Monitoring SIP-protected applications on updated macOS endpoints
If you plan to update the macOS to a version (for macOS 10.11.x —10.15.x) that exceeds the default supported version for a given DLP Agent version, you must update the agent configuration to continue monitoring applications protected by System Integrity Protection (SIP). If you do not update the agent configuration, the DLP Agent can no longer monitor these applications. The agent continues to monitor all other channels.
For a list of the DLP Agent and macOS versions where SIP monitoring is supported by default, see Default SIP monitoring.
You do not update the agent configuration if you update macOS 11.1. Support for monitoring SIP-protected applications continues by default.