CA trust tiers

The interception certificate becomes trusted on a device in one of two ways. The CA trust column on the Devices page tells you which one each device is on — and whether it held.

Tier L — Local (the default; no MDM required)

When the agent first needs trust, macOS prompts the employee — for their own login password. That is Apple’s rule about the user trust store, not our choice, and it is worth telling your staff in advance so the prompt is expected rather than alarming. If they approve, the certificate is trusted for their account on that Mac, interception starts, and the device shows Local.

Two things to understand about Tier L, because they are the honest trade for needing no infrastructure:

• The employee can decline — and that is recorded as a person’s choice, not an error. The device shows Declined, its traffic is uninspected, and you decide the follow-up: a conversation, or the MDM profile below. The agent prompts once per enrollment, not on every login — password prompt spam trains exactly the wrong reflex.
• The employee can revoke it later. Local trust lives in the user’s own trust store. The product deliberately chooses detect-not-prevent here: the console shows you which devices are in the employee-revocable state rather than pretending the state can’t exist. That visibility is what makes the tier defensible.

Tier M — MDM-enforced (the upgrade, per device)

Push the device’s CA certificate profile through your MDM. The trust lands in the admin domain — outside the employee’s reach, where removal becomes an MDM-visible event. The device shows MDM-enforced on its next report.

Download ≠ install

The badge does not change when you download the profile — only when the device itself reports the installed trust on a later check-in. A badge that turned green on download would be claiming an enforcement nobody has performed yet.

Which tier should you use?

Tier L makes a device useful the moment it enrolls, with zero infrastructure. Tier M is the posture for devices that must resist an insider willing to quietly remove trust. Many organizations run Tier L broadly and push Tier M profiles to the machines handling the most sensitive data. Neither blocks the other.

One caveat for shared Macs: Tier L trust covers the approving user’s account only. On multi-user machines, use Tier M — details in Limitations.

The badge vocabulary

Badge	Meaning	Your move
Declined	The employee said no to the trust prompt	A person made a choice — talk to them, or push the Tier M profile
Awaiting approval	Prompted; no answer yet	Wait, or chase — an unanswered prompt can sit for days
MDM-enforced	Trusted via your MDM profile, outside employee reach	The strong posture; nothing to do
Local	Trusted via the employee’s own approval	A legitimate steady state — enforced, but employee-revocable
Unknown	Old agent, never reported, or quiet too long	Update the agent / investigate why the device is silent

The full Devices-page column reference is in Device statuses.