Crowdstrike macOS 15 - Missing AllowUserOverrides

[saladd-bu]

Hello,

The current version of the Crowdstrike macOS 15 configuration profile is currently missing the AllowUserOverrides key, which causes it to be ineffectual. A previous (monolithic) version contained this; the change to a single Non-UI Removable payload removed it.

<key>AllowUserOverrides</key>
<true/>

Adding this back to the payload restores functionality.

Thanks!
Drew

[captam3rica]

hey @saladd-bu thanks for reaching out!

the intent with the "macOS15" config (settings specific to macOS15+) is to deploy that along with the other larger settings profile, which includes the key you mentioned above.

deploying this way prevents any necessary prompting to the end user.

be sure to reach out to support if you have further questions!

[saladd-bu]

Hi there!

So, that was how we started, crowdstrike_settings.mobileconfig and crowdstrike_settings_macOS15.mobileconfig deployed simultaneously to the device. However, the effective behavior on the device with those as-is was the Falcon Endpoint Security Extension toggle left unmanaged and removable.

Once we added AllowUserOverrides to crowdstrike_settings_macOS15.mobileconfig, the toggle locked and uninstall was removed from the … menu as expected.

We tested on a few fresh macOS 15 deployments and could reproduce the issue prior to the edit. Since we're mid-mdm migration, we went back and compared against our previous configs. We were doing the same thing before, Non-UI Removable layered on top of the previous extension config profile. Only difference was presence of AllowUserOverrides, true.

Thanks,
Drew