74 lines
2.6 KiB
Markdown
74 lines
2.6 KiB
Markdown
# OpenIntuneBaseline - MacOS
|
|
|
|
<img src="https://raw.githubusercontent.com/ugurkocde/intunemacadmins/main/public/favicon.svg" width="100">
|
|
|
|
Developed in collaboration with [IntuneMacAdmins](https://www.intunemacadmins.com/)
|
|
|
|
## Intended Use-Case
|
|
The baseline has been designed and tested on the following scenario:
|
|
|
|
### Device:
|
|
* MacOS 14.6 or above on Apple Silicon
|
|
* Enrolled into Apple Business Manager
|
|
* ADE Deployment with the following configured:
|
|
* Management Settings:
|
|
* Enroll with User Affinity
|
|
* Setup Assistant with Modern Authentication
|
|
* Await Final Configuration -Yes
|
|
* Locked Configuration - Yes
|
|
* Setup Assistant:
|
|
* FileVault - Show
|
|
* Touch ID - Show
|
|
* M365 Apps deployed via VPP
|
|
|
|
### User:
|
|
* Cloud-Only or Hybrid Identity with Entra ID as IdP
|
|
* MFA configured via Conditional Access
|
|
|
|
### Licensing:
|
|
* M365 Business Premium or M365 E5/A5, or M365 E3/A3 + MDE P1/P2
|
|
<br>**OR**:
|
|
* Entra ID P1 or P2
|
|
* Office 365 E3/E5, A3/A5 or F3
|
|
* Intune P1
|
|
* Defender for Business or Endpoint P1/P2
|
|
|
|
> [!IMPORTANT]
|
|
> Successful application of the baseline outside of this configuration cannot be guaranteed.
|
|
|
|
---
|
|
|
|
## Importing the Baseline:
|
|
Please reference [Importing the Baseline](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/wiki#importing-the-baseline) for information.
|
|
|
|
### Post-Import Configuration
|
|
There are some settings that require manual configuration or creation post-import. These are detailed in [SETTINGSGUIDANCE](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/wiki/macos-settingsguidance).
|
|
|
|
---
|
|
|
|
## Baseline Security Posture
|
|
Primary information regarding adherence to security frameworks can be found in the main wiki [README](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/wiki#security-framework-adherence).
|
|
|
|
### Included Settings
|
|
* Entra Join and Authentication via Platform SSO Secure Enclave
|
|
* Core device security restrictions
|
|
* Device Encryption via FileVault
|
|
* Microsoft Edge (Split into multiple policies for easier management)
|
|
* Microsoft Office (Including OneDrive Known Folder Move)
|
|
* Microsoft Defender for Endpoint
|
|
* Update Configuration
|
|
|
|
All policies are Settings Catalog and will show in Devices>Configuration Profiles.
|
|
|
|
For a complete list of settings, please consult [SETTINGSOUTPUT](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/blob/main/MACOS/SETTINGSOUTPUT.md).
|
|
|
|
---
|
|
|
|
## Additional Information:
|
|
|
|
> [!TIP]
|
|
> Please visit [IntuneMacAdmins](https://www.intunemacadmins.com/) for additional information on MacOS management with Intune.
|
|
|
|
---
|
|
|
|
## [Change Log](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/blob/main/MACOS/CHANGELOG.md) |