Ensure iCloud Drive Document and Desktop Sync Is Disabled

MediumLevel 2Automatedmacos

Description

With macOS 10.12, Apple introduced the capability to have a user's Desktop and Documents folders automatically synchronize to the user's iCloud Drive, provided they have enough room purchased through Apple on their iCloud Drive. This capability mirrors what Microsoft is doing with the use of OneDrive and Office 365. There are concerns with using this capability.

How it is checked

Audit method: Shell command

shell

/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowCloudDesktopAndDocuments').js
EOS

Expected output: false

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.applicationaccess allowCloudDesktopAndDocuments = <false/>.

Properties

Operating systems: macos-26
Tags: macossystem-settings
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.1.1.3 Ensure iCloud Drive Document and Desktop Sync Is Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos --level 2