Endpoint Security, CrowdStrike, Full Disk Access for macOS 10.14, 10.15, 11, and 12
Granting Full Disk Access to the Falcon Sensor on macOS 10.14 and up.
University of Illinois IT Pros leveraging Technology Services CrowdStrike
Beginning with macOS 10.15, full disk access must be granted to the CrowdStrike Falcon Sensor to obtain visibility to all files on the device. This action only needs to be taken once per host when installing the Falcon Sensor, or after upgrading from pre-10.15 macOS releases. It does not need to be repeated after sensor updates.
For macOS 10.14, CrowdStrike recommends granting full disk access to the CrowdStrike Falcon Sensor, in order to accommodate sensor releases that access file paths protected by default on Mojave.
If you are using EPS Workspace ONE to manage your macOS devices, please contact the EPS team and we will help you leverage the existing "fda.crowdstrike" global privacy preferences profile to grant full disk access to the Crowdstrike Falcon Sensor.
For Macs not enrolled in Workspace ONE, you can take the following steps to manually grant full disk access to the Crowdstrike Falcon Sensor. Administrator account permission is needed for these steps.
- Open System Preferences
- Open Security & Privacy
- Select the Privacy tab. If privacy settings are locked:
- Click the lock icon in the lower-left corner
- Enter your device password