macOS Security hardening with Microsoft Intune

Platforms

macOS

Products

IntuneSettings catalog

Result

Macs that report as compliant only with SIP, FileVault, firewall and a current macOS, with risky sharing features turned off

Overview

Harden Intune-managed Macs with one compliance policy and a set of settings catalog profiles: SIP, FileVault, firewall and Gatekeeper, restrictions on iCloud and sharing, login window rules, a locked ADE profile and automatic updates.

Hardening is the process of increasing system security, which makes devices more resilient against data loss, cybercriminals and hacking attempts. System security is critical for the safety of your device, the data on it and, possibly, other computers on the network.

There are many approaches to hardening, and not every configuration setting will be suitable for each organization. An Information Systems Security Officer should carefully review every setting before implementing it, because some restrictions or misconfigurations may harm the system or the user.

In this post I cover common enterprise device restrictions and endpoint protection settings that improve the security of macOS devices managed by Microsoft Intune.

Prerequisites

Before you start, check that you have the following.

Device compliance policy

With the prerequisites in place, start with the compliance policy, then add the configuration profiles.

System Integrity Protection (SIP) must be enabled

SIP is vital to protecting the integrity of the system as it prevents malicious users and software from making unauthorized or unintended changes to protected files and folders. For more information, see System Integrity Protection in Apple Platform Security.

macOS compliance policy > Device Health > Require System Integrity Protection

Minimum Operating System Version must be configured

When a device runs an earlier OS version than the one you enter, it's reported as noncompliant and the user sees a link with information on how to upgrade. After upgrading, they can access company resources again.

Note: Update the minimum OS version regularly to match new macOS releases.

Password Complexity

Below is an example of password complexity values that meet common security standards on macOS devices. Your organization may have its own password rules.

• Prohibit repeating, ascending and descending character sequences with Block Simple Passwords
• Require Minimum Password Length of 12 Characters or more
• Require Passwords Contain a Minimum of One Lowercase Character
• Require Passwords Contain a Minimum of One Uppercase Character
• Require Passwords Contain a Minimum of One Special Character
• Require Passwords Contain a Minimum of One Numeric Character
• Prohibit Password Reuse for the last 5 passwords
• Restrict Maximum Password Lifetime to 60 Days
• Set Account Lockout Time to 15 Minutes

Force password change at next logon is built into the compliance policy, so the user is asked to change the password to meet the new rules when the policy is first applied to the device and after any policy update.

FileVault disk encryption must be enabled

Disk encryption protects the confidentiality and integrity of data stored on the Mac, including when the device leaves controlled areas.

Note: When FileVault is enabled, automatic login must be disabled, so that both FileVault and login window authentication are required (see Login Window settings below).

With the Settings Catalog you can enforce FileVault by preventing users from disabling it:

• Settings Catalog > FileVault Options > Prevent FileVault From Being Disabled (True)

Enable macOS Application Firewall and Stealth Mode

The macOS Application Firewall is built into the system and must be enabled. It controls which applications can accept incoming network connections.

With Stealth Mode enabled, the Mac does not respond to probing requests such as ping, while authorized applications keep working.

Note: Stealth Mode may break some remote tools used for maintenance and compliance scanning, so evaluate the impact first.

Enable Gatekeeper to Block Applications from Unidentified Developers

Gatekeeper must be configured to only allow the system to run applications downloaded from the Mac App Store or applications signed with a valid Apple Developer ID code.

Additionally, prevent users from overriding Gatekeeper. My screenshot shows the old Endpoint protection profile; in new policies use Settings Catalog > System Policy Managed > Disable Override (True).

Note: If users can disable Gatekeeper or relax its setting, malware could get into the system.

Device restrictions

For the settings in this section I use the Settings Catalog first. Settings that are not available in the Intune console are configured with custom profiles (.mobileconfig) or preference files (.plist).

Disable AirDrop

AirDrop lets users share and receive files with nearby Apple devices. It should be disabled to prevent file transfers to or from unauthorized devices.

• Settings Catalog > Restrictions > Allow AirDrop (False)

Disable AirPlay Receiver

AirPlay Receiver lets another Apple device play content on the Mac's screen. It is non-essential and can be disabled.

• Settings Catalog > Restrictions > Allow AirPlay Incoming Requests (Disabled)

Disable Handoff

Handoff (Activity Continuation) lets users continue working on a document or project when they switch from one Apple device to another. Disabling Handoff prevents data transfers to unauthorized devices.

• Settings Catalog > Restrictions > Allow Activity Continuation (False)

Disable Content Caching Service

Content caching is a macOS service that reduces internet data usage and speeds up software installation on Mac computers. Employee devices should not act as caching servers.

• Settings Catalog > Restrictions > Allow Content Caching (False)

Disable iCloud Services

Apple’s iCloud does not give an organization enough control over how data is stored and accessed, so consumer (personal) iCloud services should be turned off.

• Settings Catalog > Restrictions:

To disable Find My in iCloud, create a custom profile (.mobileconfig) with the following key in the com.apple.icloud.managed payload type. Use any profile editor (e.g. iMazing) to generate the XML file and import it into Intune:

<key>DisableFMMiCloudSetting</key>
<true/>

Disable Password Autofill

macOS lets users save passwords and use Password AutoFill in Safari and compatible apps. Disable it so users are not prompted to save passwords in applications, which protects accounts if a malicious user gains access to the system.

• Settings Catalog > Restrictions > Allow Password Auto Fill (False)

Disable Password Sharing and Password Proximity Requests

By default, macOS lets users request passwords from other known devices (macOS and iOS). Disable password proximity requests to prevent passwords from being shared.

Block password sharing as well, so passwords cannot be shared over AirDrop with other macOS and iOS devices.

• Settings Catalog > Restrictions > Allow Password Proximity Requests (False)
• Settings Catalog > Restrictions > Allow Password Sharing (False)

Disable Password Hints

Password hints leak information about passwords that are currently in use and can lead to loss of confidentiality.

To disable password hints, create a custom profile (.mobileconfig) or preference file (.plist) with the RetriesUntilHint key in the com.apple.loginwindow payload (preference domain):

<key>RetriesUntilHint</key>
<integer>0</integer>

Enforce Rapid Security Response Mechanism

Rapid Security Response (RSR) must be enabled, and users should not be able to remove it. From macOS 26.1, Apple calls these releases Background Security Improvements.

• Settings Catalog > Restrictions > Allow Rapid Security Response Installation (True)
• Settings Catalog > Restrictions > Allow Rapid Security Response Removal (False)

Prevent Apple Watch from Terminating a Session Lock

Apple Watch is not an approved authenticator, so unlocking with it must be disabled.

This keeps the session locked until the user signs in again with an approved identification and authentication method.

• Settings Catalog > Restrictions > Allow Auto Unlock (False)

Enforce Auto Logout After 86400 Seconds of Inactivity

Configure auto logout to end the user session after 86400 seconds (24 hours) of inactivity; 86400 seconds is the maximum value.

• Settings Catalog > Global Preferences > Auto Log Out Delay (value in seconds)

Disable the Guest Account

Turning off guest access prevents anonymous users from accessing files.

• Settings Catalog > Accounts > Disable Guest Account (True)

Disable Dictation (Siri)

Dictation sends the user's voice to Apple for processing. It is non-essential and should be disabled, so the system provides only essential capabilities. This setting turns off only dictation; the rest of Siri is not affected.

• Settings Catalog > Restrictions > Allow Dictation (False)

Disable Game Center

Disable Game Center and adding friends. Game Center uses the Apple ID and shares data with Apple ID based services.

• Settings Catalog > Restrictions > Allow Game Center (False)
• Settings Catalog > Restrictions > Allow Adding Game Center Friends (False)
• Settings Catalog > Restrictions > Allow Multiplayer Gaming (False)

USB devices must be authorized before they are allowed

USB accessories connected to a Mac must be authorized by the user.

• Settings Catalog > Restrictions > Allow USB Restricted Mode (True)

Disable Installation of Configuration Profiles through the User Interface

Users must not install configuration profiles through the user interface; profiles come only from the authorized MDM server.

• Settings Catalog > Restrictions > Allow UI Configuration Profile Installation (False)

Disable Touch ID for unlocking the device

Touch ID lets users unlock a Mac with their fingerprint. Disable it for "Unlocking your Mac" on all Macs that support Touch ID.

The macOS system should remain locked until the user establishes access using an authorized identification and authentication method.

• Settings Catalog > Restrictions > Allow Fingerprint For Unlock (False)

Login window and screen saver

Login window settings are available in the Settings Catalog or in the Device features template profile in Intune.

Configure Login Window to Prompt for Username and Password

By default, the macOS system displays a list of known users on the login window, which can make it easier for a malicious user to gain access to someone else’s account. Requiring users to type in both their username and password mitigates the risk of unauthorized users gaining access to the information system.

Configure the login window to prompt all users for both a username and a password (the downside is a less convenient sign-in).

• Settings Catalog > Login Window Behaviour > Show Full Name (True)

Display Login Window Text Banner

Show a short text that the device belongs to the organization before anyone signs in, so users know it is managed and monitored by IT.

• Settings Catalog > Login Window Behaviour > Login Window Text

Optionally, a longer policy banner (PolicyBanner.rtf or PolicyBanner.rtfd) is displayed if the file exists in /Library/Security. For details, see How to set up policy banners in macOS.

Disable Unattended or Automatic Logon to the System

With automatic login enabled, the default user account is signed in at startup without a password. Even if the screen is locked later, a malicious user could restart the computer and find it already signed in. Disabling automatic login removes this risk.

Automatic login is disabled by default once FileVault is enabled. To enforce it anyway, create a configuration profile with the DisableAutoLoginClient key in the com.apple.loginwindow payload type:

<key>com.apple.login.mcx.DisableAutoLoginClient</key>
<true/>

Enforce Screen Saver at Login Window

Configure a default screen saver for the login window; it must not display any sensitive information.

• Settings Catalog > System Configuration > Screensaver > Login Window Module Path

Note: Screen savers are stored in /System/Library/Screen Savers/, e.g. /System/Library/Screen Savers/Monterey.saver.

Enforce Screen Saver Password

The screen saver acts as a session lock and prevents unauthorized users from accessing the current session. Users must authenticate when unlocking the screen saver.

• Settings Catalog > System Configuration > Screensaver > Ask For Password (True)

Enforce Session Lock After Screen Saver is Started

The screen saver must be enabled, and the system must require a password once the screen saver has been on for a maximum of 5 seconds. An unattended system with an excessive grace period is vulnerable to a malicious user.

• Settings Catalog > System Configuration > Screensaver > Ask For Password Delay

Enforce Screen Saver Timeout

The screen saver timeout must be set to 1200 seconds or a shorter length of time. This ensures the session is locked after no more than 1200 seconds (20 minutes) of inactivity.

• Settings Catalog > System Configuration > Screensaver > Login Window Idle Time

Automated Device Enrollment profile

Enforce MDM device enrollment

Enable the Locked Enrollment setting in the ADE profile for macOS devices to prevent users from unenrolling their devices from Intune. It stops users from removing the management profile in System Settings or with the Terminal app.

Setup Assistant user prompts

The following Setup Assistant screens must be hidden in the ADE profile:

• Apple ID setup during Setup Assistant must be disabled

• iCloud storage services during Setup Assistant must be disabled

• Siri during Setup Assistant must be disabled

• Apple Watch unlock setup during Setup Assistant must be disabled

• TouchID during Setup Assistant must be disabled

macOS software updates

Enforce Automated Updates

Make sure security updates are installed as soon as Apple releases them.

Note: This MDM-based policy is deprecated. On macOS 14 and later, use a settings catalog policy with Declarative Device Management > Software Update instead.

Deploy Intune macOS Software updates policy to all managed devices with Download and install and the schedule type Update at next check-in:

• Critical updates – Download and install
• Firmware updates – Download and install
• Configuration file updates – Download and install
• All other updates (OS, built-in apps) – Download and install
• Schedule type – Update at next check-in

Prevent changes to Update settings

By default, users can change Software Update settings on a Mac. This configuration prevents them from changing the managed settings.

• Settings Catalog > Software Update