Ensure Configuration Profile Can Not be Removed by an End User

보통레벨 1수동 검토intune-macos

설명

This recommendation focuses on preventing end users from removing management profiles from organizational macOS devices. When properly implemented, the option to remove a management profile in System Settings should be grayed out (disabled), which indicates the device is enrolled via Apple Business Manager (ABM). If the removal button is clickable but requires authentication, this represents an alternative implementation. The ABM enrollment method is preferred and the most effective method to ensure management profiles remain locked to devices and cannot be removed, even by users with administrative privileges. The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

macOS: Intune admin center: Select MacOS; Select Enrollment; Select Enrollment program tokens; Select the organizations token with devices synced to it; Under the Manage heading, select profiles; Select the macOS profile assigned to organization macOS machines; Under the Manage heading, select Properties; Ensure Locked enrollment is set to Yes; Under the Monitor heading, select Assigned devices; Ensure that this profile is assigned to all organization macOS devices; From the macOS device:; Select Management Profile; Click the − symbol; Ensure this cannot be clicked (grayed out); ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Intune admin center: Select MacOS; Select Enrollment; Select Enrollment program tokens; If no token exists, select Create token and follow the ABM/ASM token creation workflow; Select the token for your organization; Under the Manage heading, select Profiles; Either select an existing profile or select Create profile; Configure the profile and ensure Locked enrollment is set to Yes; Under Assignment, ensure the profile is assigned to appropriate device groups; Click Create

속성

운영 체제: 모두
태그: intune-macosintunemanual-review
참고 자료: CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.13.1 Ensure Configuration Profile Can Not be Removed by an End User