TMA-INTUNE-MACOS-2.10.4
Ensure "Allow Standard User OS Updates" is set to "Allowed"
Description
This recommendation controls whether standard, non-administrative user accounts are permitted to initiate and install macOS operating system updates. When configured to "Allowed", users who are not local administrators can perform OS updates without requiring administrator intervention. To ensure devices are updated to a specific approved OS version, this configuration should be used in combination with recommendation 2.10.1.1 "Enforce Latest Software Update Version", or an acceptable substitute highlighted in the 2.10.1.1 description section. The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
macOS: Intune admin center: Expand the Declarative Device Management (DDM) heading; Under the Software Update Settings subheading; Verify that Allow Standard User OS Updates is present and set to Allowed. On the device: Double-click Management Profile; Under the Device Declarations section; Click Software Update Settings; Confirm Allow Standard User OS Updates is set to On
How it is fixed
Fix method: Guidance or infrastructure patch
Intune admin center: Select Declarative Device Management (DDM) then Software Update Settings; Check Allow Standard User OS Updates; On the left side of the page set Allow Standard User OS Updates to Allowed; Verify that Allow Standard User OS Updates is present and set to Allowed
Properties
- Operating systems
- Any
- Tags
- intune-macosintunemanual-review
- Reference
- CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.10.4 Ensure "Allow Standard User OS Updates" is set to "Allowed"