Configure Kernel Extensions (macOS)

Install signed or unsigned kernel extensions on macOS devices using the Kernel Extensions profile configuration.

Before you begin

Ensure the following requirements are met:
Tip: On Apple silicon Macs not enrolled in Apple School Manager or Apple Business Manager, set the security policy to Reduced Security to allow kernel extension loading. See Apple's support documentation.

About this task

Use the Kernel Extensions profile configuration to control which kernel extensions can load on macOS devices. This is useful when managing device-level drivers or custom system extensions that require explicit user or administrator approval.

Procedure

  1. Create or edit a Reactive macOS Device profile. See Creating a Profile and Editing a Profile.
  2. From the Security & Restrictions configurations list, add the Kernel Extensions configuration.
    Kernel Extensions configuration payload on a macOS device profile.
  3. Optional: Toggle on Allow User to Approve Additional Kernel Extensions to let users approve kernel extensions not explicitly listed in the profile.
  4. Select (Add) in the Valid Signed Kernel Extensions section to add team identifiers for software vendors whose signed kernel extensions should be allowed.

    Example: com.example.kext.mydriver.

  5. Select (Add) in the Kernel Extensions section to specify the bundle and team identifiers for allowed kernel extensions.
    Example:
    • Bundle ID: com.example.mydriver.
    • Team ID: com.example.kext.mydriver.
    Tip: Leave the team identifier blank for unsigned legacy extensions.

Results

Once the profile is deployed:
  • The specified kernel extensions are allowed to load on macOS devices.
  • Depending on the configuration, users may no longer see prompts for approving extensions.