Can a script grant macOS screen recording permission?

No. Screen recording is a TCC privilege. It can be granted only by a human in System Settings or by an MDM PPPC configuration profile. There is no command that grants it.

What is a PPPC profile?

Privacy Preferences Policy Control. An MDM payload that pre-approves specific apps for specific privacy-protected capabilities, including screen recording, so no per-machine click is needed.

Does the Mac need to be in MDM before it is useful?

For screen recording at scale, yes. The machine must be enrolled in MDM so the PPPC profile can be pushed. That is why enrollment, not the app install, is the gating step.

← blog

Granting screen recording at fleet scale with an MDM profile

October 4, 2026 · 6 min read

A Mac we rent out shows the customer its screen in a browser tab. For that to work, the screen-sharing service needs permission to record the screen. macOS guards that permission tightly, and the guard is the one thing in our whole setup that a script cannot open. Here is why, and how you get past it without a human touching every machine.

The failure this prevents is the black screen we wrote up in the Mac that logs you in and shows you nothing. This post is the fix at scale.

Why a script cannot do it

Screen recording is a TCC privilege, part of the same system that asks "allow this app to access your camera?". Apple deliberately puts these behind a human or a trusted management channel. There is no tccutil grant for it. A script that enables the Screen Sharing service starts a daemon that listens, authenticates, and then has nothing it is allowed to capture.

Script enables the service

Daemon runs, port 5900 open

Screen recording not granted

Black framebuffer

The service starts. The privilege does not.

Two ways to grant it

By hand, one machine

·System Settings, General, Sharing

·Toggle Screen Sharing off then on

·Authenticate as an administrator

·Fine for one or two machines

·Does not scale, needs someone at the Mac

By MDM, any number

·Push a PPPC configuration profile

·Pre-approves the service for screen recording

·No per-machine click

·Survives wipes and reinstalls

·Requires the Mac to be enrolled in MDM

What the profile contains

A PPPC profile is a signed payload that names an app or service and the privacy capabilities it is allowed. For the browser-desktop case the payload grants ScreenCapture to the screen-sharing service. The service is identified by its code signature, so the grant cannot be borrowed by something else.

Enroll the Mac in MDM

This is the real prerequisite. Until the machine is enrolled, there is no channel to push a profile, so screen recording stays a manual toggle.

Author the PPPC payload

Name the screen-sharing service by its code-signing identifier and grant the ScreenCapture service. Sign the profile so macOS accepts it silently.

Push it at enrollment

Deliver the profile as part of the enrollment set, so a freshly imaged Mac comes up already permitted.

Verify by pixels, not by tools

Sample the framebuffer and count colours. A tool's exit code cannot tell a granted machine from a denied one; the picture can.

The takeaway

If your automation assumes it can configure everything on a Mac, TCC is where that assumption breaks. Screen recording, accessibility, and full disk access all sit behind the same wall. On one machine you click through it. At scale the answer is MDM. The practical consequence is that enrollment, not software installation, is the step that decides whether a machine is really ready.

Questions

Can a script grant macOS screen recording permission?: No. Screen recording is a TCC privilege. It can be granted only by a human in System Settings or by an MDM PPPC configuration profile. There is no command that grants it.
What is a PPPC profile?: Privacy Preferences Policy Control. An MDM payload that pre-approves specific apps for specific privacy-protected capabilities, including screen recording, so no per-machine click is needed.
Does the Mac need to be in MDM before it is useful?: For screen recording at scale, yes. The machine must be enrolled in MDM so the PPPC profile can be pushed. That is why enrollment, not the app install, is the gating step.

Run your own numbers on the calculator or lease a runner.