MAC OS - Compliance Policy
Compliance policy for MAC OS devices
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy name | Display name for the policy. Learn more |
| Policy description | Description for the policy. Learn more |
| System Integrity Protection enabled | Require that System Integrity Protection is enabled on the device. Learn more |
| Minimum macOS version | Minimum macOS version. Learn more |
| Maximum macOS version | Maximum macOS version. Learn more |
| Minimum macOS build version | Minimum macOS build version. Learn more |
| Maximum macOS build version | Maximum macOS build version. Learn more |
| Password required | Require a password to unlock macOS devices. Learn more |
13 more settings
| Setting | What it does |
|---|---|
| Block simple passwords | Block simple passwords. Learn more |
| Minimum password length | Minimum password length. Learn more |
| Required password type | Type of characters in password. Learn more |
| Minimum character set count | Number of character sets required in the password. Learn more |
| Minutes before password required | Minutes of inactivity before a password is required. Learn more |
| Days until password expires | Number of days before the password expires. Learn more |
| Previous passwords remembered | Number of previous passwords to prevent reuse. Learn more |
| Storage encryption required | Require encryption on macOS devices. Learn more |
| Firewall enabled | Whether the firewall should be enabled. Learn more |
| Block all incoming connections | Corresponds to the “Block all incoming connections” option in the firewall settings. Learn more |
| Stealth mode enabled | Corresponds to “Enable stealth mode” in the firewall settings. Learn more |
| Allowed app sources | System and Privacy setting that determines which download locations apps can be run from on a macOS device. Learn more |
| Group assignments | The list of group assignments for this compliance policy. Learn more |
Configure it
Add this to a tenant that enrols Mac devices, to bring them to the same compliance bar as a managed Windows fleet: a real password, disk encryption and a working firewall.
-
Add the baseline to the tenant directly (Adding a baseline), or include it in a scheme you deploy to every tenant enrolling Macs (Deploying a scheme).
-
Leave Password required on: alphanumeric, at least
8characters, blocking simple passwords, expiring after365days, with the last5blocked from reuse. -
Leave Storage encryption required (FileVault) on, alongside System Integrity Protection enabled, which stops even an administrator from disabling macOS’s core protections.
-
Leave Firewall enabled, Block all incoming connections and Stealth mode enabled all on, and set Allowed app sources to the Mac App Store and identified developers. Macs can still run signed third-party software, but nothing from an unidentified developer.
-
Set Minimum macOS version to
12, leaving the maximum and build-version fields blank. -
Save, and turn on Auto-remediation if you want Octiga to create or correct this policy in Intune the next time it detects a deviation.
Check it worked
This baseline shows Passing once the policy exists in Intune with these settings and a Mac reports back as compliant. Check progress in the Microsoft Intune admin centre: Devices → Manage devices → Compliance → Policies, open the policy, and use its device status and per-setting status views. A user on a noncompliant Mac sees what needs fixing in the Company Portal app, and may lose access to protected resources until it’s fixed.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.