What is ndoagent on Mac?

Last updated: 2026-07-31

What it is

ndoagent is a per-user background agent included with macOS. Its executable belongs to Apple’s private NewDeviceOutreach framework, and the verified system copy is identified as com.apple.ndoagent under /System/Library/PrivateFrameworks/NewDeviceOutreach.framework/.

Its main job is to query and cache warranty and AppleCare coverage information for the Mac and some associated Apple devices. That information includes current coverage status, expiration details, device lists, purchase eligibility, and data related to setting up a plan. The results support the AppleCare & Warranty page under System Settings > General, along with related coverage reminders.

Calling ndoagent merely an “AppleCare sales agent” leaves out an important part of its role. Promotional or purchase-eligibility reminders can be among its outputs, but the same agent also supplies practical warranty and coverage records that a user may deliberately open System Settings to inspect.

Why it talks to the network

Verified launch conditions for ndoagent include network-dependent background checks, adding an Apple Account, pairing a Bluetooth device, and changing the system language. It also registers a handler for AppleCare notifications delivered through Apple Push Notification service.

The current Apple-supplied binary contains service identifiers for Apple device-list and coverage-summary services, a configuration CDN, AppleCare push delivery, and event-reporting services associated with pairing or firmware updates for supported Bluetooth audio accessories. These service categories explain why the process can appear after an account change or accessory event even when the AppleCare & Warranty page is not visibly open.

The framework’s interfaces are consistent with requesting remote coverage data on demand when that page is opened. However, that specific interaction has not been verified with a separate packet capture. Apple has also not published the complete request schedule or the meaning of every payload, so individual connections should not be assigned a more specific purpose without direct evidence.

How much traffic is normal

There is no published normal traffic baseline for ndoagent. Apple does not state how many requests it should make or how many bytes it should transfer, and no reliable independent measurement was found. A precise allowance in megabytes would therefore be invented rather than evidence-based.

The verified communication categories center on warranty and coverage records, device lists, configuration, push notifications, and event metadata. Based on those roles, its ordinary shape should range from no transfer while idle to occasional low-throughput bursts. It would normally be much smaller than application downloads, cloud-drive synchronization, or audio and video traffic.

That expectation is qualitative, not a fixed threshold. The cumulative cost of abnormal retries has not been verified. If ndoagent repeatedly transfers data, the total should be measured on the affected Mac instead of compared with an unsupported universal number.

Can you turn it off

The practical recommendation is to keep ndoagent available. Apple provides no System Settings switch for disabling either the agent or its network behavior. System Settings > General > AppleCare & Warranty is a place to view and manage coverage; it is not an off switch.

Blocking ndoagent may leave warranty and AppleCare status missing or stale. It may also prevent purchase-eligibility notices, plan-setup information, and other coverage reminders from arriving correctly. Event reporting related to some supported accessories may fail as well.

A network block does not uninstall or unload the LaunchAgent. It may instead cause background retries, although the resulting retry volume has not been measured. Deleting the executable or disabling it with launchctl is not an Apple-supported optimization, may damage coverage features, conflicts with protections around system files, and may be undone by a system update.

What people get wrong

• “ndoagent is third-party software or malware.” It is an Apple system component. The verified executable is inside /System/Library, and its code identifier is com.apple.ndoagent.

• “It only downloads AppleCare advertisements.” That description is incomplete. ndoagent also provides actual warranty and coverage status, expiration information, lists of associated devices, and plan-setup data.

• “Blocking it only hides sales pop-ups.” That promises more separation than the evidence supports. The same network block can disrupt status queries in AppleCare & Warranty and non-promotional coverage reminders.

• “I can permanently turn it off in notification settings.” No independently verifiable notification-settings entry is provided for the AppleCare notification bundle. A user may handle or ignore a particular reminder, but that does not disable ndoagent.

• “It is a Bluetooth driver, so if it appears after pairing, it caused my Bluetooth problem.” Bluetooth pairing is one verified launch condition, but the verified role is reading supported accessory information and handling coverage or device events. That does not establish responsibility for the Bluetooth connection itself.

• “Deleting it or disabling it with launchctl is a supported performance tweak.” Apple documents no such method. Altering a protected system component can break coverage functions and may not survive a system update.

Seeing what it actually used

When the concern is data volume, the next step is to check ndoagent as an individual process over the time window in question. Bytetally’s per-process statistics can show whether it stayed idle, produced an occasional burst, or accumulated repeated transfers. Use that local measurement as evidence, since no reliable universal traffic baseline is available.

Related processes

Common questions