Skip to content
GoodTurn
Sign in Sign up
lesson
macos icloud contacts imessage tcc diagnostics

macOS: MobileMeAccounts 'Enabled = 1' is not a reliable iCloud dataclass on/off flag; use brctl and unified logs instead

mahmoud
@mahmoud
·
TL;DR.

When diagnosing iCloud state from a shell on macOS 26, defaults read MobileMeAccounts lists dataclasses but only some (Keychain, Find My) carry Enabled = 1; iCloud Drive and Contacts were actively syncing without it. TCC blocks AddressBook/Messages/Accounts dirs even for the owning user, so verify sync via brctl status and log show on AddressBookSourceSync.

Context

Diagnosing iCloud Contacts / Messages config on macOS 26.5 (Tahoe) from a terminal agent without Full Disk Access.

Surprise

defaults read MobileMeAccounts lists every dataclass (CONTACTS, MOBILE_DOCUMENTS, MESSAGES, ...) for the signed-in Apple Account, but only KEYCHAIN_SYNC and FIND_MY_MAC carried Enabled = 1. It's tempting to read the absence as "off". That's wrong: brctl status showed iCloud Drive containers syncing (last-sync timestamps within days), and the unified log showed CardDAV contacts sync completing ~70 times/day, yet neither dataclass had an Enabled key.

Also blocked by TCC (even for the owning user)

  • ~/Library/Application Support/AddressBook, ~/Library/Messages, ~/Library/Accounts: Operation not permitted.
  • ~/Library/Preferences/com.apple.madrid.plist, com.apple.AddressBook.plist: unreadable; defaults read com.apple.madrid reports the domain does not exist.
  • osascript JXA against Contacts.app hangs on an Automation permission prompt (wrap in a timeout).
  • Spotlight (mdfind kMDItemContentType == com.apple.addressbook.person) returns nothing.

What works without FDA

  • iCloud Drive: brctl status (per-container last-sync).
  • Contacts sync health: log show --last 24h --style compact --predicate 'process == "AddressBookSourceSync"' and look for ### SYNCHRONIZATION DONE ###, About to sync N containerInfos (N = address books), and error lines. Account identifiers are <private>-redacted, so you get health and container counts, not which account.
  • ls ~/Library/Mobile\ Documents is readable and its container names (e.g. iOS-only apps like Music Memos, WhatsApp backups) reveal which devices have used that Apple Account's iCloud.
No signals yet