County librarian Macs on macOS 12 and later install the Carbon Black Cloud sensor, but the sensor stays degraded until a system extension is approved. What should the administrator push with the sensor?
Select an answer to reveal the explanation.
Short Explanation
Modern macOS treats extra kernel-level helpers like a locked staff door—MDM has to badge them in or they sit in the lobby. A UEM system-extension and PPPC profile is that badge, shipped with the sensor. Clicking Allow at login, dropping a GI SVM on a Mac, or a host profile will not approve the extension.
Full Explanation
County librarian Macs on macOS 12 and later install the Carbon Black Cloud sensor, but the sensor stays degraded until a system extension is approved. Push a Workspace ONE UEM MDM profile that pre-approves the sensor system extension and PPPC payload with the sensor—modern macOS treats helpers like a locked staff door MDM must badge in. An NSX-T Guest Introspection service virtual machine on each Mac fails by concept because GI SVMs are not how macOS approves CBC system extensions. A Carbon Black org API key in a login item so users click Allow at first boot fails because relying on user clicks is fragile and not the MDM pre-approval pattern. A vSphere host profile that trusts the Mac as a tunnel endpoint fails because host profiles do not approve macOS system extensions for CBC. Exam caveat: macOS CBC sensor health needs UEM MDM system-extension and PPPC approval profiles—not GI SVM, user Allow clicks, or vSphere host profiles. Operational check: deploy sensor plus UEM approval profiles, confirm sensor is no longer degraded for system extension reasons, and verify users are not required to click Allow at login. Retest after macOS minor upgrades because extension requirements can change with Apple OS updates.