Overview

The Apple System Policy Control Policy manages Gatekeeper on company-owned Macs. Gatekeeper is Apple's built-in protection that checks apps before they open, and blocks apps that aren't from the Mac App Store or a developer Apple has identified. With this policy you can:

keep Gatekeeper turned on
choose which apps Gatekeeper allows: the Mac App Store only, or the Mac App Store and identified developers
stop users from overriding Gatekeeper to open an app it blocked

Important: To stop users from bypassing Gatekeeper, turn on Disable Gatekeeper Override. Enable Gatekeeper keeps Gatekeeper on, but users can still open a blocked app with Open Anyway in System Settings > Privacy & Security. Disable Gatekeeper Override stops that. Security frameworks that require "Gatekeeper end-user override disabled", such as SSC-1 (Security Services), need both settings.

Supported platforms and requirements

Item	Details
Platform	macOS 10.8 or later
Device ownership	Company-owned devices
Supervision	Not required
User Enrollment (BYOD)	Not supported

Settings reference

Setting	What it does	Default
Enable Gatekeeper	On: Gatekeeper checks apps before they open. Off: Gatekeeper is turned off, and the Mac no longer blocks apps from unidentified developers.	On
Allow Identified Developers	On: Gatekeeper allows apps from the Mac App Store and identified developers. Off: Gatekeeper allows only Mac App Store apps.	On
Disable Gatekeeper Override	On: users can't override Gatekeeper to open a blocked app. Open Anyway in System Settings > Privacy & Security no longer opens the app. On macOS 14 and earlier, it also turns off Open in the Finder's Control-click menu.	Not set

Allow Identified Developers and Disable Gatekeeper Override only work while Enable Gatekeeper is on.

What "identified developers" means

Identified developers are developers who sign their apps with an Apple Developer ID certificate, and have Apple notarize them. Most business software that isn't in the Mac App Store, such as browsers, collaboration tools, and security agents, comes from identified developers.

Turn off Allow Identified Developers only if every app your users need comes from the Mac App Store or is deployed by Swif.

Gatekeeper and apps deployed by Swif

Gatekeeper checks apps when users open them. Before you turn off Allow Identified Developers or turn on Disable Gatekeeper Override, make sure the apps you deploy are signed and notarized. Otherwise, users may not be able to open them.

Before you start

List the apps your users need, and check where each comes from: the Mac App Store, an identified developer, or neither.
Find any unsigned or unnotarized apps. With Disable Gatekeeper Override on, users can't open them. Replace them, or ask the vendor for a signed version.
Check your compliance requirements. If your framework requires Gatekeeper end-user override to be disabled, plan to turn on Disable Gatekeeper Override.
Choose a pilot group of Macs.

Create the policy

In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select System Policy Control Policy.
Enter a clear name, such as Mac Gatekeeper – Strict.
Keep Enable Gatekeeper on.
Set Allow Identified Developers.
Turn on Disable Gatekeeper Override if users shouldn't be able to open blocked apps.
Save the policy.
Assign it to a device group of Macs.

Example configurations

Example 1: Recommended for most company Macs

Setting	Value
Enable Gatekeeper	On
Allow Identified Developers	On
Disable Gatekeeper Override	On

Users can open Mac App Store apps and apps from identified developers, but can't open blocked apps. This meets "Gatekeeper end-user override disabled" requirements.

Example 2: Mac App Store only

Setting	Value
Enable Gatekeeper	On
Allow Identified Developers	Off
Disable Gatekeeper Override	On

Users can open only Mac App Store apps. Use this only where all other software is deployed and tested by IT.

Example 3: Gatekeeper on, overrides allowed

Setting	Value
Enable Gatekeeper	On
Allow Identified Developers	On
Disable Gatekeeper Override	Not set

Gatekeeper warns users about blocked apps, but they can still open them with Open Anyway. Use this for developer Macs that need to run their own unsigned builds.

Not recommended: Enable Gatekeeper off. Turning off Gatekeeper lets any app open without checks. Use it only for short, controlled exceptions, such as a lab Mac.

Verify the policy

On the Mac:

Open System Settings > General > Device Management and open the Swif profile. Confirm that it includes the Gatekeeper settings.
Open System Settings > Privacy & Security and check Allow applications from. It should match the policy, and users shouldn't be able to change it.
Run this in Terminal. With Enable Gatekeeper on, it should return assessments enabled:
```
spctl --status
```
If Disable Gatekeeper Override is on, try opening an unsigned test app. It should be blocked, and Open Anyway shouldn't open it.

In Swif, open the device and confirm that the policy shows as applied.

Troubleshooting

Users can still open blocked apps

Turn on Disable Gatekeeper Override. Enable Gatekeeper alone doesn't stop users from choosing Open Anyway.
Check that Enable Gatekeeper is on, since the override setting only works while Gatekeeper is on.

Users can't open an app they need

Check whether the app comes from an identified developer. If it does, turn on Allow Identified Developers.
If the app is unsigned and Disable Gatekeeper Override is on, users can't open it. Ask the vendor for a signed, notarized version, or assign a policy without the override setting to the Macs that need it.

The Allow applications from setting can't be changed

This is expected. The policy manages it.

spctl --status shows assessments disabled

Enable Gatekeeper is off in a policy assigned to the Mac, or the profile hasn't applied. Check the device's policies in Swif.

Related resources

Swif

Apple