> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agen.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Password Prompt During an Update: "VPN Is Trying to Modify Your System Settings"

> Why macOS asks for your password with "VPN is trying to modify your system settings" while AgenShield updates or a device-management profile changes, why cancelling is safe, and how to avoid it.

While AgenShield updates, or while your organization's device-management profile is being updated, macOS can show
this dialog, sometimes several times in a row:

> **VPN is trying to modify your system settings.** Touch ID or enter your password to allow this.

## What this means

The request comes from **System Settings**, not from AgenShield.

AgenShield's network inspection uses a network proxy setting. On Macs set up before your organization's
device-management profile included that setting, AgenShield created it itself. macOS lets you edit a setting an app
created, and System Settings shows it as editable under **Network › VPN & Filters** (named **Filters & Proxies** on
some macOS versions).

System Settings asks whenever network settings change underneath its **VPN & Filters** page while that page is
open: during an AgenShield update, macOS restarts AgenShield's network extension and the proxy setting with it; when
your organization updates its profile, macOS removes and re-adds the profile's network settings. In both cases the
open page tries to save what it shows, and macOS asks an administrator to approve that.

Cancelling the dialog, or closing System Settings, changes nothing: the update or the profile is applied anyway, and
AgenShield keeps protecting the Mac. Closing System Settings also makes the dialog go away.

Affected: 2026.10.2 and earlier. 2026.10.3 and later wait for System Settings to close before restarting the network
extension, and on managed Macs remove the older setting once.

## How to stop it

* **Close System Settings while AgenShield updates or while IT pushes a profile change.** Later AgenShield releases
  wait for it to close, for up to 10 minutes, before restarting the network extension, and `agenshield upgrade` says
  so instead of asking you to restart. If the dialog appears, click **Cancel** or close System Settings.
* **On a Mac managed by your organization**, once its profile includes the network proxy, AgenShield removes the
  older setting it created itself. After that, AgenShield updates no longer ask about it. A profile change your
  organization makes while System Settings is open can still show the dialog; cancelling it is safe.

  On an administrator account AgenShield removes the setting on its own, once, at a quiet moment: within a few
  minutes of an update or a login, or after the Mac has been idle for 10 minutes, and never while System Settings is
  open. Usually this needs nothing from you, and AgenShield then shows:

  > **AgenShield finished a network update**
  > Your organization’s device-management profile now provides AgenShield’s network proxy, so AgenShield removed
  > the older copy it created itself. Nothing for you to do; macOS no longer asks about that copy when AgenShield
  > updates.

  Until then, the AgenShield menu bar window, and the **Overview** of the AgenShield dashboard, offer a
  **Remove old copy** button that does the same thing right away. On a standard account, or if macOS asks for a
  password during the automatic removal, AgenShield shows this notification instead. A password dialog shown during
  the automatic removal stays until someone answers it; cancelling it is safe.

  > **One last approval for AgenShield**
  > Your organization now manages AgenShield’s network proxy through its device-management profile. AgenShield will
  > remove the older copy it created itself, the one macOS asks about during updates. macOS may ask for an
  > administrator’s password once to remove it.

  Choose **Remove old copy**. Any password dialog comes from AgenShield in the menu bar, including when you click the
  button in the dashboard, so the menu bar app must be running. If you dismiss the notification nothing changes, and
  it comes back after a day. If you cancel the password dialog, nothing is removed and AgenShield offers again after a
  day; the dashboard card says so meanwhile. If the dialog asks for an administrator password on a standard account,
  ask your IT team.

## How to confirm

Open **System Settings › Network › VPN & Filters** (or **Filters & Proxies**). Before the older setting is removed you see
two **AgenShield Transparent Proxy** entries: one greyed out and marked as managed by your organization, and one you
can edit. After, only the managed entry remains.

## For administrators

Current AgenShield profiles from the Frontegg Portal include the network proxy. If your MDM holds an older copy of
the all-in-one profile, download the campaign profile again and replace it. macOS applies a profile update by
removing and re-installing it, which briefly restarts AgenShield's extensions; current releases bring them back on
their own. See [Network filter off after a profile change](https://docs.agen.co/troubleshoot/network-filter-off-after-profile-change.md)
for older releases.

## When to escalate

If the dialog appears while System Settings is closed, download a
diagnostics bundle from the AgenShield app and contact support. Mention whether the signed-in account is an
administrator. See [Collecting diagnostics](https://docs.agen.co/troubleshoot/collecting-diagnostics.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.