Kandji Privacy/System Extension Profile Not Applying

- Approved app is blocked by missing permissions on managed Mac. - Security/network extension remains in pending or blocked state. - Users are prompted for controls that should be silently managed.

- Profile payload mismatch for app bundle/team identifier. - Profile conflict with existing local or legacy management payload. - OS update changed extension/permission behavior requiring policy update.

Document whether the issue affects one user, multiple users, or multiple devices. Confirm exact error messages, recent changes (password reset, update, network change), and whether the same issue reproduces in web vs desktop workflows where applicable.

Confirm the user is signed in with the correct corporate account, system time is accurate, network/VPN connectivity is stable, and the application is not running in offline or limited mode.

Use the command snippets below to collect non-destructive diagnostics. Capture output in the ticket when escalation may be required. Avoid deleting profiles, cached credentials, or managed app data unless the runbook or admin approval explicitly allows it.

- Verify profile payload identifiers and deployment scope in Kandji. - Check endpoint profile install status and conflict indicators. - Re-push corrected profile through approved blueprint/policy path. - Retest affected workflow after restart/login cycle where required.