Windows vs macOS
ElevateIQ runs on both Windows and macOS. Most controls are the same on each; a few differ because of what each operating system allows an agent to do. This page lays out exactly what works where so you can plan a mixed fleet with no surprises.
At a glance
The legend below is used in the tables: Full the feature works the same as the other platform, Partial it works with a platform difference noted, Setup it works after a one-time permission, and No not available on that platform.
Privilege elevation
| Capability | Windows | macOS | Notes |
|---|
| Time-boxed admin elevation (grant + auto-revoke) | Full | Full | Same request, approval and countdown flow; the grant is revoked automatically when the window ends, and after a reboot or agent restart. |
| Cloud-approved admin sessions (approve on web or phone) | Full | Full | The agent polls for the decision; approving on the web console or the iOS Approver app grants the session on the endpoint. |
| Rule-based auto-approval | Full | Full | Publisher, path, hash and OS-tag rules evaluate the same on both. |
| Local admin downgrade / removal | Full | Full | Standing local admins are reported on check-in and can be downgraded or removed from the console. |
| Per-app elevation of a specific installer (UAC) | Full | Partial | Windows elevates a specific process with injected credentials. On macOS, elevation is a time-boxed admin session rather than a single-process UAC prompt. |
Multi-factor and offline
| Capability | Windows | macOS | Notes |
|---|
| MFA on elevation (TOTP + passkey) | Full | Full | The agent runs the passkey assertion locally; the daemon makes the verification hops. |
| Offline elevation PIN | No | Full | A time-based PIN that elevates with no network (per-user brute-force lockout) ships on macOS today. On Windows it is on the roadmap; meanwhile the last-known-good cache below already covers the offline case. |
| Last-known-good cache when the server is unreachable | Full | Full | The USB device list and active access grants show the last data the agent saw, marked "offline," instead of an empty list. |
USB and device control
| Capability | Windows | macOS | Notes |
|---|
| Block / allow USB and SD/MMC storage | Full | Full | Hard deny by default, with a tray "request access" flow and console approval. On macOS this needs no special permission or MDM. |
| Request access + approve, per device | Full | Full | Same request / approve / rule model; an approved rule survives the device being unplugged and re-inserted. |
| Auto-allow infrastructure (hubs, Type-C, hypervisor) | Full | Full | Bus infrastructure is exempt on both so you are never blocking a hub or a dock. |
| Block malicious HID (rubber-ducky keystroke injection) | Full | No | Windows can enforce non-storage device classes. macOS only exposes storage devices to a userland agent, so HID-class defense is not possible without a kernel extension. |
| Block before first mount | Full | Full | macOS vetoes the mount via Disk Arbitration, so a denied drive never mounts. |
Application allowlisting
| Capability | Windows | macOS | Notes |
|---|
| Allow / block which applications run | Full | Setup | On macOS this uses Apple's Endpoint Security framework, which needs Full Disk Access (pushed silently by an MDM, or granted once by hand). See Deploying on macOS. |
| Confidence score + AI/ML risk analysis | Full | Full | Scoring happens server-side, so it is identical on both platforms. |
Access, technician and inventory
| Capability | Windows | macOS | Notes |
|---|
| Access grants (time-boxed access to printers, network, date and time) | Full | Full | Granted through group membership for the grant window, then reverted automatically. |
| Technician mode (QR-paired elevated session) | Full | Full | Same QR pairing flow from the tray. |
| Inventory + local-admin reporting on check-in | Full | Full | Hardware, OS and standing-admin posture are reported the same way. |
| Org branding + contact "Info" panel in the tray | Full | Full | The tray shows your logo, name and support contact. |
| Silent install with baked config + auto-enroll | Full | Full | Windows ships one signed MSI; macOS ships a signed .pkg. Both self-enroll on first run from baked or MDM-pushed settings. |
Deployment
| Aspect | Windows | macOS |
|---|
| Installer | One self-contained signed MSI (wrap in Intune as-is) | One signed .pkg (upload to any MDM, or install from the command line) |
| Zero-touch config | MSI properties (API URL, tenant, org, dev mode) | Baked install profile, or an MDM managed preference |
| Extra OS permission needed | None | Full Disk Access, for application allowlisting only |
| Works on an unmanaged machine | Yes | Yes, USB control and elevation work with zero setup; allowlisting needs the one-time permission |
Everything customer-facing, the web console, approvals, reports, rules and risk scoring, is identical regardless of which platform an endpoint runs. The differences above are only in what the on-device agent can enforce.