a ticket with CyberFOX Support.

Security Notes

• The install command carries your license key. Anyone who has it can enroll machines into your tenant. Handle it like a credential.
• The configuration file is short-lived. A scripted install writes /tmp/AEInstaller.conf with root-only permissions, and the agent deletes it after enrollment. If you write the file yourself, restrict it the same way and remove it when the install finishes.
• The daemon runs as root and is the only component with privilege. The menu app runs unprivileged in the user's session and reaches the daemon over a code-signature-validated channel.
• The menu app lives in /Applications, which only admins can write, so a standard user cannot swap the bundle the agent launches.
• Elevation on macOS grants full administrator rights for the approved duration. Keep session durations short and review elevated-session activity — see macOS Support & Elevated Sessions.

Related Articles

• macOS Support & Elevated Sessions
• System Agent Installation
• Firewall Whitelisting (AutoElevate)
• Client On-Boarding Guide
• Web Admin Portal Overview
• Rule-Based Application Elevation on macOS (Beta)