How to Check if Your Work Mac Is Being Monitored

To check if your work Mac is being monitored, open System Settings > Privacy & Security and read three lists: Screen & System Audio Recording, Input Monitoring and Accessibility. A tool that watches your screen or your typing must appear in one of them, by name. Then open Terminal and run profiles status -type enrollment: MDM enrollment: Yes means your company manages the Mac and can install software on it without asking. The six checks below take about 10 minutes, change nothing and need no admin password.

Six checks on a work Mac

The general version for Windows and Mac, with the network checks in full, is in how to tell if you are being monitored at work.

Check 1: is the Mac enrolled in MDM?

profiles status -type enrollment

Enrolled via DEP: Yes means the Mac was set up for your company before it reached you (Apple Business Manager). MDM enrollment: Yes means a management server such as Jamf, Kandji or Intune controls it. You can also look in System Settings > General > Device Management. Enrollment does not watch you by itself. It is the channel IT uses to install software, including a monitoring agent, with no prompt on your side.

Check 2: which apps can see your screen and keys

In System Settings > Privacy & Security, open each list:

• • Screen & System Audio Recording: apps that can capture the screen. Zoom, Teams and Slack belong here for screen sharing. An app you do not recognize does not.

• • Input Monitoring: apps that can read the keyboard and mouse. This is what a keystroke logger needs.
• • Accessibility: apps that can read and control other apps' windows.

The fastest way there is to paste x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture into Safari's address bar, or run it with open in Terminal; on macOS 26.5.2 it opened that list directly. The matching Privacy_ListenEvent link for Input Monitoring did not work in our test; it opened the General page, so go through Privacy & Security for that one.

macOS 15 and later also ask you again from time to time whether an app may keep recording the screen, unless IT turned that prompt off. When an app records the screen, a recording icon appears in the menu bar. If you see it with no call or screen share running, find out which app holds it.

Check 3: permissions IT approved for you

A company can pre-approve screen recording and input monitoring through a configuration profile, so the app never asks. These grants appear in the lists from Check 2, sometimes with the switch greyed out. To see them in Terminal:

# lists privacy payloads in installed profiles: ScreenCapture, ListenEvent (input), PostEvent, Accessibility
system_profiler SPConfigurationProfileDataType | grep -iE 'ScreenCapture|ListenEvent|PostEvent|Accessibility' | sort -u

No output means no profile grants those rights. A line with ScreenCapture or ListenEvent means some app has the right by company policy. The profile names are in System Settings > General > Device Management.

Check 4: background items and extensions

Open System Settings > General > Login Items & Extensions. The Allow in the Background list shows every app that runs helpers while you work, and Extensions shows network and endpoint security extensions. Monitoring agents also install launch daemons, which you can list:

# everything that starts with the Mac and is not from Apple
ls /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents | grep -v '^com\.apple'
systemextensionsctl list

Check 5: known monitoring agents

Open Activity Monitor, choose All Processes, and search for the common names: ActivTrak, Teramind, Hubstaff, Time Doctor, Insightful, Veriato, Controlio, InterGuard, DeskTime. Some agents run under a neutral name, so compare with what you found in Checks 2 and 4. How ActivTrak and similar tools record work is in what is bossware, and which of them log keystrokes is in can my employer see my keystrokes.

Check 6: the browser and the network

Type chrome://management in Chrome or edge://management in Edge. "Your browser is managed by your organization" means policy controls it, and the page lists reporting settings and forced extensions. In Terminal, scutil --proxy shows whether traffic goes through a company proxy. What that exposes is in can my employer see my browsing history.

A script that runs the checks at once

Save this as check-mac-monitoring.sh and run zsh check-mac-monitoring.sh. It only reads, and needs no admin password:

#!/bin/zsh
# check-mac-monitoring.sh - read-only checks, no admin password needed
names='activtrak|teramind|hubstaff|timedoctor|insightful|veriato|controlio|interguard|kickidler|currentware|desktime|workpuls'

echo "== MDM enrollment"
profiles status -type enrollment

echo "== Privacy permissions granted by a profile (screen, input, accessibility)"
system_profiler SPConfigurationProfileDataType 2>/dev/null |
  grep -iE 'ScreenCapture|ListenEvent|PostEvent|Accessibility' | sort -u

echo "== Launch daemons and agents not from Apple"
ls /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents 2>/dev/null | grep -v '^com\.apple'

echo "== System extensions"
systemextensionsctl list | grep -E '^\s*\*'

echo "== Known monitoring agents running"
ps -axo comm | grep -iE "$names" || echo "none found"

We ran it on our own MacBook Pro (macOS 26.5.2, not managed by a company) on 4 October 2026. The output, with our own 19 user launch agents left out:

== MDM enrollment
Enrolled via DEP: No
MDM enrollment: No
== Privacy permissions granted by a profile (screen, input, accessibility)
== Launch daemons and agents not from Apple
/Library/LaunchAgents:

/Library/LaunchDaemons:
com.crystalidea.macsfancontrol.smcwrite.plist
com.docker.socket.plist
com.docker.vmnetd.plist
com.interezen.nwsdaemon.plist
com.raon.touchen.nxkey.plist
com.softforum.anysign.plist
== System extensions
*  *  G43BCU2T37  org.pqrs.Karabiner-DriverKit-VirtualHIDDevice (1.8.0/1.8.0)  [activated enabled]
*  *  W5364U7YZB  io.tailscale.ipn.macsys.network-extension (1.102.4/101.102.4)  [activated enabled]
== Known monitoring agents running
none found

How to read it: no MDM, no profile grants, and no known agent, so nothing on this Mac reports to an employer. The launch daemons are a fan control app, Docker and three Korean banking security modules (interezen, raon touchen nxkey, softforum anysign). The system extensions are Karabiner, a keyboard remapper, and the Tailscale VPN. Karabiner shows why names matter: a driver that sees every key press is normal when you installed it yourself, and a warning sign when you cannot say what it is. scutil --proxy on the same Mac listed only local exceptions and no proxy server.

On a company Mac, expect more lines; the next section says which ones are normal.

What is normal on a work Mac

Most work Macs show MDM enrollment, a security tool such as CrowdStrike Falcon, SentinelOne, Microsoft Defender or Jamf Protect, a VPN client, and Okta Verify or Company Portal. Security tools can log processes, files and network connections for threat detection. They do not take screenshots or report your working hours to a manager.

The signs of activity monitoring are narrower: an app you cannot name in Screen & System Audio Recording or Input Monitoring, a profile that grants ScreenCapture or ListenEvent, or a known monitoring agent in Activity Monitor. A camera light with no call running is its own case, covered in can my employer see me through my laptop camera.

What the checks cannot see

Some records need no software on the Mac. Your company still sees your sign-ins to Microsoft 365, Google Workspace, Okta and Slack, VPN connect times, and messages in company tools. Sign-in and unlock times are logged by macOS itself; see can my employer see when I log into my computer. If you find monitoring, read your company's IT policy before you remove anything: uninstalling a managed agent is visible to IT, and on an MDM Mac it usually comes back.

FAQ

Can my employer see my iMessages on a work Mac? Not through MDM or the network, but screen capture and backups of your user folder can reach them. How to take Messages off the Mac safely is in can my employer see my iMessages on a work Mac.

Can my employer see my screen on a Mac? Only through an app with screen recording rights. It appears in Screen & System Audio Recording, even when IT approved it.

Does MDM mean my Mac is being monitored? Not by itself. MDM manages settings and apps. It lets IT install a monitoring tool without asking you.

Can I see if IT approved screen recording for an app? Yes. Run system_profiler SPConfigurationProfileDataType and look for ScreenCapture in the output.