Introduction
Level creates a dedicated service account on macOS for two purposes:
Installing restart-requiring macOS system updates on Apple Silicon Macs
Running Level-managed FileVault enable, disable, and recovery-key rotation actions on Apple Silicon and Intel Macs
The account lets Level perform these operations without an interactive user session.
It's created automatically during agent installation. If you skipped the prompt at install time or need to manage it later, you can do so via the command line.
What the Service Account Is
The Level service account is a system account used for macOS updates and FileVault actions. It's not a user account in any practical sense.
No admin privileges
No login privileges (no home folder, no shell)
Hidden in the login window and Users & Groups preferences
If FileVault is enabled, the account is visible at startup and can unlock the drive
Removed automatically when the Level agent is uninstalled
ℹ️ NOTE: Level uses the service account for restart-requiring macOS system updates on Apple Silicon. Level-managed FileVault actions use the account on both Apple Silicon and Intel Macs.
Manual Setup
If the service account wasn't created during install, run this command as an administrator on the target device:
sudo /usr/local/bin/level --create-service-account
You'll be prompted for an admin username and password. These credentials must belong to an existing local macOS administrator on the device with a SecureToken. An administrator identity used only to sign in to an MDM console does not meet this requirement.
💡 TIP: For scripted or MDM-based setup, pass the local administrator credentials as flags to skip the interactive prompt:
Example
sudo /usr/local/bin/level --create-service-account --admin-name=adminuser --admin-password=adminpass
After creation, verify the account:
sudo /usr/local/bin/level --check-service-account
For an MDM deployment, make sure the administrator account exists locally on each Mac and has a SecureToken before running the command in a post-install script. Store the credentials using your MDM's protected secret mechanism.
CLI Reference
ℹ️ NOTE: Service account commands are available on Apple Silicon and Intel Macs. Run them as root with sudo. The general level --check output includes a Service account row only on Apple Silicon; use --check-service-account to verify the account directly on either architecture.
All options require the full path to the Level agent binary: /usr/local/bin/level
Option | Description |
| Checks whether a Level service account exists on this device |
| Creates a new Level service account |
| Removes the Level service account |
| Admin username for |
| Admin password for |
⚠️ WARNING: Deleting the service account with --delete-service-account prevents Level from installing restart-requiring macOS system updates on Apple Silicon and from running Level-managed FileVault actions until the account is recreated.
macOS Secure Tokens
Why does --create-service-account fail with "The provided admin credentials are valid, but the account lacks a secure token"?
Whenever Level creates the service account, macOS requires the local administrator authorizing the operation to hold a SecureToken. This requirement applies on both Apple Silicon and Intel Macs, even if FileVault is not enabled when the account is created. The Level service account also receives a SecureToken so it can perform operations that require FileVault access. If the admin credentials you pass to --create-service-account don't have a SecureToken, the agent fails with this error even though those credentials are otherwise valid administrator credentials.
This is most commonly hit when the admin account was created by a Jamf PreStage Enrollment (or another MDM prestage) without Bootstrap Token escrow. Those accounts are real admins, but they aren't automatically granted a SecureToken.
How do I check whether an admin account has a SecureToken?
sysadminctl -secureTokenStatus <adminuser>
If the output is ENABLED, that account can authorize --create-service-account. If it's DISABLED, you'll need to either use a different admin or grant this one a SecureToken first.
How do I get a SecureToken on the admin account I want to use?
There are three common paths, depending on the state of the device:
Setup Assistant (cleanest, for new devices). The first interactive user through Setup Assistant is automatically granted a SecureToken. If that's the admin you intend to use for Level deployment, no further action is needed.
Bootstrap Token via MDM (recommended for fleet deployments). Configure your MDM's prestage enrollment to create a Managed Local Administrator Account with Bootstrap Token escrow enabled. In Jamf, this is set on the PreStage Enrollment under Account Settings. The MDM then grants that admin a SecureToken at enrollment, and you can pass its credentials to
--create-service-accountnon-interactively.Grant the token from an existing SecureToken holder. If the device already has another account with a SecureToken (often the original end-user account), use it once to grant a token to your admin:
sudo sysadminctl -secureTokenOn <adminuser> -password <adminpw> -adminUser <tokenholder> -adminPassword <tokenholderpw>
After this,
<adminuser>will have a SecureToken and can be used for--create-service-accountgoing forward.
I deployed a fleet without a SecureToken-holding admin. What now?
For each device, run sysadminctl -secureTokenStatus against the local admin accounts to find one that has a SecureToken (often the original Setup Assistant user). Use that account either to run --create-service-account directly, or to grant a SecureToken to your standard deployment admin (option 3 above) so future operations are non-interactive. For new enrollments, fix the underlying issue by enabling Bootstrap Token escrow on the MDM prestage.
Does this apply to Intel Macs too?
Yes. Creating the service account requires a SecureToken-holding local administrator on both Intel and Apple Silicon Macs. Level uses the account for FileVault actions on both architectures, but only the Apple Silicon system-update flow uses it for restart-requiring macOS updates.
FAQ
Why does Level need a service account? Level uses the account to install restart-requiring macOS system updates on Apple Silicon and to run Level-managed FileVault actions on Apple Silicon and Intel Macs without an interactive user session.
Will my users see this account? No. The service account is hidden in the login window and in System Settings → Users & Groups. It only appears at the startup FileVault unlock screen on devices with FileVault enabled.
I dismissed the credential prompt during install. Do I need to set the account up? Set it up if you want Level to install restart-requiring macOS system updates on Apple Silicon or run Level-managed FileVault actions. Run
--create-service-accountmanually or push it through your deployment tooling.Can I automate service account creation at scale? Yes. Use
--admin-name=and--admin-password=to pass credentials for a local macOS administrator with a SecureToken. Run the command as root in a post-install script in your MDM or deployment tool.What happens to the service account if I uninstall Level? It's removed automatically as part of the uninstall process.