What is the "studentd" process?

Solution 1:

studentd manages the Apple Classroom experience for students and teachers that use MDM and the Apple School Manager service.

• https://support.apple.com/guide/classroom/classroom-infrastructure-requirements-classes-apdd491bf924/mac
• https://school.apple.com

The manual page also says it is designed to run without classes configured, so I would allow the traffic so that it knows you aren’t needing management and then sits idle.

• https://eclecticlight.co/2019/07/24/studentd-and-its-self-signed-certificate-are-permanent-fixtures-in-mojave/

Unless there’s a resource issue, you have thousands of processes that run, self configure and then sleep or wait for a task. Blocking the traffic might make the daemon keep trying to connect and finish it’s run-once (or perhaps a regular check in) setup process.

On a larger stage, this design is how Unix and all of the Apple os work. They design small hardened daemons to serve narrow purposes, and often make a user account to run these behind the scenes to isolate permissions and sandbox everything cleanly. For us using the OS, I only try to manage these processes if there is a resource or usage issue.

In your case, this process will connect to very specific servers, so you can know it’s talking to Apple or to your MDM server in all likelihood. We would need details to dig into that deeper by using wire shark or tcpdump to capture and analyze the traffic. Also, don’t be misled - the process could have initially been designed to manage the student log in for iPads and then the code base was used for all the OS to receive and validate MDM / security details and/or sync user data to iCloud or other network stores. If you’re interested in just shutting this process down, there may be options on some macOS to do that.