Introduction

This article walks through the process of installing the endpoint agent on macOS using the installer file on a single device.

Table of contents

• Other Admin installation methods
• Granting Exceptions for Blocked Apps
• Getting the Installer Package
• Installing the Package on a Single MacBook
• Enabling Full Disk Access 
• Uninstalling a macOS Endpoint Agent

Other Admin installation methods

If you are an admin that manages a fleet of devices, see the following articles for more information on the various installation methods supported by the endpoint agent: 

• Appliance Hosted Endpoint Installers
• Deploying the macOS agent via JAMF
• Deploying the macOS agent via Intune
• Best Practices: Automated Agent Deployment

Granting Exceptions for Blocked Apps

If the .pkg file won’t open, it may be because Apple can’t check it for malicious software as the app was not obtained from their App store. If you encounter this, visit this Apple support article for more this protection feature and how approve exceptions for an app.

Use their drop-down list to select your version of macOS as the exception process will vary from version to version.

Getting the Installer Package

You can download the installer for macOS, and all other supported operating systems, from the MDR Portal's Downloads page. Once you have the installer package downloaded and on the machine that requires and endpoint agent, see Installing the Package on a Single MacBook below. 

Partners: The downloads page is available at the per-client level, and all the files available for download are specific to each client. 

Ensure that the organization selector is set to the correct client view when downloading assets.

Installing the Package on a Single MacBook

The following procedure outlines the process of installing the endpoint agent on to a single MacBook using the package available from the Downloads page. 

Once the installer package is on the device in question, open it in Finder and click the installer package.

This will open the Field Effect MDR installer, click Continue. 

Click Continue to move past the Read Me section.

After reviewing the licensing agreement, click Continue. 

You will be asked to explicitly agree to the terms of the software. Click Agree to give your consent and continue.

You will be presented with the endpoint agent's storage requirements, and optional customization options. We recommend not customizing the installation or the storage location.  Click Install to install the endpoint agent on the device.  

You will then need to authenticate using your password, fingerprint, or other means supported by your device (face unlock, etc.). Authenticate to continue.

You may be asked to allow the installer to access files on your device. If this is the case, Allow access.

After allowing access, you will need to allow "covalence-endpoint" to act as a security extension and run in the background. Click ok allow this behavior and continue.

If this is missed during the installation, it can be authorized post-installation by navigating to System Settings > General and clicking the (i) button next to CovalenceEndpoint entry in the extensions section Security Extensions. This will open the same window as shown above. 

The installer will show you that it was successful, and you man click to close the installer. 

Enabling Full Disk Access 

When manually installing the endpoint agent on macOS, full disk access will also have to be manually enabled for the endpoint agent. To do so, (after installing the agent) open the System Settings app and from the Privacy and Security tab, click Full Disk Access. 

On the Full Disk Access page, "Covalence System Extension" should be listed as an application. This is our endpoint agent, so enable it.  

You will then need to authenticate using your password, fingerprint, or other means supported by your device (face unlock, etc.). Authenticate to continue.

The endpoint agent will then have full disk access, and the toggle will be set to the on position. 

Uninstalling a macOS Endpoint Agent

Begin by using the Launchpad to open Terminal.

In Terminal, type in the following uninstall script and press Enter:

/Applications/Covalence.app/Contents/scripts/uninstall.sh

After running the command above, you need to give the Terminal permission to run the script. To allow, provide your administrator password. 

You will next be presented with a dialogue to enter your administrator password a second time, which is required to remove the Covalence System Extension. 

Enter your administrator password or use a biological authentication method supported by your device, to continue.

Once the script has completed, you will be returned to the command prompt, and the endpoint agent will be uninstalled. You may close the Terminal at this point.