Ensure "Enforce Latest Software Update Version" is set to "True"

中レベル 1手動レビューintune-macos

説明

The "Enforce Latest Software Update Version" setting, mandates that device install the latest available software update. When set to "True", the update is enforced by the system rather than remaining optional for the user. Administrators may also configure an "Install Time" (e.g., 02:00) and a "Delay In Days" (0-30) to manage the rollout. Intune allows a delay of up to 30 days, this may exceed the recommended remediation window for critical vulnerabilities, organizations should set this delay as short as operationally feasible (typically 7 days) to maintain a strong security posture. ... The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

macOS: Intune admin center: Expand the Declarative Device Management (DDM) heading; Under the Software Update Enforce Latest subheading; Verify that Enforce Latest Software Update Version is present and set to True

修正方法

修正方法: ガイダンスまたは IaC パッチ

Intune admin center: Select Declarative Device Management (DDM) then Software Update Enforce Latest; Check Enforce Latest Software Update Version; On the left side of the page set Enforce Latest Software Update Version to True; Verify that Enforce Latest Software Update Version is present and set to True

プロパティ

オペレーティングシステム: すべて
タグ: intune-macosintunemanual-review
参照: CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.10.1.1 Ensure "Enforce Latest Software Update Version" is set to "True"