Intune: macOS
TMA-INTUNE-MACOS-2.10.4
Ensure "Allow Standard User OS Updates" is set to "Allowed"
Descripción
This recommendation controls whether standard, non-administrative user accounts are permitted to initiate and install macOS operating system updates. When configured to "Allowed", users who are not local administrators can perform OS updates without requiring administrator intervention. To ensure devices are updated to a specific approved OS version, this configuration should be used in combination with recommendation 2.10.1.1 "Enforce Latest Software Update Version", or an acceptable substitute highlighted in the 2.10.1.1 description section. The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).
Cómo se verifica
Método de auditoría: Revisión manual
macOS: Intune admin center: Expand the Declarative Device Management (DDM) heading; Under the Software Update Settings subheading; Verify that Allow Standard User OS Updates is present and set to Allowed. On the device: Double-click Management Profile; Under the Device Declarations section; Click Software Update Settings; Confirm Allow Standard User OS Updates is set to On
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Intune admin center: Select Declarative Device Management (DDM) then Software Update Settings; Check Allow Standard User OS Updates; On the left side of the page set Allow Standard User OS Updates to Allowed; Verify that Allow Standard User OS Updates is present and set to Allowed
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- intune-macosintunemanual-review
- Referencia
- CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.10.4 Ensure "Allow Standard User OS Updates" is set to "Allowed"