Overview There has always been a perception that macOS devices are safer than Windows PCs in terms of security. The idea that Apple devices are impenetrable, or secure is widespread. But those times are long gone, as both platforms have seen zero-dat attacks and number of vunerabilities exposed in every
There has always been a perception that macOS devices are safer than Windows PCs in terms of security. The idea that Apple devices are impenetrable, or secure is widespread. But those times are long gone, as both platforms have seen zero-dat attacks and number of vunerabilities exposed in every OS release.
I’ll provide you with a list of configurations and settings in this article that you may use to strengthen the overall security of your macOS device fleet.
This guide is provided on an ‘as is basis without any warranties. You are responsible if you break anything or if something stops functioning as it should.
This guide is based on recommendations from the Center for Internet Security (CIS) Benchmark as they are globally recognized and consensus-driven best practices for cybersecurity defences.
When you power on the Macbook for the first, it goes through setup assistant screen which ask you to set a name, a username, and a password in order to set up your first user account. This account by default becomes the local administrator. Administrator accounts have the ability to modify or remove any file and install any program, which could be dangerous if the program is malicious.
With Microsoft Intune, you can configure and enforce configurations and restrictions as minimum standard baselines for securing your MacBooks. These configurations & restrictions will help in protecting remote attacks on the device.
Apple does not allow MDM vendors to control the Bluetooth payload directly, so you will not find any setting in Intune portal to disable Bluetooth. However, you can still push a custom bash script to disable Bluetooth on your corporate macOS devices.
#!/bin/sh
$ sudo defaults write/Library/Preferences/com.apple.Bluetooth ControllerPowerState -int 0
$ sudo killall -HUP bluetoothd 
There is no default configuration available for securing the screensaver, but you can use the script available here to configure hot corner settings – Github
Using Intune, you can easily create & deploy OS update policies to ensure that your macOS devices are always updated and fully patched.
Few network configurations are also required to reduce the network-based attacks on the corporate devices.
It is true to some extent that Mac is a bit more secure as compared to Windows but still they can be infected by malware, malicious softwares/files or any zero-day attacks. To make sure, your devices are always protected, an enterprise endpoint security platform should always be installed on these devices.
You can refer to one of my previous article, to onboard the corporate owned macOS devices in Microsoft Defender for Endpoint:
macOS Management with Intune – Part II – Intune – In Real Life (intuneirl.com)
With Intune, you can easily create and enforce baseline security policies to keep the corporate MacBooks secure.
It is an everlasting list and it depends upon how secure you want the devices to be. Many of the settings, restrictions or configurations we discussed are pretty simple and should always be implemented. However, before you implement any of these benchmark, it is always advisable to perform a risk assessment of your environment and based on the feedback you should implement the policies.
I hope this will help you with configuring policies in Intune with giving more granular control over these modern and trendy devices.
