Mac Support

Mac tickets stall on Windows-native desks because nobody knows where macOS keeps the same
problem. Four issues cover most: keychain, MDM enrollment, TCC, FileVault.

Climb the Troubleshooting Ladder base skill first: past Mac tickets at this client, then the
documented standard — MDM product, supervised via Apple Business Manager or user-enrolled,
identity integration, and where FileVault keys are escrowed (say so if unknown). Get the
exact macOS and app versions: permissions and MDM behavior change materially between
releases, so verify steps against the running version on the web, never invent a menu path,
and translate Windows steps into their real macOS equivalent.

Branch:
a. Keychain — a password changed elsewhere and the Mac now prompts for the old one, or apps
   re-ask endlessly: the login keychain is still encrypted with it. If the user remembers
   it, update the login keychain to match. If not, a new login keychain discards every saved
   password and certificate in the old one — list what's in there (Wi-Fi, mail, app
   credentials) and get explicit acknowledgment of the loss first. Never delete keychain
   files by hand.
b. MDM enrollment — won't enroll, or profiles stopped applying. Check: is the serial
   assigned in Apple Business Manager to the right MDM server; does it show in the MDM
   console (a stale or duplicate record blocks re-enrollment — remove it per the MDM's
   process); can it reach Apple's enrollment endpoints (filtered networks break this).
   Re-enrolling a supervised device usually needs an erase, which destroys data: gate it
   behind explicit acknowledgment and a confirmed backup. Expired tokens and server
   mismatches are the MDM admin's.
c. Permissions (TCC) — an app can't use camera, mic, screen recording or files after an
   update or on a new machine; a remote-support tool showing black is classic. Enable that
   permission for the app in System Settings under Privacy & Security, then quit and
   relaunch it. A greyed-out or resetting toggle is MDM-managed via a PPPC profile: fix it
   in the MDM, don't fight the endpoint.
d. FileVault — stuck at disk unlock, or recovery needed. Check the documented escrow
   (MDM-escrowed recovery key, or the client's key record) before attempting anything. A
   password changed elsewhere may not reach the unlock screen until the local password syncs
   — known behavior; confirm current guidance. With no escrowed key and no working password,
   say plainly recovery is closed: erase and restore from backup. Recovery keys never go in
   notes or email, and no fleet-wide escrow is a client-level risk finding: raise it.

Verify by re-testing the failing action: screen share visible, no prompt storm across a
reboot, profile applied. Note it (PSA Note Discipline base skill): macOS version, branch,
cause, action, what was discarded and must be re-entered, verification.