macos-intune-baseline

Name: macos-intune-baseline
Author: vinayaklatthe

161stars34forks

How to install macos-intune-baseline?

vinayaklatthe/microsoft-security-skills/macos-intune-baseline

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill macos-intune-baseline

Installs into the current project.

Summary

Guidance for hardening macOS endpoints managed by Microsoft Intune — automated device enrollment via Apple Business Manager (ABM), platform single sign-on (PSSO) with Entra ID, FileVault disk encryption escrow, security configuration profiles (Gatekeeper, XProtect, system extensi

Files · 1

View on GitHub

SKILL.md

1	# macOS Hardening with Microsoft Intune
2
3	Mac fleets in Microsoft-shop enterprises are usually under-governed compared to
4	Windows. Intune-managed macOS with the right configuration profiles, FileVault
5	escrow, Defender for Endpoint, and Platform SSO with Entra ID closes most of the gap
6	and gives you a Conditional Access compliance signal that actually means something.
7
8	## When to use
9	Designing or hardening macOS endpoint management in an Intune + Entra ID environment
10	(workforce devices, BYOD via user-enrollment is a separate model).
11
12	Do not use this skill for end-to-end Intune (`intune-device-mgmt`), MDE policy
13	authoring (`defender-for-endpoint`), or iOS / iPadOS management.
14
15	## Capability map
16
17	\| Layer \| Tool / Profile \|
18	\|---\|---\|
19	\| Provisioning \| Apple Business Manager + Intune Automated Device Enrollment \|
20	\| Identity / SSO \| Platform SSO (Entra ID), Enterprise SSO plug-in \|
21	\| Disk encryption \| FileVault enabled + escrow recovery key to Intune \|
22	\| App control \| Gatekeeper, XProtect (Apple-managed), notarized apps allowlist via system extensions \|
23	\| Endpoint protection \| Microsoft Defender for Endpoint on macOS \|
24	\| Configuration \| Settings catalog profiles (preferred), legacy templates where required \|
25	\| Privacy / kernel \| Privacy Preferences Policy Control (PPPC), System Extensions, Notification Center policy \|
26	\| Updates \| Managed Software Updates / Declarative Device Management (DDM) \|
27	\| Compliance \| Intune compliance policy → Conditional Access \|
28
29	## Approach
30
31	1. Enroll via ABM + Automated Device Enrollment. Manual enrollment is fine for
32	pilots; production needs ABM so devices arrive supervised, can't be unenrolled by
33	the user, and pick up policy at first boot.
34
35	2. Platform SSO (PSSO) with Entra ID is the modern macOS SSO. User signs into
36	the Mac with their Entra credentials (password, smart card, or passkey-style
37	secure enclave). Replaces the older Enterprise SSO plug-in for sign-in scenarios.
38	Requires deployment of the Microsoft Enterprise SSO plug-in package + a PSSO
39	configuration profile.
40
41	3. FileVault profile with escrow to Intune. Keys are recoverable by IT (with
42	audit). Don't deploy FileVault without escrow — locked-out users brick devices.
43
44	4. Defender for Endpoint on macOS via Intune app deployment + onboarding profile.
45	Includes:
46	- Real-time AV.
47	- Network protection.
48	- EDR.
49	- Vulnerability assessment.
50	Validate via `mdatp health` post-onboarding.
51
52	5. **Configuration profiles — start with the Microsoft macOS security baseline (or
53	CIS macOS benchmark)** and adapt. Critical settings:
54	- Gatekeeper: Mac App Store + identified developers.
55	- System extensions allowlist — required for Defender, your VPN, your DLP
56	agent. Without explicit allowlist, users see prompts and may deny.
57	- Privacy Preferences Policy Control (PPPC) — pre-approve required
58	accessibility / full-disk-access for management tools (Defender, Intune
59	management agent). Without this, MDE EDR coverage is partial.
60	- Firewall on with stealth mode.
61	- Screen lock + passcode complexity + password age aligned with policy.
62	- Disable login as root, disable guest user, disable iCloud sync of passwords
63	for managed devices (or scope by user group).
64	- Block USB mass storage for restricted populations (Defender device
65	control).
66
67	6. App management. Apps via VPP (Apple Volume Purchase Program) for App Store
68	apps; PKG/DMG for non-store apps via Intune; shell scripts for the long tail.
69	Maintain an "approved apps" catalogue.
70
71	7. Patching: Managed Software Updates / DDM. Apple's modern patch model uses
72	Declarative Device Management — deferral windows, target OS versions, force-install
73	deadlines. Replaces the older "deferral days" model. Roll out:
74	- Major version: deferral 30 days, target n-1 supported.
75	- Minor / securit

People who liked this also viewed

6 picks

Type

macos-intune-baseline

161stars34forks

View on GitHub

How to install macos-intune-baseline?

vinayaklatthe/microsoft-security-skills/macos-intune-baseline

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill macos-intune-baseline

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# macOS Hardening with Microsoft Intune
2
3	Mac fleets in Microsoft-shop enterprises are usually under-governed compared to
4	Windows. Intune-managed macOS with the right configuration profiles, FileVault
5	escrow, Defender for Endpoint, and Platform SSO with Entra ID closes most of the gap
6	and gives you a Conditional Access compliance signal that actually means something.
7
8	## When to use
9	Designing or hardening macOS endpoint management in an Intune + Entra ID environment
10	(workforce devices, BYOD via user-enrollment is a separate model).
11
12	Do not use this skill for end-to-end Intune (`intune-device-mgmt`), MDE policy
13	authoring (`defender-for-endpoint`), or iOS / iPadOS management.
14
15	## Capability map
16
17	\| Layer \| Tool / Profile \|
18	\|---\|---\|
19	\| Provisioning \| Apple Business Manager + Intune Automated Device Enrollment \|
20	\| Identity / SSO \| Platform SSO (Entra ID), Enterprise SSO plug-in \|
21	\| Disk encryption \| FileVault enabled + escrow recovery key to Intune \|
22	\| App control \| Gatekeeper, XProtect (Apple-managed), notarized apps allowlist via system extensions \|
23	\| Endpoint protection \| Microsoft Defender for Endpoint on macOS \|
24	\| Configuration \| Settings catalog profiles (preferred), legacy templates where required \|
25	\| Privacy / kernel \| Privacy Preferences Policy Control (PPPC), System Extensions, Notification Center policy \|
26	\| Updates \| Managed Software Updates / Declarative Device Management (DDM) \|
27	\| Compliance \| Intune compliance policy → Conditional Access \|
28
29	## Approach
30
31	1. Enroll via ABM + Automated Device Enrollment. Manual enrollment is fine for
32	pilots; production needs ABM so devices arrive supervised, can't be unenrolled by
33	the user, and pick up policy at first boot.
34
35	2. Platform SSO (PSSO) with Entra ID is the modern macOS SSO. User signs into
36	the Mac with their Entra credentials (password, smart card, or passkey-style
37	secure enclave). Replaces the older Enterprise SSO plug-in for sign-in scenarios.
38	Requires deployment of the Microsoft Enterprise SSO plug-in package + a PSSO
39	configuration profile.
40
41	3. FileVault profile with escrow to Intune. Keys are recoverable by IT (with
42	audit). Don't deploy FileVault without escrow — locked-out users brick devices.
43
44	4. Defender for Endpoint on macOS via Intune app deployment + onboarding profile.
45	Includes:
46	- Real-time AV.
47	- Network protection.
48	- EDR.
49	- Vulnerability assessment.
50	Validate via `mdatp health` post-onboarding.
51
52	5. **Configuration profiles — start with the Microsoft macOS security baseline (or
53	CIS macOS benchmark)** and adapt. Critical settings:
54	- Gatekeeper: Mac App Store + identified developers.
55	- System extensions allowlist — required for Defender, your VPN, your DLP
56	agent. Without explicit allowlist, users see prompts and may deny.
57	- Privacy Preferences Policy Control (PPPC) — pre-approve required
58	accessibility / full-disk-access for management tools (Defender, Intune
59	management agent). Without this, MDE EDR coverage is partial.
60	- Firewall on with stealth mode.
61	- Screen lock + passcode complexity + password age aligned with policy.
62	- Disable login as root, disable guest user, disable iCloud sync of passwords
63	for managed devices (or scope by user group).
64	- Block USB mass storage for restricted populations (Defender device
65	control).
66
67	6. App management. Apps via VPP (Apple Volume Purchase Program) for App Store
68	apps; PKG/DMG for non-store apps via Intune; shell scripts for the long tail.
69	Maintain an "approved apps" catalogue.
70
71	7. Patching: Managed Software Updates / DDM. Apple's modern patch model uses
72	Declarative Device Management — deferral windows, target OS versions, force-install
73	deadlines. Replaces the older "deferral days" model. Roll out:
74	- Major version: deferral 30 days, target n-1 supported.
75	- Minor / securit

People who liked this also viewed

6 picks

Type