Admin Privileges for Xcode

Just deploy Xcode updates with Jamf, in the Mac App Store Policy check the box to force updates for the app. There is also a configuration profile that allows non-admins to update Appstore apps.

There are still some functions that need admin access for xcode, but adding users to the _developer local group can mitigate some of that.

I use a script like this for my non admin users and XCode.  Havent tested the ability to update yet so that might be something to try.   Here is the scirpt

#!/bin/bash

#identify and add currently logged in user to the developer group

currentUser=$(`ls -la /dev/console | awk '{print $3}'`)

dscl . append /Groups/_developer GroupMembership "$currentUser"
sleep .5
DevToolsSecurity -enable
sleep .5
#install Xcode command line tools

xcode-select --install

sleep .5
#install additional Xcode applications and accept the license

/Applications/Xcode.app/Contents/Developer/usr/bin/xcodebuild -license accept
sleep .5
installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/MobileDevice.pkg -target /
sleep .5
installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/MobileDeviceDevelopment.pkg -target /
sleep .5
installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/CoreTypes.pkg -target /
sleep .5
installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/XcodeSystemResources.pkg -target /

@a_hebert providing their script it inspired me to dig my script up lol.

Apple added a workflow for _developer group some time back, and made no documentation about it. Several of the checks in Xcode are looking for the user to be a member of administrators or _developer. This is one of the many workflows in Apple software you just have to figure out unfortunately.

Just cleaning up previous scripting so it is easy to copy and read.

 

#!/bin/zsh --no-rcs

#*=======================================================
#* Script Name: Xcode_Developer_GroupPrivilege #* Created: #* Author:
#* Purpose:
#* - Remap the authorization policies so members of the _developer group
#* - Add $ActiveUser to _developer
#*=======================================================
#* GLOBAL VARIABLE
#*=======================================================
DIV1='echo ####################################################################'
DIV2='echo --------------------------------------------------------------------'
DIV3='echo ....................................................................'
ActiveUserID=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }')
ActiveUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'| tr "[a-z]" "[A-Z]")
ActiveUserRealName=$(dscl . -read /Users/$ActiveUser| grep RealName:| cut -c11-)
if [[ -z $ActiveUserRealName ]]; then
	ActiveUserRealName=$(dscl . -read /Users/$ActiveUser| awk '/^RealName:/,/^RecordName:/'| sed -n 2p | cut -c 2-)
fi
#*=======================================================
#* BODY
#*=======================================================
# Remap the authorization policies for _developer group
echo "Remaping authorization policies for _developer group"
sudo DevToolsSecurity -enable
$DIV3
# Checking for User ID in _developer group
echo "Checking group membership for _developer"
GroupMembershipCheck=$(sudo dscl . read /Groups/_developer | grep "$ActiveUserID")
if [[ -z $GroupMembershipCheck ]]; then
	echo "...User id ($ActiveUserID) was not found in _developer group"
	echo "...Proceeding to add user $ActiveUserID to _developer group"
	# Add ActiveUser id to the _developer group
	echo "...Append $ActiveUserID to _developer group"
	sudo dscl . append /Groups/_developer GroupMembership $ActiveUserID
else
	echo "...User id ($ActiveUserID) already in _developer group"
	echo "...No further action needed"
	exit
fi
$DIV3
#*=======================================================
#* END
#*=======================================================