Windows vs macOS
ElevateIQ runs on both Windows and macOS. Most controls are the same on each; a few differ because of what each operating system allows an agent to do. This page lays out exactly what works where so you can plan a mixed fleet with no surprises.
At a glance
The legend below is used in the tables: Full the feature works the same as the other platform, Partial it works with a platform difference noted, Setup it works after a one-time permission, and No not available on that platform.
Privilege elevation
| Capability | Windows | macOS | Notes |
|---|
| Time-boxed admin elevation (grant + auto-revoke) | Full | Full | Same request, approval and countdown flow; the grant is revoked automatically when the window ends, and after a reboot or agent restart. |
| Cloud-approved admin sessions (approve on web or phone) | Full | Full | The agent polls for the decision; approving on the web console or the iOS Approver app grants the session on the endpoint. |
| Rule-based auto-approval | Full | Full | Publisher, path, hash and OS-tag rules evaluate the same on both. |
| Local admin downgrade / removal | Full | Full | Standing local admins are reported on check-in and can be downgraded or removed from the console. |
| Per-app elevation of a specific installer (UAC) | Full | Partial | Windows elevates a specific process with injected credentials. On macOS, elevation is a time-boxed admin session rather than a single-process UAC prompt. |
Multi-factor and offline
| Capability | Windows | macOS | Notes |
|---|
| MFA on elevation (TOTP + passkey) | Full | Full | The agent runs the passkey assertion locally; the daemon makes the verification hops. |
| Offline elevation PIN | No | Full | A time-based PIN that elevates with no network (per-user brute-force lockout) ships on macOS today. On Windows it is on the roadmap; meanwhile the last-known-good cache below already covers the offline case. |
| Last-known-good cache when the server is unreachable | Full | Full | The USB device list and active access grants show the last data the agent saw, marked "offline," instead of an empty list. |
USB and device control
| Capability | Windows | macOS | Notes |
|---|
| Block / allow USB and SD/MMC storage | Full | Full | Hard deny by default, with a tray "request access" flow and console approval. On macOS this needs no special permission or MDM. |
| Request access + approve, per device | Full | Full | Same request / approve / rule model; an approved rule survives the device being unplugged and re-inserted. |
| Auto-allow infrastructure (hubs, Type-C, hypervisor) | Full | Full | Bus infrastructure is exempt on both so you are never blocking a hub or a dock. |
| Block malicious HID (rubber-ducky keystroke injection) | Full | No | Windows can enforce non-storage device classes. macOS only exposes storage devices to a userland agent, so HID-class defense is not possible without a kernel extension. |
| Block before first mount | Full | Full | macOS vetoes the mount via Disk Arbitration, so a denied drive never mounts. |
Application allowlisting
| Capability | Windows | macOS | Notes |
|---|
| Allow / block which applications run | Full | Setup | On macOS this uses Apple's Endpoint Security framework, which needs the background helper approved (pushed silently by an MDM, or turned on once by hand). See Deploying on macOS. |
| Confidence score + AI/ML risk analysis | Full | Full | Scoring happens server-side, so it is identical on both platforms. |
Access, technician and inventory
| Capability | Windows | macOS | Notes |
|---|
| Access grants (time-boxed access to printers, network, date and time) | Full | Full | Granted through group membership for the grant window, then reverted automatically. |
| Technician mode (QR-paired elevated session) | Full | Full | Same QR pairing flow from the tray. |
| Inventory + local-admin reporting on check-in | Full | Full | Hardware, OS and standing-admin posture are reported the same way. |
| Org branding + contact "Info" panel in the tray | Full | Full | The tray shows your logo, name and support contact. |
| Silent install with baked config + auto-enroll | Full | Full | Windows ships one signed MSI; macOS ships a signed .pkg. Both self-enroll on first run from baked or MDM-pushed settings. |
Signing in: web console vs iOS Approver
The web console and the iOS Approver app are two ways into the same account, but they do not do the same job. The web console is where an organization is created and managed. The Approver app is a free companion for administrators who already belong to an organization: it exists so an approval can be actioned from a phone. Creating an organization is a web action only.
| Action | Web console | iOS Approver | Notes |
|---|
| Create a new organization (sign up) | Full | No | Organizations are created on the web. The app has no sign-up flow; it signs in existing administrators only. |
| Sign in with email and password | Full | Full | Multi-factor applies on both when it is enabled for the account. |
| Sign in with Microsoft or Google | Full | Full | The provider verifies the mailbox, so no separate email confirmation is needed. |
| Sign in with Apple | Full | Full | On the web an Apple sign-in can also create a new organization. In the app it signs in an existing member only. |
| Sign in with a passkey | Full | Full | Face ID or Touch ID on the device; no password involved. |
| Sign in when the account has no organization yet | Partial | No | On the web, a person with no organization is offered registration. In the app they are told to ask their administrator for an invitation, because the app cannot create one. |
| Switch between organizations | Full | Full | An administrator who belongs to several organizations can change scope in both. |
| Delete your account | Full | Full | Both schedule deletion after a 30-day grace period. Cancelling a scheduled deletion is done in the web console under Settings. |
| Approve or deny a request | Full | Full | This is the app's main purpose: a push notification arrives and the decision can be made without opening a laptop. |
| Manage rules, reports and billing | Full | No | Configuration and account administration live in the web console. |
If you are invited to an organization, sign in with whichever method matches the address the invitation was sent to. If a sign-in method reports that no organization is linked to it, the account simply has not been added to one yet: ask an administrator to send an invitation.
Deployment
| Aspect | Windows | macOS |
|---|
| Installer | One self-contained signed MSI (wrap in Intune as-is) | One signed .pkg (upload to any MDM, or install from the command line) |
| Zero-touch config | MSI properties (API URL, tenant, org, dev mode) | Baked install profile, or an MDM managed preference |
| Extra OS permission needed | None | Background helper approval, for application allowlisting only |
| Works on an unmanaged machine | Yes | Yes, USB control and elevation work with zero setup; allowlisting needs the one-time permission |
Everything customer-facing, the web console, approvals, reports, rules and risk scoring, is identical regardless of which platform an endpoint runs. The differences above are only in what the on-device agent can enforce.