Ensure On-Device Dictation Is Enabled

LowLevel 1Automatedmacos

Description

In macOS 14.0 Sonoma, Apple released the ability to limit dictation to staying on-device and not sending data to the Siri servers. The use of dictation is likely to include editing documents with confidential information. While Apple does have controls to obfuscate voice data that exists on their servers, it is recommended that Dictation-collected information does not leave the local Mac.

How it is checked

Audit method: Shell command

shell

/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('forceOnDeviceOnlyDictation').js
EOS

Expected output: true

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.applicationaccess forceOnDeviceOnlyDictation = <true/>.

Properties

Operating systems: macos-26
Tags: macossystem-settings
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.18.1 Ensure On-Device Dictation Is Enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos