Automatically Reset Teams Camera and Microphone for User

Contributor III

I wanted to share my method of ensuring Users have the Camera and Microphone enabled for Teams.

Background: As many of you may be aware, the Microphone and Camera TCC privacy options are only adjustable by Users. Some of our users were having issues with the Microphone or Camera for Skype for Business, (not allowing the permissions). I wrote out the following EA and Script to resolve this issue. As we transitioned to Teams, I have redeployed this script to our users.

Solution: I built this script to check for the current logged in User's TCC Camera and Microphone permission. If it see that the Camera or Microphone has been set to not allow, The script will:

1- Check if the app is open, and present the user an AppleScript alert that the app will close in 10 minutes


2- Reset the corresponding permission

(Please be aware that for machines running Mojave and below resetting a single Application's TCC bundle ids does not work properly so the entire microphone or camera TCC settings will be reset. If you have multiple apps that require TCC, please consider the necessity of this script.)

Extension Attribute:
Name: Disabled Microsoft user TCC Values

#This script is created to report disabled Camera or Microphone Security and Privacy access within a logged in user's TCC preferences
#Shaquir Tannis 3-15-2020
# Get current logged in user
loggedInUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }')

# Get current logged in user's home directory
[[ "$loggedInUser" ]] && loggedInUser_home="$(/usr/bin/dscl /Local/Default read /Users/"$loggedInUser" NFSHomeDirectory | /usr/bin/awk '{print $2}')"

if [[ -z "$loggedInUser" ]]; then
elif [ "${loggedInUser}" != "itadmin" ] || [ "${loggedInUser}" != "root" ] || [ "${loggedInUser}" != "" ]; then
    disabledValues=$(/usr/bin/sqlite3 "$loggedInUser_home/Library/Application Support/" 'SELECT service, client FROM access WHERE allowed = '0'' | grep "")

    IFS=" "
    echo "<result>$disabledValues</result>"

Smart Group:
Name: Teams Webcam or Microphone Disabled


Disabled Microsoft user TCC Values is not <Leave Blank>
And (
Disabled Microsoft user TCC Values like kTCCServiceCamera|
Disabled Microsoft user TCC Values like kTCCServiceMicrophone|

Name: Fix Teams Microphone or Camera
Frequency: Once every day
Trigger: Check-in
Scope: Teams Webcam or Microphone Disabled


Contributor III

Interesting approach. Thanks for sharing.


This is very handy, thanks!


Did I miss a step? Seems like AppleScript needs permission to post events?

Executing Policy Fix Teams Microphone or Camera Running script Reset Teams TCC Camera or Microphone... Script exit code: 0 Script result: macOS version is 10.14 so all TCC Microphone or Camera values will be reset Microsoft Teams is running. Will prompt user for permission to close 337:454: execution error: Not authorised to send Apple events to Finder. (-1743) Prompt has completed Closing Microsoft Teams Camera permission reset Re-opening Microsoft Teams


Contributor III

Hi @djrory,
Jamf has a PPPC whitelist for Apple events on their Github: JamfAppleEvents.mobileconfig
Some more detailed info around this can be found Creating Privacy Preferences Policy Control profiles for macOS.

Alternatively, you could change the AppleScript dialog to use jamfhelper for the dialog prompt. The jamfhelper is natively whitelisted through Jamf.

New Contributor II

This is really great @shaquir I am getting an error though. Also are you using this with macOS 11? I would guess it can just be edited to 5 instead go 15 and 11 instead of 10. Please advise about both if you can help.

Script result:
macOS version is 10.5 so all TCC Microphone or Camera values will be reset
Error: no such column: allowed
Permissions Okay