# MAC OS - Compliance Policy > Compliance policy for MAC OS devices Compliance policy for MAC OS devices ## Settings this baseline controls | Setting | What it does | | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Policy name | Display name for the policy. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Policy description | Description for the policy. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | System Integrity Protection enabled | Require that System Integrity Protection is enabled on the device. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Minimum macOS version | Minimum macOS version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Maximum macOS version | Maximum macOS version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Minimum macOS build version | Minimum macOS build version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Maximum macOS build version | Maximum macOS build version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Password required | Require a password to unlock macOS devices. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | **13 more settings** | Setting | What it does | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Block simple passwords | Block simple passwords. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Minimum password length | Minimum password length. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Required password type | Type of characters in password. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Minimum character set count | Number of character sets required in the password. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Minutes before password required | Minutes of inactivity before a password is required. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Days until password expires | Number of days before the password expires. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Previous passwords remembered | Number of previous passwords to prevent reuse. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Storage encryption required | Require encryption on macOS devices. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Firewall enabled | Whether the firewall should be enabled. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Block all incoming connections | Corresponds to the "Block all incoming connections" option in the firewall settings. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Stealth mode enabled | Corresponds to "Enable stealth mode" in the firewall settings. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Allowed app sources | System and Privacy setting that determines which download locations apps can be run from on a macOS device. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | | Group assignments | The list of group assignments for this compliance policy. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this to a tenant that enrols Mac devices, to bring them to the same compliance bar as a managed Windows fleet: a real password, disk encryption and a working firewall. 1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or include it in a scheme you deploy to every tenant enrolling Macs ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Password required** on: alphanumeric, at least `8` characters, blocking simple passwords, expiring after `365` days, with the last `5` blocked from reuse. 3. Leave **Storage encryption required** (FileVault) on, alongside **System Integrity Protection enabled**, which stops even an administrator from disabling macOS's core protections. 4. Leave **Firewall enabled**, **Block all incoming connections** and **Stealth mode enabled** all on, and set **Allowed app sources** to the Mac App Store and identified developers. Macs can still run signed third-party software, but nothing from an unidentified developer. 5. Set **Minimum macOS version** to `12`, leaving the maximum and build-version fields blank. 6. Save, and turn on **Auto-remediation** if you want Octiga to create or correct this policy in Intune the next time it detects a deviation. > **Caution:** A Mac that already fails these settings — an unencrypted disk, a disabled firewall, or a weak password — becomes noncompliant on its next check-in, and loses access to anything behind a Conditional Access device-compliance policy until the user brings it up to standard. > **Licence: Intune:** ## Check it worked This baseline shows **Passing** once the policy exists in Intune with these settings and a Mac reports back as compliant. Check progress in the Microsoft Intune admin centre: **Devices → Manage devices → Compliance → Policies**, open the policy, and use its device status and per-setting status views. A user on a noncompliant Mac sees what needs fixing in the Company Portal app, and may lose access to protected resources until it's fixed. ## Standards this addresses ### CIS - **v8 4.1** — CIS Controls v8 Safeguard 4.1 - **v8 3.6** — CIS Controls v8 Safeguard 3.6 ### NIST - **PR.DS-1** — NIST CSF 2.0 PR.DS-1 - **SC-28** — NIST SP 800-53 SC-28 - **CM-6** — NIST SP 800-53 CM-6 ### ISO 27001 - **A.8.13** — ISO/IEC 27001:2022 Annex A.8.13 - **A.8.22** — ISO/IEC 27001:2022 Annex A.8.22 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)