What is identityservicesd on macOS?

Last updated: 2026-07-31

What it is

identityservicesd is an Apple-supplied background agent that launchd runs separately in each user session. Its verified bundle identifier is com.apple.identityservicesd, and its executable resides inside the system-protected IDS.framework. macOS metadata also labels it “Messages Agent,” or “信息代理” in Simplified Chinese.

Apple does not publish a dedicated technical description of this daemon, so its complete responsibility is not public. Apple’s security documentation does explain the service behind it: Apple Identity Service, usually shortened to IDS, maintains a directory used by iMessage. That directory associates a phone number or email address with device public keys and Apple Push Notification service addresses. IDS also provides identity authentication and connection-establishment foundations for FaceTime.

The daemon contains private service identifiers associated with SMS and phone-call relay between devices, along with Continuity-related functions. Those identifiers show that its role extends beyond a single Messages window, but Apple has not published a complete mapping from every private service to identityservicesd. Claims about its less visible responsibilities therefore need to remain limited.

Why it talks to the network

Several network triggers are known. When iMessage is enabled or signed in again, or when a device or reachable address is added, the device registers public keys and APNs addresses with Apple IDS. When an iMessage conversation begins, the sender’s device queries IDS for the recipient’s public keys and APNs delivery addresses.

FaceTime call establishment also requires network communication. Apple documents the use of APNs, identity credentials, and its initial relay infrastructure during call setup. Account or device changes, reconnecting to a network, and background registration maintenance may produce additional small exchanges. Local launchd state exposes a registration tracker and an APS interface, which is consistent with those functions.

The relevant destination categories are Apple’s IDS directory and registration services, APNs, and FaceTime signaling or relay infrastructure. This does not mean every related socket belongs directly to identityservicesd: apsd may hold the actual APNs connection. A per-process total can therefore show only what macOS attributed to this process, not the entire network cost of every service in which it participates.

How much traffic is normal

Apple has not published a normal byte range for identityservicesd, so there is no reliable MB figure or fixed threshold to quote. Registration, directory lookups, and message or call signaling should generally appear as low-volume, intermittent communication, sometimes with short bursts.

That control traffic is normally much smaller than photo or video attachments and FaceTime audio or video media. However, whether any of that larger traffic appears under identityservicesd depends on the macOS version and the method used to attribute connections. It cannot be confirmed without tracing individual connections.

Sustained high traffic deserves closer inspection, but the process name alone cannot establish whether it is normal or abnormal. First check the time window, whether iMessage or FaceTime activity occurred, and which process actually owned the connections.

Can you turn it off

Apple does not provide a supported System Settings switch for disabling identityservicesd itself. Force-quitting or disabling its launchd agent may disrupt iMessage activation, identity and key lookups, FaceTime call establishment, and some SMS or phone-call relay between devices. The system may also start the process again.

If you do not use the associated services, use their application controls instead. In Messages, go to Messages > Settings > iMessage > Sign Out. In FaceTime, go to FaceTime > Settings > General > Sign Out. These actions sign out of the services; they are not a daemon-level off switch.

What people get wrong

• “It is third-party software or malware.” It is an Apple system component. The verified executable is inside the protected IDS framework, carries Apple’s com.apple.identityservicesd bundle identifier, and starts through a system LaunchAgent.

• “I do not use iMessage, so I can delete or permanently disable it.” Its known role also includes FaceTime identity and connection setup. Private identifiers further associate it with SMS, phone relay, and Continuity functions, although Apple has not published the complete dependency map. Deleting or disabling it is not an Apple-supported optimization.

• “Any traffic means it is uploading plaintext messages or monitoring me.” Network byte counts reveal neither payload contents nor purpose. They cannot distinguish registration, directory lookup, signaling, or relay traffic. Apple documents end-to-end encryption for iMessage content and FaceTime audio and video, so traffic by itself is not evidence of plaintext uploads or surveillance.

• “Turning off Messages or FaceTime notifications stops its network access.” Notification settings control how alerts appear. They do not sign out of the service, revoke IDS registration, or disable APNs.

• “identityservicesd handles Sign in with Apple or local macOS user accounts.” The name makes that assumption understandable, but the verified material does not support it. Public Apple documentation describes IDS here primarily as the identity service used by communication features such as iMessage and FaceTime.

Seeing what it actually used

The useful next step is to measure the process instead of inferring behavior from its name. Check identityservicesd in Bytetally’s per-process statistics for the relevant time window, and compare short bursts with the iMessage, FaceTime, account, device, or network activity you observed. Remember that APNs sockets may be attributed to apsd, so no single process row necessarily represents the complete service.

Related processes

Common questions