Agent Traces: Suppressing macOS Background Notification

Last updated: June 16, 2026

On macOS 13 (Ventura) and later, macOS notifies the user the first time it sees a new background service:

"Software from Attuned Corp. can run in the background."

This is expected, benign behavior. macOS attributes the service to the Developer ID team that signed it — Span (Attuned Corp, team KNH44SBYN4). The notification appears the first time each service is seen on a machine; reinstalls and upgrades do not re-notify.

To prevent the notification from appearing for your users, deploy the configuration profile below through your MDM.

General approach

Deploy a managed configuration profile that allowlists Span's background services:

span-coding-hooks-background-items.mobileconfig

Key points:

  • The profile must be deployed through your MDM as a managed profile to take effect.

  • The profile is allow-only — it only permits Span's background services and cannot disable, block, or change any other setting.

  • It coexists with any existing background-items profiles you have; their entries are preserved.

  • Deploy it before or alongside the Span Coding Hooks installer on new machines so the notification never appears. On machines that already saw the notification once, the profile cleans up the entry going forward.

  • The profile allowlists Span's background services two ways: by Team Identifier (KNH44SBYN4), covering items signed with Span's Apple Developer ID, and by label prefix (com.span.), covering any Span launchd job by name. Both rules are included so every Span background service is matched (currently registry poller invokes /bin/sh directly instead of a binary built and signed by us, which make the launchd job prefix clearing needed).

Conflict safety

This is an additive, allow-only profile. It does not modify or remove any existing configuration. To deploy it safely:

  • Deploy it as a new, separate configuration profile. Do not paste this payload into an existing profile, and do not edit an existing Managed Login Items profile.

  • Keep the PayloadIdentifier values as-provided. Do not reuse an identifier already present in your environment.

  • If your organization consolidates all managed login items into a single profile, append these two rules to that profile's existing Rules array rather than replacing it.

Verification

After the profile lands on a test Mac:

sudo sfltool dumpbtm

Span's services should show as allowed / managed. In System Settings → General → Login Items & Extensions, they appear greyed out as "Managed by your organization," and the user cannot toggle them off. No notification should appear on subsequent installs or upgrades.

Mosyle

  1. Console → Management → Management Profiles → Certificates / Custom Profiles → Add new profile

  2. Upload span-coding-hooks-background-items.mobileconfig.

  3. Assign to the relevant Device group (or user group).

  4. Save — Mosyle deploys it as a managed profile automatically.

Jamf Pro

Either method works:

Native UI (Jamf Pro 11.x+):

  1. Computers → Configuration Profiles → New.

  2. Add the Service Management – Managed Login Items payload.

  3. Add two rules:

    • Team Identifier = KNH44SBYN4

    • Label Prefix = com.span.

  4. Set Scope → Save.

Upload route (any version):

  1. Computers → Configuration Profiles → Upload (next to New).

  2. Select span-coding-hooks-background-items.mobileconfig.

  3. Set Scope → Save.

Create a brand-new Configuration Profile for this — do not add the Managed Login Items payload onto an unrelated existing profile.

Workspace ONE

  1. Resources → Profiles & Baselines → Profiles → Add → Add Profile → Apple macOS → Device.

  2. Fill in General (name + assignment Smart Group).

  3. Add a Custom Settings payload and paste the com.apple.servicemanagement payload XML (the inner <dict>…</dict>, or the full profile depending on your WS1 version's Custom Settings handling).

  4. Save & Publish.

IRU (Kandji)

  1. Library → Add New → Custom Profile.

  2. Name it (e.g. Span Coding Hooks — Background Items Allowlist) and upload span-coding-hooks-background-items.mobileconfig.

  3. Assign the relevant Blueprint(s).

  4. Save — Kandji deploys it as a managed profile.