TMA-INTUNE-MACOS-2.10.4
Ensure "Allow Standard User OS Updates" is set to "Allowed"
説明
This recommendation controls whether standard, non-administrative user accounts are permitted to initiate and install macOS operating system updates. When configured to "Allowed", users who are not local administrators can perform OS updates without requiring administrator intervention. To ensure devices are updated to a specific approved OS version, this configuration should be used in combination with recommendation 2.10.1.1 "Enforce Latest Software Update Version", or an acceptable substitute highlighted in the 2.10.1.1 description section. The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
macOS: Intune admin center: Expand the Declarative Device Management (DDM) heading; Under the Software Update Settings subheading; Verify that Allow Standard User OS Updates is present and set to Allowed. On the device: Double-click Management Profile; Under the Device Declarations section; Click Software Update Settings; Confirm Allow Standard User OS Updates is set to On
修正方法
修正方法: ガイダンスまたは IaC パッチ
Intune admin center: Select Declarative Device Management (DDM) then Software Update Settings; Check Allow Standard User OS Updates; On the left side of the page set Allow Standard User OS Updates to Allowed; Verify that Allow Standard User OS Updates is present and set to Allowed
プロパティ
- オペレーティングシステム
- すべて
- タグ
- intune-macosintunemanual-review
- 参照
- CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.10.4 Ensure "Allow Standard User OS Updates" is set to "Allowed"