Detections
Analytics
APPL-14-005110 - The macOS system must enforce enrollment in mobile device management.
Information
Users must enroll their Mac in a Mobile Device Management (MDM) software.User Approved MDM (UAMDM) enrollment or enrollment via Apple Business Manager (ABM)/Apple School Manager (ASM) is required to manage certain security settings. Currently these include:
* Allowed Kernel Extensions
* Allowed Approved System Extensions
* Privacy Preferences Policy Control Payload
* ExtensibleSingleSignOn
* FDEFileVault
In macOS 11, UAMDM grants Supervised status on a Mac, unlocking the following MDM features, which were previously locked behind ABM:
* Activation Lock Bypass
* Access to Bootstrap Tokens
* Scheduling Software Updates
* Query list and delete local users
Solution
Configure the macOS system by ensuring that system is enrolled via UAMDM.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_14_V2R4_STIG.zip
Item Details
Audit Name: DISA Apple macOS 14 Sonoma STIG v2r4
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-259574r991589_rule, STIG-ID|APPL-14-005110, Vuln-ID|V-259574
Plugin: Unix
Control ID: 67a3b38519ccb33807db0725df7421217de7eadd795e755ccdb34625a1ea1e24