MAC Agent Version 11.x Release Notes | ThreatLocker Help Center

Note: Reminder to run Learning Mode after installation before securing endpoints for the minimum recommendation of 5-7 days.

Important: Use the link below to download the ThreatLocker MDM profiles required for Version 11 and above.
https://static.threatlocker.com/deployment/A/ThreatLocker+MDM+Profiles+v3.1.zip

From the downloaded file, extract the four .mobileconfig files:

ThreatLocker Configuration (v3).mobileconfig - Configures core security permissions for ThreatLocker's core agent. It includes the core agent's System Extension, Full Disk Access, and Notifications. These enable ThreatLocker's Application, Ringfencing, Elevation, Storage, and other security policies.

ThreatLocker Startup & Lock (v3).mobileconfig - Configures macOS Managed Login Items to enable auto starting and auto restarting of the ThreatLocker Agent. Additionally it prevents removal of ThreatLocker's System Extension and Network System Extension.

ThreatLocker Network Core (v3).mobileconfig - Configures ThreatLocker's Network Filter (labeled 'Content Filter' by macOS) in firewall mode. This enables agent enforcement of network based ThreatLocker Ringfencing and ThreatLocker Zero Trust Endpoint Firewall policies.

ThreatLocker Network ZTNA + ZTCA (v3).mobileconfig - Configures specific ThreatLocker Network Filters (Transparent Proxy & DNS Proxy). It includes configuration for the Secure Network Agent's System Extension and its Full Disk Access. These enable ThreatLocker's brokered ZTNA and ZTCA policies.

Version 11.2.6

Live:

Beta: 10/12/2026

New Features and Improvements

Improved website loading speeds on macOS when using Tailscale DNS alongside the Content Filter
Improved ZTNA logging to ensure inbound broker logs correctly display policy matches for connections originating from macOS devices
Improved the accuracy of Web Control category matching in the Mac Agent to ensure consistent alignment with defined domain classifications
Optimized network tag processing and indexing on the macOS agent to resolve browsing performance issues when large ZTCA policies are present
Updated the macOS Agent to support SASE policy traffic redirection for all TCP destination ports
Improved ZTNA connectivity for Mac endpoints to ensure reliable remote access from Windows devices
Enhanced ZTNA to support dynamic port ranges for device-to-device policies
Implemented functionality for the Mac Agent to download and broker external devices, enabling secure connections to authorized external devices

Bug Fixes

Improved system performance by resolving an issue where the macOS agent caused high CPU usage when opening or saving files in certain applications

Version 11.3.0

Live:

Beta: Limited Beta 10/08/2026

New Features and Improvements

The Mac Agent has been updated to support the evaluation and enforcement of new Ringfencing policies, allowing for granular control over application interactions with other applications, the internet, and the file system
Introduced an offline elevation workflow for the Mac Agent, allowing users to request and receive one-time elevation codes when internet connectivity is unavailable
The macOS Agent has been updated to include enhanced Patch Management deferral options, allowing users to delay restarts by specific time durations or schedule them for a later date and time
The Mac Agent now supports expanded Web Control customization, allowing administrators to independently configure the visibility and requirement of email address and reason fields, as well as customize blocked-page text and field labels
The macOS Agent now supports automatically enabling override mode by reading an override code from an `override.txt` file located on the root of a connected USB drive
Introduced support for configurable justification prompts when elevating applications on the macOS Agent, ensuring consistency with administrative elevation workflows
Enhanced the Unified Audit to display the Application File ID for matched rules, allowing for more precise identification and troubleshooting of application executions
Updated the Mac Agent to support the "Disable TL Hash" option, enabling the use of full file SHA-256 hashes for application matching and reporting to enhance security and performance
Added support for Azure, Entra, and SCIM group membership within policies for the macOS agent, ensuring parity with Windows policy evaluation
Updated the Mac Agent to support SHA-256 matching for Chrome extensions, ensuring consistent application identification and policy enforcement when the "Disable TL Hash" option is enabled
Improved performance for applications running from external APFS storage devices on macOS by implementing hash caching optimizations
Updated the Mac Agent status bar to remove blocked elevation requests from the blocked items list for consistency across platforms
Improved the Mac Agent's ability to retrieve and update local device information records upon request
Enhanced security for the Mac Agent by updating the Peer Validation authentication process to prevent potential replay attacks
Improved the user experience by removing redundant error notifications when enabling ThreatLocker notifications on macOS standard user accounts, as this information is now conveniently accessible via the Status Bar popup
Updated the macOS agent to ensure ThreatLocker's elevation interface correctly appears when modifying various system settings, including Energy, Sharing, and Network Firewall
Improved the responsiveness of the macOS Approval Request window by implementing a loading state and optimizing data retrieval timeouts to ensure the window appears promptly even during slow network conditions
Updated the macOS agent to support Device to Device policies and peer validation within the Network Control module
Improved the Mac Agent to ensure that secure network data and device information are correctly removed when an organization mapping is deleted
Implemented performance improvements for the macOS Agent to address intermittent CPU spikes and enhance system stability
Improved the Mac Agent's ability to correctly identify and permit inbound traffic from CIDR-range network tags when no hostname is available
Improved policy matching for Mac Agent by resolving an issue with Entra and SCIM group parsing

Bug Fixes

Resolved an issue in the Mac Agent user interface where multiple log status messages were displayed simultaneously when uploading logs to the server
Resolved an issue on macOS where ThreatLocker agent files remained inaccessible even after Tamper Protection was disabled
Resolved an issue where the macOS agent incorrectly blocked applications with computer-level "Permit" policies following a new installation and baseline scan
Resolved an issue where the Mac Agent incorrectly reported a DAC configuration error immediately following installation
Resolved an issue where the Mac Agent would fail to complete log collection, ensuring logs are now successfully saved to the desktop as expected
Resolved an issue where the Mac Agent Installer Helper would incorrectly display a "Notifications: Initializing..." status and fail to launch the user interface agent after installation
Resolved an issue where "Deny Execute" events from the macOS agent were not appearing in the Unified Audit portal
Resolved an issue on macOS where the application blocked notification dropdown menu failed to appear when self-approval was enabled

Version 11.2.5

Live: 9/29/2026

Beta: 09/22/2026

New Features and Improvements

Improved internal communication validation and security for the Mac Agent

Bug Fixes

Improved network connectivity and browsing performance on macOS by optimizing DNS flow handling and reducing Web Control tag timeouts, resolving an error in which macOS agents could experience web connectivity issues after upgrading
Improved the stability of the ThreatLocker UI Agent on macOS to prevent unexpected crashes and interface anomalies
Resolved an issue in which the maintenance mode window could not be moved by improving the user interface and interactivity of the Maintenance Mode and Elevation windows

Version 11.2.4

Live: 9/17/2026

Beta: 09/09/2026

New Features and Improvements

Enhanced security for the Mac Agent by implementing automatic API validation key rotation during version updates to ensure secure communication
Updated the macOS agent to ensure Web Control policies are correctly applied when the Web Filtering feature is enabled

Version 11.2.3

Live: 09/09/2026

Beta: 09/02/2026

New Features and Improvements

Improved the reliability of application definition downloads during installation on macOS to ensure all required policies are correctly applied before securing the device

Bug Fixes

Improved the accuracy of Ringfence reporting for macOS agents to ensure simulated deny actions are correctly logged when a policy or machine is in Monitor-Only or Learning Mode
Resolved an issue where legacy Web Control and Network Control policies were not correctly enforced on macOS agents due to network event caching
Resolved an issue where the Mac Agent incorrectly blocked applications with "Permit" policies applied at the computer level following a new installation and baseline completion

Version 11.2.2

Live: 8/31/2026

Beta: 08/27/2026

New Features and Improvements

Improved Mac Agent performance by optimizing file hashing processes to reduce high CPU usage during file selection operations
Improved disk performance and reduced excessive read/write activity on macOS devices by optimizing database management and resolution processes
Improved the Mac Agent's certificate validation process to ensure successful baselining by correctly identifying valid root certificates

Bug Fixes

Resolved an issue with the Mac Agent's ability to recognize and process self-signed certificates that only contain the leaf certificate
Resolved an issue where macOS endpoints could not be configured as ZTNA servers for services such as VNC and SMB

Version 11.2.1

Live: 08/24/2026

Beta: 08/19/2026

Bug Fixes

Resolved an issue on macOS where users would intermittently receive an "Error Code 1" prompt during agent updates by improving the system extension update logic

Version 11.2

Live: 08/19/2026

Beta: 08/07/2026

New Features and Improvements

The ThreatLocker Mac Agent has been updated to support multiple languages across all customer-facing user interface windows and notifications, including new translations for Portuguese (Brazil), French, and Ukrainian (setting pulled from OS settings)
Updated the Mac Agent to utilize UDP instead of TCP for peer validation to improve communication efficiency
Added support for wildcard characters in Secure Network Custom Domain policies
Improved the Mac Agent's handling of command-line parameter exclusions to correctly support special characters and array values, ensuring exclusions match as intended
Improved performance and responsiveness on macOS devices when running terminal commands and development tools
Optimized the macOS agent to reduce CPU usage during high-volume file operations on non-monitored paths
Added ability to limit Source Applications that can launch an application (portal support coming soon)
Improved memory management for the Mac Agent by optimizing file install storage and resolving a memory leak related to DNS resolution
Improved the macOS agent to support the elevation of Xcode location and command-line tool selection
Updated the macOS Agent to ensure IP address information is only transmitted and displayed when Network Control or relevant security features are enabled
Implemented the update delay notification for Patch Management on macOS, allowing users to schedule or postpone application updates
Improved the consistency of Storage Control policies on macOS to ensure that denied files and folders are correctly hidden and inaccessible within Finder, including the "Recents" view
Improved the performance of the Mac Agent by implementing a secure process hash caching mechanism for running applications
Improved the Mac Agent's certificate cache handling by increasing descriptor limits to prevent excessive error logging during high-activity periods

Bug Fixes

Resolved an issue where the macOS Agent would not correctly respect the precedence of Advanced Settings after a restart or a 24-hour period
Resolved an issue where standard users on macOS were intermittently prompted for elevation by the Software Update Notification Manager following a system update
Resolved an issue where certain external hostnames were incorrectly resolved, preventing successful connections to those domains
Resolved an issue where the Secure Network component could crash, resulting in a loss of internet connectivity

Version 11.1

Live: 8/10/2026

Beta: 07/22/2026

New Features and Improvements

Enhanced the macOS agent to support custom button colors on the Web Control blocked screen, allowing for improved branding and visual consistency
The Mac Agent has been updated to support managed override codes and includes an enhanced user interface for override mode to display code expiration details
Improved the security and reliability of sensitive data storage on macOS by transitioning to a new secure storage system with enhanced tamper protection
The Mac Agent now supports user and group-based policy enforcement, allowing for granular control of application behavior based on the specific user or group context
Improved the Mac agent installer to ensure successful installation when using specific environment configurations
Improved the macOS Agent to prevent internal authentication components from being unnecessarily logged or learned during system authentication events
Improved the Mac Agent startup process by moving private key downloads to a background task with progressive timeouts to prevent delays when the keychain is unavailable or internet connectivity is poor
Implemented support for the "Configure Application Prioritization" advanced setting on macOS, ensuring that application policy precedence correctly follows the defined order when built-in application prioritization is disabled
Improved the security of the Mac Agent by encrypting sensitive registration data during the baseline scanning process
Improved the macOS agent to ensure all application and elevation approval requests include a valid file hash and optimized resource management during hash calculation to prevent request failures
Improved the Mac Agent to ensure internal lock files are hidden from the user interface

Bug Fixes

Resolved an issue where Tamper Protection could prevent elevation via `sudo` when using non-standard binary paths or custom PAM configurations
Updated the Mac Agent to ensure Web Category policies are applied to all matching applications, rather than being restricted to only browser applications only
Resolved a conflict in the Second Look Advanced Setting feature that could cause temporary file denies during application updates
Resolved an issue where the Mac Agent's Secure Network extension could experience a crash when the internet connection was lost or the proxy service stopped
Resolved an issue where Secure Network policies for website category restrictions remained enforced while the macOS agent was in Network Monitor Mode
Resolved an issue where custom rule tags were not matching correctly ensuring proper network redirection

Version 11.0.2

Live: 07/14/2026

Beta: 07/09/2026

Bug Fixes

Resolved an issue where database locking could prevent application files from saving correctly, potentially leading to incorrect file denials

Version 11.0.1

Live: 07/01/2026

Beta: 06/18/2026

New Features and Improvements

The macOS Agent has been updated to include support for custom SaaS application tags
Made improvements to exclude Defender from Ringfencing policies and policies with "Kill Running Processes" enabled

Bug Fixes

Resolved a communication issue between the Mac Agent and ThreatLocker application that caused incorrect status reporting
Resolved an issue where the Mac Agent would intermittently lose connection to the secure network following a network change
Resolved an issue on macOS where applications installed from the App Store could execute once without a policy or approval
Resolved an issue where the DNS Proxy on macOS would stop functioning after using the Fast User Switching feature
Resolved an issue where the DNS Proxy on macOS would stop functioning after using the Fast User Switching feature

Version 11.0

4/3/2026 - Beta

6/24/2026 - Live

New Features and Improvements

Improved Tamper Protection to prevent unauthorized deletion of ThreatLocker files and logs by administrators
Expanded Tamper Protection coverage to better preserve audit and forensic data.
Strengthened protection against attempts to stop or interfere with ThreatLocker services and system extensions
Restricted access to installation logs to authorized system users only
Added automatic cleanup of installation logs after successful installation
Enhanced runtime security protections for authentication components to improve resistance against tampering and unauthorized code injection
The agent now enables DAC by default, with the option to disable it available through Advanced Settings
Added support for Secure Network Policies and network configuration management
Added new registration flow to the agent, supporting pending, approved, and rejected registration states for improved device onboarding
Introduced support for a feature-centric billing model, enabling more granular purchasing and improved policy management
Added a hierarchical view option to the Realtime Unified Audit, allowing users to toggle between regular and hierarchical table views with improved sorting and filtering
Added Device Discovery feature, enabling network scanning for unprotected devices and open ports
Updated the Mac Agent to improve how Network Activity monitoring is triggered
Added tooltips to the Blocked Items List and Realtime Unified Audit buttons for improved user guidance
Added a disk space monitoring feature to the Mac Agent to alert when free space is low
Added support for configuring multiple broker servers per ZTNA and SaaS policy
Improved performance by optimizing DNS resolution processing
Improved Secure Network Web Control on Mac to ensure manually entered domains in policies are correctly matched and applied
Improved ZTCA performance on Mac Agents by implementing latency testing to automatically route traffic through the most optimal server
Improved the reliability of the Mac Agent's Secure Network Broker to ensure connection persistence and automatic recovery following network interruptions or server-side connection timeouts
Improved the performance of the Mac Agent by optimizing policy loading at startup, significantly reducing the time for the Secure Network extension to apply security rules
Updated agent log submission to a new logging endpoint and ensured logs include the correct Mac source type identifier for improved log routing and consistency
Added advanced settings to allow disabling Elevation Control and Local Admin Management features per machine or group in the Mac Agent
Improved the Mac Agent Secure Network extension’s resilience by ensuring it can automatically re-establish communication with the ThreatLocker application after an internal connection failure
Improved the Mac Agent's ability to correctly identify and match domain-based tags within Zero Trust Network Access (ZTNA) policies

Bug Fixes

Removed developer-specific path information from distributed components
Resolved an issue where the agent would prompt for admin credentials by attempting to uninstall the Secure Network Extension even when the feature was not enabled
Resolved an issue where scheduled policies on Mac endpoints were not applying the correct date and time, ensuring policy timing now works as expected in the Mac Agent
Resolved an issue where the Secure Network Extension on macOS failed to update automatically alongside the ThreatLocker agent
The agent now includes its version information in Unified Audit logs and PortalAPI responses
Updated the agent to skip processing directed broadcast network traffic, aligning its behavior with the Windows agent
Resolved an issue where newly created standard users could not use sudo; now, user creation and deletion events on macOS 14+ properly update the sudoers file
Resolved an issue where you were not able to connect to SMB share with Secure Network
Resolved issue where agent logs showed 'cannot download memberships for organization' error until first agent restart
Resolved issue where Secure Network could become broken because of memory allocation errors for DNS flows
Resolved an issue where error messages appeared during initial installation if the Secure Network feature was enabled
Resolved an issue where the Secure Network extension could lose DNS Proxy, Transparent Proxy access, and communication with the ThreatLocker application
Resolved an issue where excessive network logs were generated for Secure Network events
Updated the agent to allow uninstallation when device registration is rejected
Resolved an issue where users could not request access to blocked websites when "Allow User to Request" was enabled in Secure Network policies
Resolved an issue where the tray icon on macOS devices would remain visible after being configured to be hidden in the group settings
Resolved an issue where tags database journaling would not stop, by updating tag handling to use UUIDs for improved reliability
Resolved an issue where the Secure Network Extension on macOS failed to update automatically alongside the ThreatLocker agent
Resolved an issue in Mac Agent 11.0 where Secure Network Full Disk Access status was incorrectly shown as denied, ensuring accurate permissions display and improved user experience
Resolved an issue where the Secure Network extension could stop working and display "Cannot Allocate Memory" errors due to connection leaks; improvements now ensure proper connection handling and stability
Resolved an issue in Mac Agent 11.0 where multiple Baseline Scanner processes could run simultaneously after installation

Version 11.0.1

6/18/2026 - Beta

New Features and Improvements

The macOS Agent has been updated to include support for custom SaaS application tags, allowing for more granular policy control and identification of web-based applications
Improved exclusion logic on macOS to ensure the agent correctly honors exclusions for security products, preventing unnecessary interactions during Ringfencing or process termination events

Bug Fixes

Resolved a communication issue between the Mac Agent and ThreatLocker application that caused incorrect status reporting, and updated the status interface to more accurately reflect connection states
Resolved an issue where the Mac Agent would intermittently lose connection to the secure network for an extended period following a network change
Resolved an issue on macOS where applications installed from the App Store could execute once without a policy or approval
Resolved an issue on Mac agents where hostnames were incorrectly identified as domains in Web Control
Resolved an issue in which the Secure Network System Extension was unable to communicate after updating
Resolved an issue where the DNS Proxy on macOS would stop functioning after using the Fast User Switching feature