The Apple Service Management Managed Login Items Policy allows administrators to preapprove background items used by managed applications on Mac devices.

The policy can automatically approve matched:

This helps required business, security, VPN, backup, monitoring, and developer applications run their background components without requiring users to approve each matched item manually.

Important: This is an approval policy. It automatically enables and allows items that match a configured rule. It does not block unmatched login items or background services.

On macOS 13 and later, Apple provides the Service Management framework to give users and administrators greater visibility into login items, launch agents, launch daemons, and other background tasks.

The policy contains one or more matching rules. When macOS discovers a login item or background item, it compares the item against all configured rules.

If the item matches any rule, macOS automatically approves it.

If the item does not match a rule, this policy does not approve or block it. The item remains subject to normal macOS behavior and any other applicable policy.

This policy does not:

Deploy any required application, PPPC profile, system extension profile, or network extension profile separately.

Before creating the policy:

Security warning: TeamIdentifier and LabelPrefix rules can approve multiple items. Use them only when you understand and accept the full scope of the match.

At least one complete rule is required. Every rule must include both Rule Type and Rule Value.

Recommended rule-selection order:

Determines which application or service attribute macOS uses for matching.

The available values are:

The identifier or label that macOS compares against the selected Rule Type.

The value must match the selected type. An incorrect identifier, extra character, or unintended prefix may cause the rule not to match or to approve more items than expected.

An optional human-readable description of the rule.

Recommended comment format:

Example:

Comments do not affect matching or enforcement.

Matches the application’s bundle identifier exactly.

Example:

Use this rule when you want to approve background items associated with one specific application bundle.

To retrieve an application’s bundle identifier:

Example:

The command should return a value similar to:

Verify the value on a trusted installation rather than copying an identifier from an unverified source.

Recommended use: Preferred when the application bundle is known and an app-specific rule is sufficient.

Matches the Apple Developer Team Identifier in the item’s code-signing information exactly.

Example format:

To retrieve the signing team identifier:

Example output:

A TeamIdentifier rule can match multiple applications and services signed by the same development team.

Security warning: This is broader than an exact bundle or label rule. Before using it, verify the developer identity and determine whether every applicable item signed by that team should receive automatic approval.

Recommended use: Trusted vendors whose approved product family contains several required components that cannot be managed reliably with narrower rules.

Matches the Label value of a launch agent or launch daemon exactly.

Example:

Common system locations include:

A user’s launch agents may also appear under:

To inspect a service property list:

You can also inspect the raw value with:

Recommended use: Preferred when approving one specific launch agent or daemon.

Matches any launch agent or daemon label that begins with the specified prefix.

Example:

This could match labels such as:

Security warning: Prefix rules can match more items than intended. Use the narrowest vendor- and product-specific prefix possible. Avoid generic prefixes such as com, com.vendor, or another value shared by unrelated applications.

Recommended use: An approved application with multiple verified services that consistently use one narrow label prefix.

macOS compares discovered items against all rules in the policy. Apple documents that an item matching a rule is automatically approved in its background task management guidance.

The rules operate as approval matches:

For example, a policy containing both of these rules approves any item matching either one:

Review the combined scope of all rules before deployment.

Use an exact application bundle identifier when it sufficiently covers the application’s registered background items.

This is more restrictive than approving every service from the vendor by prefix or signing team.

Use this only after confirming all labels that can match the prefix.

Use this broad rule only when the organization intends to approve all applicable items signed by the identified development team.

For company-owned Macs:

For BYOD Macs:

This policy changes system-level background-item approval. It does not create a separate macOS work profile.

Matched items are automatically enabled and allowed, but users may still see a macOS notification informing them that managed background items were installed. Users can view registered items under:

System Settings > General > Login Items & Extensions

The exact wording and placement can vary by macOS version.

On macOS 26 or later, Apple may prompt users when an app starts a background task that remains active after the app is closed. Apple states that applicable BundleIdentifier, BundleIdentifierPrefix, or TeamIdentifier rules can prevent this alert for matched managed items. Swif currently exposes BundleIdentifier and TeamIdentifier for this purpose. Learn more from Apple.

After assigning the policy:

The output includes known login and background items and loaded Service Management payload identifiers.

The output of sfltool dumpbtm may contain application and user information. Review and redact it before sharing it outside your organization.

Verify the installed application’s identifier:

Confirm that:

Verify the code-signing information:

If no TeamIdentifier is returned:

Do not disable code-signature validation to work around a mismatch.

This usually occurs when a TeamIdentifier or LabelPrefix rule is too broad.

Removing or narrowing the rule stops future matching by that rule, but it does not uninstall the application or its helper components.

This policy approves Service Management login and background items only. The application may separately require:

Deploy the corresponding Swif or Apple policy separately. Do not add a broader Service Management rule to solve an unrelated permission request.

This can be expected. The policy approves matched items, but macOS can still display a notification that managed background items were installed.

Verify approval through System Settings and sfltool dumpbtm rather than relying only on whether a notification appears.

To monitor background task management activity, run:

Reproduce the application registration or launch while the command is running. Stop the stream with Control-C.

Review logs for sensitive usernames, application paths, or identifiers before sharing them with Swif Support.

Background items and privileged helper tools can run without the main application being open and may operate with elevated privileges. Automatically approving an overly broad set of items can increase persistence and software supply-chain risk.

For a secure deployment:

This policy supports endpoint governance and least-privilege objectives, but it does not independently verify that a background item is safe or make the organization compliant with a particular framework.

The Apple Service Management Managed Login Items Policy automatically approves matched login items, launch agents, launch daemons, privileged helper tools, and other background services on macOS 13.0 or later.

For most deployments: