Central management of local configuration is a great boon for IT departments in the modern era. It allows us to, for example, make sure that your screen locks itself when you wander off to blather about whatever nonsense you watched last night to your officemates while a bunch of customer social security numbers is in plain view on your monitor. Apple allows this, broadly, but Apple doesn't let you centrally manage certain things (camera, microphone, Location Services) even if you're a corporate customer using an approved MDM so you can't stalk people. OK, fine, I get it, Apple wants to protect people's privacy. (Or more precisely, Apple wants to make itself the gatekeeper of people's privacy...)
This was annoying during the early days of the pandemic when everyone switched to remote access, because they had to manually give permission to videoconferencing apps, but usually it was fairly straightforward to do so - you were quite obviously prompted, and if you didn't, your mic/camera didn't work, so it behooved you to actually read the fucking words on the fucking screen and perform the fucking changes so you could participate in your fucking meeting for your fucking email job.
Recently we've moved away from a "traditional" phone system in our organization to a software-based solution. Your computer is now your phone! Wow such 21st century! Many future! So scifi! There's a problem, though, that apparently that silly Federal gubbamint says that any phone system needs to relay location data when a 911 call is made, so they know where to send the SWAT teams. How this works is Fucking Magic to legislators and the general public, but as a savvy IT professional you understand that what it means is that your telephony app has to be granted permissions by Location Services to share that location data.
Except, unlike in the hoary days of 2020, there's much less in-your-face notification about this, and your phone works perfectly well if you never grant this permission. So despite our pleadings, many people don't turn this on.
Last week we went on organization-wide lockdown after a (hoaxed, as it turns out) terrorist threat was made. Once the xanax had worn off and everyone's assholes unclenched, we began a furious round of finger pointing about all the things that could have been done differently, and as it turns out auditing who hasn't turned on Location Services and made sure our telephony app has access has come into the crosshairs.
So I'm stuck between Apple's snotty indifference to the needs of corporate customers, the laws of the Federal government, and an organization-wide moral panic, and have spent the past day and a half figuring out how to extract this info.
(For the real nerds: Finding out if Location Services is enabled or not is actually pretty easy; the trick is figuring out which users have given which apps permission. Parsing the /var/db/locationd/clients.plist seems one way to do this, but it seems Apple changed how the formatting of that plist works over the last 3 versions, and I'm not 100% clear if interrogating it only tells me what the setting is for the current console user, which is *probably* Good Enough... if that's the case, which I'm not sure of!)
