Standard users may occasionally see a macOS prompt asking for an administrator name and password when an app tries to update itself. This prompt is not shown by App Catalog: the Catalog Agent will never asked for admin credentials.

Cause

Many apps ship with their own update mechanism, such as Sparkle, Squirrel or a vendor-specific updater. When such an app tries to update itself in /Applications, macOS asks for administrator credentials because standard users are not allowed to modify apps in this location.

As App Catalog already keeps these apps up to date, the built-in updater is redundant and only causes friction for standard users.

Solution

Disable the app's built-in update mechanism and let App Catalog handle all updates. The recommended way is to deploy a managed preference (Configuration Profile) using your MDM solution.

Sparkle

Sparkle is a widely used open source update framework. Apps using Sparkle can usually be configured with the following keys, using the app's Bundle Identifier as the preference domain:

Not sure what the app's Bundle Identifier is? See Get an app Bundle Identifier.

Squirrel

Squirrel is the update framework used by most Electron-based apps. Squirrel does not offer standard preference keys: whether the updater can be disabled — and how — is up to the app vendor. Refer to the vendor's deployment documentation.

Note: only disable the built-in updater for apps that are updated by App Catalog. Apps from the Mac App Store, Microsoft 365 and Adobe Creative Cloud are handled differently, see Updating apps.