Issue with moblieconfig for Privileges 2

[LAD-JasonS]

We've attempted to use the mobile config with modifications to suite our needs, but when it's deployed to the user device, it will not let them elevate their priviliges.

`

PayloadContent PayloadContent corp.sap.privileges Forced mcx_preference_settings

							<key>ExpirationInterval</key>
							<integer>15</integer>
															
							<key>ExpirationIntervalMax</key>
							<integer>20</integer>
							
							<key>EnforcePrivileges</key>
							<string>none</string>
                            
                        
                            <key>RequireAuthentication</key>
                            <true/>
                            
                            
                            <key>AllowCLIBiometricAuthentication</key>
                            <true/>
                            
                            
                            <key>PostChangeExecutablePath</key>
                            <string>/Library/Application Support/Privileges/privileges_changed.sh</string>
                            
                           
                            <key>PostChangeActionOnGrantOnly</key>
                            <true/>
                            
                          
                            <key>RevokePrivilegesAtLogin</key>
                            <false/>
                            
                           
                            <key>HideOtherWindows</key>
                            <true/>
                                                            
                            
							
							<key>ReasonRequired</key>
							<true/>
							
							
                            <key>ReasonMinLength</key>
							<integer>30</integer>
							
                            
                            <key>ReasonMaxLength</key>
                            <integer>250</integer>
                            
							
                            <key>ReasonPresetList</key>
							<array>

								<dict>
									<key>en</key>
									<string>For installing software</string>
									<key>es</key>
									<string>Para la instalación de software</string>
                                    <key>en</key>
                                    <string>For testing purposes</string>
                                    <key>es</key>
                                    <string>Para fines de prueba</string>
                                    <key>default</key>
									<string>For installing software</string>
								</dict>

							</array>
                            
                           
                            <key>ReasonCheckingEnabled</key>
                            <true/>
                            
                            
                            <key>HideSettingsButton</key>
                            <true/>
                            
                            
                            <key>HideSettingsFromDockMenu</key>
                            <true/>
							
							
                            <key>RemoteLogging</key>
							<dict>
                                
								<key>ServerType</key>
								<string>syslog</string>
								<key>ServerAddress</key>
								<string>xxx.xxx.xxx.xxx</string>
                                
								<key>SyslogOptions</key>
								<dict>
                                    <key>ServerPort</key>
                                    <integer>xxxx</integer>
                                    <key>UseTLS</key>
                                    <false/>
									<key>LogFacility</key>
									<integer>4</integer>
									<key>LogSeverity</key>
									<integer>6</integer>
									<key>MaximumMessageSize</key>
									<integer>1000</integer>
								</dict>
                                
                        </dict>
							
						</dict>
					</dict>
				</array>
			</dict>
		</dict>
		<key>PayloadDescription</key>
		<string/>
		<key>PayloadDisplayName</key>
		<string>Privileges configuration</string>
		<key>PayloadEnabled</key>
		<true/>
		<key>PayloadIdentifier</key>
		<string>com.apple.ManagedClient.preferences.36132147-235E-4663-ADA8-2664C67C4DD2</string>
		<key>PayloadOrganization</key>
		<string>SAP SE</string>
		<key>PayloadType</key>
		<string>com.apple.ManagedClient.preferences</string>
		<key>PayloadUUID</key>
		<string>36132147-235E-4663-ADA8-2664C67C4DD2</string>
		<key>PayloadVersion</key>
		<integer>1</integer>
	</dict>
</array>
<key>PayloadDescription</key>
<string>Configures the Privileges app.</string>
<key>PayloadDisplayName</key>
<string>Privileges configuration</string>
<key>PayloadEnabled</key>
<true/>
<key>PayloadIdentifier</key>
<string>CF401A42-35CA-4DA6-9123-5A49C87ECB5A</string>
<key>PayloadOrganization</key>
<string>SAP SE</string>
<key>PayloadRemovalDisallowed</key>
<true/>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>50870D16-7AAD-478B-BFFE-BED09499F7E0</string>
<key>PayloadVersion</key>
<integer>1</integer>

`

[mthielemann]

@LAD-JasonS I see several problems with your mobileconfig file. First, setting an ExpirationInterval and ExpirationIntervalMax does not make much sense. Either you configure a fixed interval that the user can't change with ExpirationInterval, or you configure a maximum expiration interval where the user can choose any value up to the configured interval with ExpirationIntervalMax. If you configure EnforcePrivileges with a value of none, it is no longer possible to change privileges with the Privileges application or any of its bundled applications. Therefore, it won't work for you. The ReasonPresetList is not configured properly. Please read the documentation as it explains all settings in detail. Thank you.