Resolving macOS Wazuh Agent Failures: Missing Full Disk Access Fix

On modern versions of macOS, security and privacy protections are significantly stricter than they were in previous releases.

Apple’s Transparency, Consent, and Control (TCC) framework limits how applications access sensitive user data and protected system locations.

While these protections improve user privacy, they can also prevent security tools like the Wazuh agent from collecting the data they need unless they are explicitly granted Full Disk Access (FDA).

One of the most common causes of incomplete monitoring on macOS is a Wazuh agent running without Full Disk Access.

At first glance, the agent may appear to be operating normally, it stays connected to the manager, sends heartbeats, and reports basic system information.

However, behind the scenes, critical monitoring capabilities can silently fail.

File Integrity Monitoring (FIM) may stop detecting changes in protected folders, important security logs may never reach the manager, and malware activity occurring within restricted directories can remain invisible.

Without Full Disk Access, several core Wazuh capabilities are affected, including:

File Integrity Monitoring (FIM) for protected files and directories.
Collection of macOS security logs and system events.
Detection of unauthorized file modifications.
Malware and persistence detection that relies on monitoring sensitive locations.
Compliance auditing for frameworks that require complete filesystem visibility.

Apple officially recommends granting Full Disk Access only to trusted security and management software because of the broad level of access it provides.

Endpoint detection and monitoring platforms like Wazuh fall into this category since they must inspect protected areas to detect threats effectively.

In this guide, you’ll learn exactly why the Wazuh agent requires Full Disk Access, how missing permissions affect monitoring, how to identify the symptoms, and the step-by-step process to restore full visibility on macOS endpoints.

You’ll also learn how to verify that the fix is working so your agents can resume collecting the security data your Wazuh deployment depends on.

Understanding Wazuh Missing Full Disk Access

What Is Full Disk Access on macOS?

Full Disk Access is a macOS privacy permission that allows approved applications to read and monitor files that are normally protected by the operating system.

Apple introduced this protection as part of its Transparency, Consent, and Control (TCC) privacy framework, beginning with macOS Mojave (10.14).

The TCC framework protects sensitive locations such as:

Desktop
Documents
Downloads
Mail
Safari data
Calendar databases
Contacts
Photos
Certain system directories
Application data
Some security-related logs

Applications cannot simply bypass these protections because they are running as root or because the user is an administrator.

Instead, Apple requires explicit user approval before an application can access these protected resources.

This distinction is important because many administrators assume installing the Wazuh agent with administrative privileges automatically grants unrestricted access. On macOS, that is not the case.

Apple’s Transparency, Consent, and Control (TCC) Framework

TCC is designed around the principle of user consent.

Every application requesting access to protected data must receive explicit authorization before macOS allows the request.

According to Apple’s Platform Security documentation, TCC enforces privacy restrictions even for privileged processes in many situations, preventing applications from silently accessing sensitive user data without approval.

This significantly reduces the ability of malware to harvest sensitive information, but it also means legitimate security software must be granted additional permissions.

Why Security Software Requires Elevated File Permissions

Endpoint Detection and Response (EDR), SIEM agents, antivirus software, and File Integrity Monitoring solutions continuously inspect files, monitor changes, and analyze system activity.

Without Full Disk Access they cannot:

Monitor protected folders
Read certain security artifacts
Detect unauthorized modifications
Inspect persistence mechanisms
Analyze some application data

As a result, threat detection becomes incomplete.

Full Disk Access vs Administrator Privileges

This is one of the most misunderstood concepts among macOS administrators.

Administrator privileges allow software to:

Install applications
Modify system settings
Manage services
Install launch daemons

Full Disk Access allows software to:

Read protected user files
Monitor sensitive directories
Access protected application databases
Collect information restricted by TCC

The two permissions are completely separate.

An application may run as root and still receive Operation not permitted errors when attempting to read protected files if Full Disk Access has not been granted.

Why the Wazuh Agent Requires Full Disk Access

The Wazuh agent performs continuous endpoint monitoring across the operating system.

Many of its core modules rely on reading files that fall within macOS protected locations.

Without Full Disk Access, the operating system simply blocks these requests.

Accessing Protected System Directories

Many important security artifacts reside inside directories protected by TCC.

Examples include:

User Library folders
Application Support
Certain configuration files
Protected system metadata

If these files cannot be read, Wazuh cannot determine whether they have changed.

Monitoring User Home Directories

File Integrity Monitoring is commonly configured to watch user directories for:

Unauthorized document changes
Ransomware encryption
Persistence files
Suspicious downloads
Script modifications

macOS prevents unrestricted monitoring of these locations without explicit authorization.

Reading Security Logs and System Events

Some endpoint telemetry depends on reading log files or security-related resources protected by macOS privacy controls.

Without permission, log collection becomes incomplete.

This can lead to:

Missing login activity
Reduced audit visibility
Missing application events
Partial forensic timelines

Supporting File Integrity Monitoring (FIM)

The Wazuh File Integrity Monitoring module relies on continuous filesystem access to:

Detect file creation
Detect deletions
Monitor permission changes
Identify unauthorized modifications
Calculate file hashes

If protected directories cannot be scanned, these detections never occur.

Improving Endpoint Visibility

Security monitoring is only as effective as the data available.

Granting Full Disk Access enables the Wazuh agent to provide a more complete picture of endpoint activity, improving:

Threat detection
Incident investigations
Compliance reporting
Malware analysis
Security auditing

Industry guidance from organizations such as the MITRE emphasizes that endpoint visibility is critical for detecting attacker techniques that rely on persistence, privilege escalation, and defense evasion.

Reduced telemetry increases the likelihood that malicious activity will go undetected.

What Happens When Full Disk Access Is Missing?

Although the Wazuh agent continues running, many monitoring capabilities become partially functional.

Administrators often mistake this for a configuration issue because there are no obvious installation errors.

File Integrity Monitoring Fails

Protected files are excluded from monitoring.

Any modifications occurring within these locations remain invisible to Wazuh.

Missing Log Events

Security events that rely on protected resources never reach the manager.

Dashboards may show:

Lower-than-expected event counts
Missing login activity
Sparse endpoint telemetry

Incomplete Malware Detection

Malware frequently stores files inside user-specific directories protected by TCC.

Without Full Disk Access:

Persistence mechanisms may be missed.
Malicious scripts may not be inspected.
Suspicious file modifications can go undetected.

Compliance Monitoring Gaps

Many compliance frameworks require organizations to monitor critical system files and detect unauthorized changes.

If protected directories cannot be inspected, compliance reports may become incomplete or inaccurate.

Reduced Visibility Within the Wazuh Dashboard

One of the most deceptive symptoms is that the macOS agent appears online and healthy in the dashboard.

Administrators may see:

Normal agent status
Successful heartbeats
Healthy CPU usage
Connected manager

Yet the endpoint generates very few alerts because much of the required telemetry is never collected.

Related Guide: How to Test Wazuh Rules

Common Symptoms of Missing Full Disk Access

Missing Full Disk Access does not usually cause the Wazuh agent to crash or disconnect.

Instead, it silently limits what the agent can observe, making the problem more difficult to identify.

If your macOS endpoint appears healthy but produces little security data, one or more of the following symptoms may indicate that Full Disk Access has not been granted.

Wazuh FIM Stops Detecting File Changes

One of the earliest signs is that File Integrity Monitoring no longer reports changes within protected directories.

You may notice that:

Modified files generate no alerts.
New files are never reported.
Deleted files go unnoticed.
File hashes are not updated.

Meanwhile, FIM continues working normally for unprotected locations, creating the false impression that the module is functioning correctly.

Protected Directories Are Never Scanned

Directories covered by Apple’s TCC protections are effectively invisible to the agent without Full Disk Access.

Examples include portions of:

Desktop
Documents
Downloads
Library
Application Support

Scheduled scans complete successfully, but files inside these locations are skipped because macOS denies access.

Missing macOS Security Events

You may observe significant gaps in endpoint telemetry, including:

Missing authentication events
Missing application activity
Incomplete audit information
Reduced security log collection

This can make investigations much more difficult because event timelines are incomplete.

Agent Appears Healthy but Produces Few Alerts

Perhaps the most misleading symptom is that the Wazuh dashboard shows the agent as connected and healthy while security alerts remain unusually low.

Heartbeat messages, inventory data, and basic status updates continue to function, giving administrators the impression that monitoring is working as expected.

In reality, the agent lacks visibility into many of the locations where suspicious activity occurs.

Permission Denied Errors in Agent Logs

When the agent attempts to access protected resources, its logs may contain errors similar to:

Operation not permitted
Permission denied
Access denied
Cannot open file

These messages indicate that macOS is blocking access through its TCC privacy controls rather than a problem with Wazuh itself.

Compliance Checks Return Incomplete Results

Compliance policies that depend on monitoring protected files or directories may return incomplete or inaccurate findings.

This can affect audits aligned with frameworks such as Center for Internet Security benchmarks or National Institute of Standards and Technology guidance, where comprehensive file and system monitoring is an important security control.

Without Full Disk Access, Wazuh cannot evaluate every required location, reducing the reliability of compliance reporting.

Why the Permission Was Lost

Even if the Wazuh agent previously worked correctly, Full Disk Access (FDA) can disappear over time. macOS manages these permissions through its Transparency, Consent, and Control (TCC) database, and several events can remove or invalidate an application’s authorization.

Understanding why the permission was lost helps you choose the appropriate fix and prevent the issue from recurring.

Full Disk Access Was Never Granted

The most common cause is also the simplest, the Wazuh agent was installed successfully, but Full Disk Access was never approved.

This often happens when:

The installation was performed remotely.
The administrator assumed root privileges were sufficient.
Deployment documentation omitted the FDA step.
The installer completed without prompting for permission.

The agent continues communicating with the Wazuh manager, making the missing permission easy to overlook until monitoring gaps become apparent.

macOS Update Reset Privacy Permissions

Major macOS upgrades occasionally rebuild or migrate the TCC database during installation.

While Apple generally preserves privacy permissions, administrators have reported cases where Full Disk Access entries must be reapproved after upgrading to a new macOS release.

Symptoms often appear immediately after upgrading:

File Integrity Monitoring stops working.
New permission errors appear in agent logs.
Previously monitored directories are no longer accessible.

Whenever macOS is upgraded, verifying the Wazuh agent’s privacy permissions should be part of the post-upgrade validation process.

Wazuh Agent Was Reinstalled

Reinstalling the Wazuh agent can invalidate the existing Full Disk Access entry.

This happens because macOS associates privacy permissions with the specific application identity rather than simply its name. Removing and reinstalling the software may require the operating system to create a new authorization entry.

After reinstalling the agent:

Check whether it still appears under Full Disk Access.
Confirm the permission remains enabled.
Verify that monitoring has resumed normally.

Related Guide: How to Upgrade a Wazuh Agent

Agent Binary Changed After an Upgrade

Some upgrades replace the agent executable or modify its code signature.

When macOS detects that an application’s identity has changed, it may no longer trust the previously approved permission entry.

Depending on the upgrade method and macOS version, administrators may need to reauthorize Full Disk Access.

This is particularly important when:

Upgrading between major Wazuh versions.
Migrating deployment methods.
Installing manually over an existing installation.

MDM Policy Removed the Permission

Organizations using enterprise device management can unintentionally revoke Full Disk Access through configuration changes.

If an updated Privacy Preferences Policy Control (PPPC) profile:

Removes the Wazuh agent,
Changes its bundle identifier,
Modifies the approved code signature, or
Replaces an existing privacy profile,

macOS may immediately revoke the permission.

Review recent changes to your MDM policies if multiple managed Macs lose monitoring simultaneously.

User Accidentally Disabled Access

Users with administrative privileges can manually disable Full Disk Access from System Settings.

This commonly occurs when:

Cleaning up privacy permissions.
Troubleshooting unrelated software.
Following incorrect online instructions.
Attempting to improve system privacy.

Since the Wazuh agent continues running normally, the loss of monitoring may go unnoticed for days or even weeks.

How to Verify Whether Full Disk Access Is Missing

Before making configuration changes, confirm that Full Disk Access is actually the source of the problem.

Several quick verification steps can help distinguish a macOS privacy issue from network connectivity problems, agent configuration errors, or File Integrity Monitoring misconfigurations.

Check macOS Privacy Settings

The fastest way to verify the permission is through the macOS privacy settings.

Navigate to:

System Settings → Privacy & Security → Full Disk Access

Look for the Wazuh agent in the list of approved applications.

Verify that:

The agent is present.
The toggle is enabled.
There are no duplicate or disabled entries.
The permission has not been removed.

If the Wazuh agent is missing entirely, it has not been granted Full Disk Access.

Verify Wazuh Agent Status

Next, confirm that the problem is limited to permissions rather than the agent itself.

Check that:

The Wazuh agent service is running.
The agent is connected to the manager.
Heartbeats are being received.
The endpoint appears healthy in the Wazuh dashboard.

A connected agent with unusually little telemetry is often a strong indicator of missing Full Disk Access.

Review Wazuh Agent Logs

Agent logs frequently reveal whether macOS is blocking filesystem access.

Look for messages indicating:

Permission denied
Operation not permitted
Unable to access monitored files
Failed directory scans
Read failures

Repeated permission-related errors usually point directly to missing Full Disk Access rather than a Wazuh configuration problem.

Related Guide: How to Test Wazuh Rules

Test File Integrity Monitoring

One of the simplest validation methods is performing a controlled File Integrity Monitoring test.

Choose a directory that should be monitored by Wazuh, then:

Create a new file.
Modify its contents.
Rename the file.
Delete the file.

If no alerts appear in the Wazuh dashboard for protected directories, Full Disk Access is a likely cause.

Inspect macOS Unified Logs

macOS records TCC permission denials in the Unified Logging system.

Search the logs for:

TCC access denials
Privacy framework messages
Blocked filesystem access
Permission failures involving the Wazuh agent

These entries can confirm that macOS, not Wazuh, is preventing access to protected resources.

Apple’s developer documentation provides additional details about the Unified Logging system and how security-related events are recorded.

How to Fix Wazuh Missing Full Disk Access

Once you’ve confirmed that macOS privacy restrictions are preventing the Wazuh agent from accessing protected resources, you can restore monitoring using one of the following methods.

The appropriate solution depends on whether you’re managing a single Mac or deploying Wazuh across an enterprise environment.

Method 1: Grant Full Disk Access Manually

For standalone Macs or small deployments, manually granting Full Disk Access is usually the fastest solution.

Step 1: Open System Settings

Open System Settings from the Apple menu.

Step 2: Navigate to Privacy & Security

Select Privacy & Security, then scroll to Full Disk Access.

Step 3: Add the Wazuh Agent

If the Wazuh agent is not already listed:

Click the + button.
Browse to the installed Wazuh agent application or executable.
Add it to the approved list.

Step 4: Enable Full Disk Access

Ensure the permission toggle is enabled.

macOS may request administrator authentication before applying the change.

Step 5: Restart the Agent

Restart the Wazuh agent so it can reopen protected resources using its new permissions.

After restarting:

Modify a monitored file.
Verify new events appear in the dashboard.
Confirm permission-related errors have disappeared from the logs.

Method 2: Reinstall the Wazuh Agent

If the installation is corrupted or the privacy database contains outdated references, reinstalling the agent may resolve the issue.

Remove the Existing Installation

Completely uninstall the current Wazuh agent.

Removing leftover files helps prevent stale configuration data from affecting the new installation.

Install the Latest Agent Version

Download and install the latest supported Wazuh agent for macOS.

Grant Full Disk Access During Setup

Before placing the endpoint into production:

Open Full Disk Access settings.
Verify the new installation appears.
Enable the permission if necessary.

Verify Successful Registration

After installation, confirm:

The agent connects successfully.
The manager receives heartbeats.
File Integrity Monitoring is functioning.
Protected directories are accessible.

Method 3: Deploy Full Disk Access Using MDM

For enterprise environments, manually approving every endpoint is not practical.

Apple recommends deploying Full Disk Access using Privacy Preferences Policy Control (PPPC) profiles through an approved Mobile Device Management (MDM) solution.

Create a Privacy Preferences Policy Control (PPPC) Profile

Configure a PPPC payload that grants the Wazuh agent Full Disk Access using its correct code signature and bundle information.

Approve Full Disk Access Automatically

Once installed, macOS applies the approved permission automatically without requiring user interaction.

This ensures consistent monitoring across managed devices.

Deploy Through Enterprise Device Management

Push the PPPC profile using your organization’s MDM platform.

Common enterprise solutions include:

Microsoft Intune
Jamf Pro
VMware Workspace ONE
Kandji

Validate Policy Application

After deployment:

Verify the profile is installed.
Confirm Full Disk Access is enabled.
Review agent logs.
Perform a File Integrity Monitoring test.

Using centralized management greatly reduces configuration drift and ensures all macOS endpoints maintain consistent monitoring.

Method 4: Reset macOS Privacy Permissions

Occasionally, the TCC database itself becomes inconsistent or contains stale permission entries.

In these situations, resetting the privacy permissions may resolve the issue.

Reset TCC Permissions

Reset the relevant privacy permissions using Apple’s supported tools or administrative commands.

After resetting:

The existing authorization is removed.
macOS treats the Wazuh agent as a new application requesting access.

Re-Grant Full Disk Access

Open the Full Disk Access settings and approve the Wazuh agent again.

Verify Restored Monitoring

Restart the agent and confirm:

Permission errors disappear.
Protected directories are scanned.
File Integrity Monitoring alerts resume.
Dashboard activity returns to expected levels.

Method 5: Upgrade to the Latest Wazuh Agent

Older agent versions may not be fully compatible with newer macOS privacy requirements.

Keeping the agent updated ensures compatibility with Apple’s latest security changes.

Install the Latest Supported Release

Upgrade to the newest supported Wazuh agent version recommended for your deployment.

Verify Compatibility with the Installed macOS Version

Confirm that your installed macOS release is supported by the Wazuh version you’re running.

Compatibility issues can sometimes appear after major macOS upgrades if the agent has not been updated accordingly.

Confirm Permission Persistence After Upgrading

After completing the upgrade:

Verify the agent still has Full Disk Access.
Review the agent logs for permission-related errors.
Perform a File Integrity Monitoring test.
Confirm alerts appear correctly in the Wazuh dashboard.

Verifying the Fix

After granting Full Disk Access (FDA), don’t assume the problem is solved simply because the Wazuh agent is running.

Verify that the agent has regained access to protected resources and is once again collecting complete endpoint telemetry.

Performing the following checks ensures the permission has been applied correctly and that monitoring has been fully restored.

Confirm Protected Directories Are Accessible

The first step is to verify that the Wazuh agent can access directories previously restricted by macOS.

Review your File Integrity Monitoring (FIM) configuration and confirm that monitored locations such as user home directories or other protected paths are no longer generating permission errors.

You should no longer see messages such as:

Operation not permitted
Permission denied
Access denied
Unable to open monitored directory

If these errors persist, confirm that:

Full Disk Access is still enabled.
The correct Wazuh agent executable has been authorized.
The agent has been restarted after granting permission.

Verify File Integrity Monitoring Alerts

Next, perform a controlled File Integrity Monitoring test to confirm that protected files are once again being monitored.

For example:

Create a file inside a monitored directory.
Modify the file.
Rename the file.
Delete the file.

Within a short period, corresponding FIM alerts should appear in the Wazuh manager.

Successful detection confirms that the agent has regained visibility into protected filesystem locations.

Review Fresh Agent Logs

After restarting the agent, inspect the newest log entries rather than relying on older log files.

Verify that:

Permission-related errors have disappeared.
Directory scans complete successfully.
File monitoring initializes normally.
No new access-denied messages are generated.

Clean logs are one of the strongest indicators that the privacy issue has been resolved.

Confirm Security Events Reach the Wazuh Manager

The next step is verifying that endpoint telemetry is successfully reaching the Wazuh manager.

Confirm that:

File Integrity Monitoring events are arriving.
Inventory updates continue normally.
Security-related log events appear.
Newly generated alerts are processed without delay.

If events are still missing, investigate other possible causes such as agent connectivity or log collection configuration.

Check the Wazuh Dashboard for New Activity

Finally, review the Wazuh dashboard to ensure endpoint activity reflects normal monitoring.

Look for:

Recent FIM alerts
Updated event counts
New security events
Healthy agent status
Normal endpoint activity over time

The dashboard should now display a steady stream of telemetry instead of the unusually quiet behavior typically seen when Full Disk Access is missing.

Wazuh Dashboard Not Loading? Complete Troubleshooting Guide

macOS Security Considerations

Granting Full Disk Access is an important step, but it’s equally important to understand how it fits within Apple’s broader security architecture.

Several macOS security features work together to protect sensitive data while still allowing trusted security software like the Wazuh agent to perform endpoint monitoring.

Apple TCC Privacy Framework

Apple’s Transparency, Consent, and Control (TCC) framework governs access to sensitive user data and protected system resources.

Rather than granting unrestricted filesystem access based solely on administrative privileges, TCC requires explicit user or administrator approval before an application can access protected locations.

This approach helps prevent malware from silently harvesting sensitive information while ensuring trusted security applications receive only the permissions they genuinely require.

Apple documents TCC as one of the core privacy protections built into modern versions of macOS.

System Integrity Protection (SIP)

Another important macOS security feature is System Integrity Protection (SIP).

Unlike Full Disk Access, SIP protects critical operating system files from being modified, even by the root user.

SIP helps prevent:

Unauthorized system modifications
Malware persistence
Rootkits
Tampering with protected operating system components

Granting the Wazuh agent Full Disk Access does not disable SIP and does not allow the agent to bypass SIP protections.

The two security mechanisms serve different purposes and operate independently.

Full Disk Access vs Accessibility Permissions

Administrators sometimes confuse Full Disk Access with Accessibility permissions because both appear under Privacy & Security in macOS.

However, they authorize completely different capabilities.

Full Disk Access allows applications to:

Read protected files
Monitor restricted directories
Access protected application data

Accessibility permissions allow applications to:

Control user interface elements
Simulate keyboard input
Control the mouse
Interact with other applications

The Wazuh agent typically requires Full Disk Access, not Accessibility permissions, for proper endpoint monitoring.

Granting the wrong permission will not resolve missing filesystem visibility.

Impact of macOS Version Changes

Apple regularly enhances macOS security with each major release.

Privacy protections may evolve through:

Expanded TCC coverage
Additional protected directories
Changes to application code-signing validation
Updated privacy databases
New security policies

Because of these changes, organizations should always validate Wazuh monitoring after upgrading macOS.

Even if the agent remains connected, privacy settings should be reviewed to ensure Full Disk Access has been preserved.

Best Practices for Managing Full Disk Access

Properly configuring Full Disk Access once is only part of maintaining reliable endpoint monitoring.

The following best practices help prevent future monitoring gaps and reduce administrative overhead across your macOS fleet.

Deploy Permissions Using MDM

In enterprise environments, manually approving Full Disk Access on every endpoint is inefficient and error-prone.

Instead, deploy Privacy Preferences Policy Control (PPPC) profiles through your Mobile Device Management (MDM) platform.

Benefits include:

Consistent deployments
Reduced user involvement
Centralized policy management
Faster onboarding of new devices
Lower risk of accidental permission removal

Apple recommends using managed PPPC profiles whenever possible for enterprise deployments.

Document Required macOS Permissions

Maintain clear deployment documentation describing every permission required by the Wazuh agent.

Documentation should include:

Full Disk Access requirements
Installation procedures
Validation steps
Upgrade considerations
Troubleshooting guidance

Standardized documentation reduces configuration inconsistencies and simplifies future deployments.

Verify Permissions After Every Upgrade

Both macOS upgrades and Wazuh agent upgrades can affect privacy permissions.

After every upgrade:

Verify Full Disk Access is still enabled.
Review recent agent logs.
Test File Integrity Monitoring.
Confirm normal event collection.

Making permission verification part of your upgrade checklist helps catch issues before they impact security monitoring.

Regularly Test File Integrity Monitoring

Do not wait for an incident to discover that File Integrity Monitoring has stopped working.

Schedule periodic validation tests by creating controlled file changes within monitored directories.

Confirm that:

File creation generates alerts.
Modifications are detected.
File deletions are reported.
Hash changes appear correctly.

Routine testing provides confidence that endpoint monitoring remains operational.

Keep Wazuh Agents Updated

New Wazuh releases frequently include:

macOS compatibility improvements
Bug fixes
Security enhancements
Performance optimizations
Support for newer operating system releases

Running supported agent versions helps minimize compatibility issues introduced by Apple’s evolving security model.

Monitor Agent Health Continuously

A healthy agent should be evaluated using more than its online status.

Regularly monitor:

Event volume
File Integrity Monitoring activity
Log collection rates
Active response functionality
Agent communication health

An endpoint that is connected but producing very little telemetry may indicate a permissions issue rather than a connectivity problem.

Audit Endpoint Permissions Periodically

Perform periodic audits to ensure all managed macOS endpoints still have the required privacy permissions.

During each audit, verify:

Full Disk Access remains enabled.
No duplicate or stale permission entries exist.
MDM policies are still being applied correctly.
Newly deployed endpoints meet organizational standards.

Regular permission audits reduce blind spots, improve compliance, and help ensure the Wazuh platform continues providing comprehensive visibility across your macOS environment.

Best Practices for Managing Full Disk Access

Maintaining Full Disk Access is just as important as granting it initially.

Changes to macOS, Wazuh upgrades, or enterprise policies can unintentionally remove or invalidate the permission, reducing endpoint visibility without generating obvious errors.

Adopting the following best practices will help ensure consistent monitoring across your macOS environment.

Deploy Permissions Using MDM

For organizations managing multiple Mac devices, manually granting Full Disk Access is not scalable.

Instead, use a Mobile Device Management (MDM) solution to deploy a Privacy Preferences Policy Control (PPPC) profile that automatically approves the Wazuh agent.

Benefits include:

Consistent permission deployment
Reduced user interaction
Centralized policy management
Faster onboarding of new endpoints
Fewer configuration errors

Using MDM also minimizes the risk of users accidentally removing the required permission.

Document Required macOS Permissions

Maintain clear deployment documentation that outlines every permission required for the Wazuh agent to function correctly.

Your documentation should include:

Full Disk Access requirements
Installation steps
Validation procedures
Upgrade considerations
Troubleshooting guidance

Well-documented procedures improve consistency and make it easier for administrators to deploy new endpoints.

Verify Permissions After Every Upgrade

Both macOS updates and Wazuh agent upgrades can affect privacy permissions.

After every upgrade:

Confirm Full Disk Access is still enabled.
Review recent agent logs.
Perform a File Integrity Monitoring (FIM) test.
Verify new events appear in the Wazuh dashboard.

Including these checks in your standard upgrade process helps detect problems before they impact security monitoring.

Regularly Test File Integrity Monitoring

Don’t assume File Integrity Monitoring is working simply because the agent is online.

Periodically create controlled changes to monitored files and verify that Wazuh detects them.

Routine testing should include:

Creating new files
Editing existing files
Renaming files
Deleting files

Successful alerts confirm that the agent still has access to protected locations.

Keep Wazuh Agents Updated

New Wazuh releases often include:

macOS compatibility improvements
Bug fixes
Performance enhancements
Security updates
Support for newer macOS releases

Keeping agents current helps maintain compatibility with Apple’s evolving security model.

Monitor Agent Health Continuously

An online agent is not necessarily a healthy agent.

Monitor key indicators such as:

Event volume
FIM activity
Log collection rates
Alert frequency
Agent communication status

A sudden drop in collected events may indicate a permissions issue rather than a connectivity problem.

Audit Endpoint Permissions Periodically

Perform regular audits to verify that all managed macOS endpoints retain the required privacy permissions.

During each audit, confirm that:

Full Disk Access is enabled.
The correct Wazuh agent is authorized.
MDM policies are still applied.
No duplicate or stale permission entries exist.

Routine audits help identify permission drift before it affects your security posture.

Troubleshooting Persistent Permission Issues

If you’ve granted Full Disk Access but the Wazuh agent still isn’t collecting complete telemetry, additional troubleshooting may be required.

The following scenarios cover some of the most common causes of persistent permission-related issues.

Full Disk Access Is Enabled but Monitoring Still Fails

If Full Disk Access is enabled and monitoring remains incomplete:

Restart the Wazuh agent.
Verify the correct executable has been granted permission.
Review recent agent logs for filesystem errors.
Confirm monitored directories are correctly configured.
Test File Integrity Monitoring with a known file change.

In some cases, a stale TCC entry or outdated configuration may require additional remediation.

Wazuh Agent Does Not Appear in Full Disk Access

If the Wazuh agent isn’t listed under System Settings → Privacy & Security → Full Disk Access, macOS has not registered it for approval.

Possible causes include:

An incomplete installation
An incorrect application path
A failed upgrade
A damaged installation

Reinstalling the agent often recreates the necessary application registration.

Agent Works Until the Next macOS Update

Some administrators notice that monitoring stops immediately after a major macOS upgrade.

When this happens:

Verify that Full Disk Access is still enabled.
Confirm the installed Wazuh version supports the new macOS release.
Perform a File Integrity Monitoring test.
Review Unified Logs for new TCC denials.

Including these checks in every operating system upgrade process helps prevent unexpected monitoring gaps.

Multiple Security Products Cause Permission Conflicts

Running multiple endpoint security products can sometimes introduce unexpected interactions.

Examples include:

Competing File Integrity Monitoring solutions
Multiple EDR agents
Endpoint antivirus software
Device management tools modifying privacy settings

Although Full Disk Access itself is not exclusive, conflicting policies or overlapping monitoring components may interfere with normal operation.

Review recently installed security software if monitoring problems begin after deploying additional endpoint tools.

TCC Database Corruption

In rare cases, the macOS TCC database may become corrupted or contain stale permission entries.

Symptoms include:

Full Disk Access appears enabled but has no effect.
Applications repeatedly request permissions.
Authorized applications lose access unexpectedly.

Resetting the relevant TCC permissions and granting Full Disk Access again often resolves these issues.

If the problem persists across multiple applications, additional macOS troubleshooting may be required.

Collect Diagnostic Information Before Contacting Support

If none of the previous steps resolve the issue, collect diagnostic information before opening a support case.

Useful information includes:

macOS version
Wazuh agent version
Recent agent logs
TCC-related Unified Log entries
File Integrity Monitoring configuration
Screenshots of Full Disk Access settings
Steps that reproduce the issue

Providing complete diagnostic information helps reduce troubleshooting time and enables support teams to identify the root cause more quickly.

Frequently Asked Questions (FAQ)

Question: Why does Wazuh need Full Disk Access on macOS?

Wazuh requires Full Disk Access to monitor files and directories protected by macOS’s Transparency, Consent, and Control (TCC) framework.

Without this permission, the agent cannot fully perform File Integrity Monitoring, collect certain security events, or inspect protected filesystem locations, resulting in reduced endpoint visibility.

Question: How do I know if Wazuh is missing Full Disk Access?

Common indicators include:

File Integrity Monitoring stops detecting changes.
Protected directories are never scanned.
Permission denied or “Operation not permitted” errors appear in the agent logs.
The agent is connected but generates very few alerts.
macOS security events are missing from the Wazuh dashboard.

Question: Can Wazuh monitor macOS without Full Disk Access?

Yes, but only partially.

The agent can still communicate with the Wazuh manager and collect some basic system information.

However, monitoring of protected files, directories, and certain security-related resources will be incomplete, reducing the effectiveness of threat detection and compliance monitoring.

Question: Does reinstalling the Wazuh agent restore permissions?

Not necessarily.

Reinstalling the agent may recreate its application registration, but you’ll often need to grant Full Disk Access again.

After reinstalling, always verify that the agent appears under Privacy & Security → Full Disk Access and that the permission is enabled.

Question: Can I deploy Full Disk Access automatically?

Yes.

Organizations managing multiple Macs can deploy Full Disk Access automatically using an MDM solution with a Privacy Preferences Policy Control (PPPC) profile. This approach provides consistent permission management across all managed endpoints.

Question: Does every macOS version require Full Disk Access?

Modern versions of macOS that implement the TCC privacy framework require Full Disk Access for applications that need access to protected files and directories.

As Apple continues strengthening privacy protections, ensuring the Wazuh agent has the appropriate permissions remains an essential deployment step.

Question: What logs should I check for permission errors?

Start by reviewing:

Wazuh agent logs
macOS Unified Logs
File Integrity Monitoring logs
Wazuh manager logs (to verify event reception)

Look for messages indicating permission denials, inaccessible files, or TCC-related access restrictions.

Conclusion

Granting Full Disk Access is essential for enabling the Wazuh agent to deliver comprehensive security monitoring on macOS.

Without it, important capabilities such as File Integrity Monitoring, security event collection, malware detection, and compliance auditing are significantly limited, even if the agent appears healthy and connected.

Throughout this guide, we’ve covered the most common causes of missing Full Disk Access, how to recognize the symptoms, verify the root cause, and apply the appropriate fixes.

In many cases, simply granting or restoring the permission resolves incomplete monitoring, but administrators should also consider factors such as macOS upgrades, agent reinstalls, MDM policy changes, and TCC database issues when troubleshooting persistent problems.

After applying any fix, always verify that:

Protected directories are accessible.
File Integrity Monitoring detects new file changes.
Permission-related errors no longer appear in the agent logs.
Security events are reaching the Wazuh manager.
The Wazuh dashboard reflects normal endpoint activity.

For organizations managing multiple macOS devices, deploying Full Disk Access through an MDM solution, regularly auditing endpoint permissions, and validating monitoring after every operating system or agent upgrade are the most effective ways to prevent future issues.

Combined with ongoing agent health checks and routine File Integrity Monitoring tests, these practices help ensure your Wazuh deployment continues to provide the complete visibility needed to detect threats and protect your macOS endpoints.