2.1.2 Ensure 'Controls when the profile can be removed' is set to 'Always'

Information

This recommendation pertains to the removal of a given configuration profile.

Rationale:
In this section of the benchmark, recommendations are for devices that are owned by the end-user. They are voluntarily accepting the configuration profile and should be able to remove it at will.

Solution

1. Open Apple Configurator.
2. Open the Configuration Profile.
3. In the left windowpane, click on the General tab.
4. In the right windowpane, under the heading Security, set the menu Controls when the profile can be removed to Always.
5. Deploy the Configuration Profile.

See Also

https://workbench.cisecurity.org/files/2141