The MSL Admin Portal

The Admin Portal — MSLAP — is how a Mac running MSL can be told what it is allowed to do. A school, a company, or you on your own Mac can deny particular things: creating instances, reaching the internet, sharing the Mac's home folder, copying an image.

Open it from Window ▸ MSL Admin Portal.

Two audiences, one window#

The window is built for two people who want opposite things from it.

Somebody using a managed Mac opens it to find out why something refused them. That is the whole top half: who set the policy, what it says, and the reason they wrote. A locked-down tool that will not say why it refused is the thing people hate most about managed machines, so MSL always says.

An administrator opens it to see the resolved rules and set them up. That is behind a password.

What it is not#

MSLAP decides what MSL will do. It is not a device management system and does not pretend to be:

• It cannot stop somebody using a Linux shell inside an instance they are allowed to run. Root inside a guest is the guest kernel's business, and nothing on the Mac side can change that — so MSL does not list it as something it can restrict.
• It assumes a Mac being administered by MSLAP is a Mac being administered. If an organisation deploys a policy, the person using that Mac is not a local administrator of it — that is what device management is for. On your own Mac you are the administrator, and there is nothing to defend against.

Where to go next#