If end users are being prompted for a password so an app can "add a new helper tool" or finish installing an update, this isn't specific to any one app — it's a common macOS behavior seen with Slack, Firefox, Claude Desktop, and many other apps that auto-update. This happens because the app doesn't have write permission to update itself in /Applications and needs elevated privileges to install the update.
Why This Happens
macOS restricts write access to /Applications to administrators. When an app is installed there — whether via a .pkg installer or deployed through Addigy — its background updater can't overwrite the app bundle without elevated permissions. To get around this, the updater asks the signed-in user for a password so it can install a small privileged "helper tool" that performs the update on the app's behalf.
This is standard macOS behavior, not a sign of a compromised app. Any app with a self-updater (Slack, Firefox, Claude Desktop, Zoom, and others) can trigger this prompt once it's installed to the system /Applications folder.
Blocking the Prompt (Requires MDM)
The most reliable fix is to disable the app's auto-update behavior via a Custom Profile, then deploy updates through Addigy. This suppresses the prompt entirely since the app never tries to self-update.
Each app manages this setting differently. We recommend configuring these using iMazing Profile Editor — search for the app by name and look for an auto-update managed preference in its payload. Known examples:
-
Slack: Select the Slack Client Management payload and de-select Auto Update. Confirm the box is un-checked and shows a blue dot (indicating it's configured).
-
Firefox: Select the Firefox payload and de-select Firefox Auto Update.
-
Claude Desktop: Select the Claude Desktop payload and select Disable Auto Updates.
After saving the Custom Profile as a .mobileconfig file, refer to How to Configure and Deploy a Custom Profile to deploy it to your devices via Addigy.
Note: If you're managing an app not listed above, check the vendor's enterprise or MDM documentation for an equivalent managed preference (often called "auto update," "disable updates," or similar) before building a Custom Profile. Workflows to disable automatic updates vary by application - please keep in mind that some apps do not support disabling auto updates.
Keeping the App Updated via Addigy
Blocking auto-update stops the prompt, but the app will fall behind unless you push updates on your own schedule. Use PreBuilt Apps in Policy to deploy new versions of Slack, Firefox, Claude Desktop, or any other affected app through Addigy instead.