appleaccountd

executablemacOS7.7 MBx86_64, arm64

Apple identity and messaging service — authenticates users and manages iMessage communications

Handles Apple ID authentication, iMessage account setup, and encrypted message synchronization across Apple devices. Accesses the Secure Enclave for cryptographic key storage and performs security-sensitive operations through the Security framework. Maintains connections to iCloud data sync services and Apple identity/messaging backends via 13 network endpoints. Manages keychain-stored credentials and certificates, integrates with system feature flags, and logs telemetry data. Exposes 19 XPC services for other system components to query authentication state and send messages.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 7.7 MB
UUID: 9BD30B91-2ECC-3BB3-975E-24213AC4C9B8
Analyzed: 2026-04-09T09:41:30Z
CDHash: 96654ada47f7acf90cbb234fb09c88e0405e03b1c7b5e7a0b7cc0f2543a10e88

Capabilities

KeychainKeychain access group membership

keychain-access-groups

com.apple.inheritance.cryptoaccess

KeychainHardware key storage (Secure Enclave)

/System/Library/PrivateFrameworks/AppleKeyStore.framework/Versions/A/AppleKeyStore

NetworkMake outgoing network connections

com.apple.security.network.client [object Object]

NetworkiCloud data sync

/System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit

StoragePrivate storage area access

com.apple.private.security.storage.appleaccountd [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

/private/var/preferences/com.apple.networkd.plist

StorageException: access additional file paths

com.apple.security.exception.files.home-relative-path.read-write

/Library/com.apple.appleaccountd//Library/HTTPStorages /Library/HTTPStorages/com.apple.appleaccountd//Library/Caches/com.apple.AppleAccount/

StorageAddress book access

/System/Library/Frameworks/Contacts.framework/Versions/A/Contacts

HardwareException: access additional IOKit user clients

com.apple.security.exception.iokit-user-client-class

AppleKeyStoreUserClient

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.mobile.usermanagerd.xpc com.apple.SBUserNotification com.apple.familycircle.agent com.apple.ak.auth.xpc com.apple.ak.anisette.xpc com.apple.ak.custodian.xpc com.apple.ak.inheritance.xpc com.apple.ak.walrus.xpc com.apple.accountsd.accountmanager com.apple.analyticsd com.apple.apsd com.apple.cloudd com.apple.contactsd com.apple.corefollowup.agent com.apple.identityservicesd.embedded.auth com.apple.identityservicesd.idquery.desktop.auth com.apple.identityservicesd.idquery.embedded.auth com.apple.securityd.xpc com.apple.security.octagon com.apple.SBUserNotification com.apple.SystemConfiguration.configd com.apple.frontboard.systemappservices com.apple.usernotifications.usernotificationservice com.apple.usernotifications.listener com.apple.cdp.daemon com.apple.securityd com.apple.usernotifications.usernotificationservice com.apple.AppSSO.service-xpc com.apple.usymptomsd com.apple.intelligenceplatform.View com.apple.lsd.xpc com.apple.kvsd

IpcApple identity/messaging services (iMessage)

/System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDS

IpcApple identity/messaging services (iMessage)

/System/Library/PrivateFrameworks/IDSFoundation.framework/Versions/A/IDSFoundation

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

SecuritySecurity framework extensions

/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation

SecurityApple ID authentication

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKit

SecurityCryptographic operations

/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKit

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SystemFeature flag evaluation

/System/Library/PrivateFrameworks/FeatureFlags.framework/Versions/A/FeatureFlags

Frameworks60

UserNotifications CoreCDP FamilyCircle(weak)Foundation AAAFoundation SecurityFoundation AppleAccount AuthKit libobjc.A.dylib libSystem.B.dylib Accounts CloudKit Combine Contacts CoreFoundation CryptoKit Security AAAFoundationSwift AppleKeyStore ApplePushService CoreFollowUp FeatureFlags GRDBInternal IDS IDSFoundation IMCore IMFoundation IntelligencePlatform ProtectedCloudStorage libswiftAVFoundation.dylib(weak)libswiftAccelerate.dylib(weak)libswiftAppleArchive.dylib(weak)libswiftCompression.dylib(weak)libswiftCore.dylib libswiftCoreAudio.dylib(weak)libswiftCoreFoundation.dylib libswiftCoreImage.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftCoreMIDI.dylib(weak)libswiftCoreMedia.dylib(weak)libswiftCoreMediaIO.dylib(weak)libswiftDispatch.dylib libswiftIOKit.dylib(weak)libswiftIntents.dylib(weak)libswiftMLCompute.dylib(weak)libswiftMetal.dylib(weak)libswiftNaturalLanguage.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib libswiftQuartzCore.dylib(weak)libswiftRegexBuilder.dylib libswiftSpatial.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftVideoToolbox.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dylib libswift_StringProcessing.dylib libswiftos.dylib libswiftsimd.dylib(weak)

Entitlements71

AvpFairPlayUserClient.accesstrue

application-identifier com.apple.appleaccountd

aps-connection-initiatetrue

com.apple.AuthKit.AgeRangeSettingsCachetrue

com.apple.TapToRadarKit.service-accesstrue

com.apple.account.dca.fullaccesstrue

com.apple.appleaccount.beneficiary.private com.apple.appleaccount.beneficiary

com.apple.appleaccount.custodian.private com.apple.appleaccount.custodian

com.apple.application-identifier com.apple.appleaccountd

com.apple.authkit.birthdaytrue

com.apple.authkit.client.privatetrue

com.apple.cdp.recoverykeytrue

com.apple.cdp.walrustrue

com.apple.cdp.walrus.pcskeystrue

com.apple.developer.hardened-processtrue

com.apple.developer.icloud-container-environment Production

com.apple.developer.icloud-container-identifiers

com.apple.appleaccount.custodian.private com.apple.appleaccount.custodian com.apple.appleaccount.beneficiary com.apple.appleaccount.beneficiary.private

com.apple.developer.icloud-services

com.apple.developer.ubiquity-kvstore-identifier com.apple.appleaccount.custodian

com.apple.frontboard.debugapplicationstrue

com.apple.frontboard.launchapplicationstrue

com.apple.imagenttrue

com.apple.imagent.chattrue

com.apple.intelligenceplatform.Viewtrue

com.apple.keystore.lockassertiontrue

com.apple.mkb.usersession.infotrue

com.apple.mkb.usersession.keybagopaquedatatrue

com.apple.private.accounts.allaccountstrue

com.apple.private.appleaccount.app-hidden-from-icloud-settingstrue

com.apple.private.aps-connection-initiatetrue

com.apple.private.cloudkit.buddyAccesstrue

com.apple.private.cloudkit.masqueradetrue

com.apple.private.cloudkit.serviceNameForContainerMap <dict>

com.apple.private.cloudkit.spitrue

com.apple.private.cloudkit.systemServicetrue

com.apple.private.contactstrue

com.apple.private.coreservices.canmaplsdatabasetrue

com.apple.private.familycircletrue

com.apple.private.followuptrue

com.apple.private.ids.idquery-cachetrue

com.apple.private.ids.messaging

com.apple.private.alloy.accounts.representative

com.apple.private.ids.messaging.urgent-priority

com.apple.private.alloy.accounts.representative

com.apple.private.imcore.imagenttrue

com.apple.private.intelligenceplatform.views.read-only

entityTagging visualIdentifier hasAssociationSubgraph phPersonIdentifierMap

com.apple.private.keychain.sysboundtrue

com.apple.private.notificationcenter-system

com.apple.AppleAccount

com.apple.private.octagontrue

com.apple.private.security.storage.appleaccountdtrue

com.apple.private.tcc.allow

kTCCServiceLiverpool kTCCServiceAddressBook

com.apple.private.usernotifications.bundle-identifiers

com.apple.appleaccount.notifications

com.apple.security.exception.files.absolute-path.read-only

/private/var/preferences/com.apple.networkd.plist

com.apple.security.exception.files.home-relative-path.read-write

/Library/com.apple.appleaccountd//Library/HTTPStorages /Library/HTTPStorages/com.apple.appleaccountd//Library/Caches/com.apple.AppleAccount/

com.apple.security.exception.iokit-user-client-class

AppleKeyStoreUserClient

com.apple.security.exception.mach-lookup.global-name

com.apple.mobile.usermanagerd.xpc com.apple.SBUserNotification com.apple.familycircle.agent com.apple.ak.auth.xpc com.apple.ak.anisette.xpc com.apple.ak.custodian.xpc com.apple.ak.inheritance.xpc com.apple.ak.walrus.xpc com.apple.accountsd.accountmanager com.apple.analyticsd com.apple.apsd com.apple.cloudd com.apple.contactsd com.apple.corefollowup.agent com.apple.identityservicesd.embedded.auth com.apple.identityservicesd.idquery.desktop.auth com.apple.identityservicesd.idquery.embedded.auth com.apple.securityd.xpc com.apple.security.octagon com.apple.SBUserNotification com.apple.SystemConfiguration.configd com.apple.frontboard.systemappservices com.apple.usernotifications.usernotificationservice com.apple.usernotifications.listener com.apple.cdp.daemon com.apple.securityd com.apple.usernotifications.usernotificationservice com.apple.AppSSO.service-xpc com.apple.usymptomsd com.apple.intelligenceplatform.View com.apple.lsd.xpc com.apple.kvsd

com.apple.security.exception.shared-preference.read-only

com.apple.gamecenter com.apple.UIKit

com.apple.security.exception.shared-preference.read-write

com.apple.appleaccountd com.apple.appleaccount

com.apple.security.iokit-user-client-class

AvpFairPlayUserClient

com.apple.security.network.clienttrue

com.apple.security.personal-information.addressbooktrue

com.apple.security.system-groups

systemgroup.com.apple.nsurlstoragedresources

com.apple.security.temporary-exception.iokit-user-client-class AppleKeyStoreUserClient

com.apple.security.temporary-exception.shared-preference.read-only

com.apple.appleaccount

com.apple.security.ts.cloudkit-clienttrue

com.apple.security.ts.tmpdir com.apple.appleaccountd

com.apple.springboard.CFUserNotificationtrue

com.apple.springboard.opensensitiveurltrue

com.apple.springboard.remote-alerttrue

com.apple.usermanagerd.persona.fetchtrue

keychain-access-groups

com.apple.inheritance.cryptoaccess

platform-applicationtrue

seatbelt-profiles

temporary-sandbox

Interesting Strings

Bundle IDs(305)

com.apple.account.dca.fullaccess com.apple.appleaccount.custodian com.apple.appleaccount.custodian0# com.apple.appleaccount.custodian0+ com.apple.application-identifier

File Paths(43)

!/Library/com.apple.appleaccountd/'/Library/Caches/com.apple.AppleAccount/0Q ./Library/HTTPStorages/com.apple.appleaccountd//Library/HTTPStorages /System/Library/Frameworks/Accounts.framework/Versions/A/Accounts

telemetry(196)

$s13appleaccountd20HealthCheckAnalyticsP $s13appleaccountd21AnalyticsAccountModelP $s13appleaccountd25AnalyticsEventFactoryTypeP $s13appleaccountd38CustodianHealthCheckAnalyticsEventTypeP $s13appleaccountd40InheritanceHealthCheckAnalyticsEventTypeP

URLs & Endpoints(6)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://setup.icloud.com

Network Surfaceentitled

Networking Frameworks

AAAFoundation AAAFoundationSwift CoreFoundation Foundation IDSFoundation IMFoundation SecurityFoundation libswiftAVFoundation.dylib libswiftCoreFoundation.dylib

Endpoints(13)

HostnameXPCActivity-com.apple.appleaccountd.custodian.invitationStatusCheck

Urlhttps://setup.icloud.com

Hostnamesetup.icloud.com

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

HostnameBcom.apple.security.temporary-exception.shared-preference.read-only0

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

2

Network

2

Storage

4

Hardware

1

IPC

3

Analytics

0

Security

5

System

1

Behavioral Profile

URL Endpoints

6

Telemetry Strings

196

File Paths

43

Bundle IDs

305

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code56ceb1f346acd4dccddcdc465f98f5d67046c33c6391373534def9480c825be1

Importsa64f2d0f0860442a9f4ec9677ca0e2baba8a3f56c3e02ed2f27bed43654a7b19

Frameworks7e10ac8717c3a9f2d0c4f80987c45a2610a57fdd81ffa47106800c7b6029d970

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlementsef03d230b9be1666d2a5f3c42c154a07633d55a9910b65081f56ad40c895304d

Symbolsa64f2d0f0860442a9f4ec9677ca0e2baba8a3f56c3e02ed2f27bed43654a7b19

Static Libraries0 / 8760 functions identified

Functions(8760)

0x100002478sub_100002478

0x100002534sub_100002534

0x10000258csub_10000258c

0x1000025e4sub_1000025e4

0x1000025f0sub_1000025f0

0x100002604sub_100002604

0x100002670sub_100002670

0x1000026dcsub_1000026dc

0x100002748sub_100002748

0x100002750sub_100002750

0x100002758sub_100002758

0x1000027acsub_1000027ac

0x100002804sub_100002804

0x10000282csub_10000282c

0x100002830sub_100002830

0x100002834sub_100002834

0x100002838sub_100002838

0x1000028a4sub_1000028a4

0x100002910sub_100002910

0x100002914sub_100002914

Imports1300 symbols from 37 dylibs

libswiftCore.dylib415 Foundation232 AppleAccount198 libSystem.B.dylib73 CloudKit56

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

findmylocateagent

searchpartyuseragent

icloudmailagent