TMA-IOS-2.1.1
Ensure a "Consent Message" has been "Configured"
Description
This recommendation pertains to the configuration of a consent message shown at the time of a configuration profile installation. Typically, the enrollment of devices into a Mobile Device Management (MDM) solution requires users to provide their approval. Such approval can waive the need of a consent message. The enrolled MDM must be the organization approved MDM. Profile: Level 1 - End-User Owned Devices.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
From the Configuration Profile: Apple Configurator > Configuration Profile > General tab > verify that under the heading Consent Message, there is an appropriate consent message configured. There is no method to determine if the installed configuration profile included a consent message from the device.
How it is fixed
Fix method: Guidance or infrastructure patch
Apple Configurator > Configuration Profile > General tab > under the heading Consent Message, insert an appropriate consent message > Deploy the Configuration Profile.
Properties
- Operating systems
- Any
- Tags
- iosend-user-owned
- Reference
- CIS Apple iOS 26 Benchmark v1.0.0 - 2.1.1 Ensure a "Consent Message" has been "Configured"