The macOS system must enforce enrollment in Mobile Device Management (MDM).

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-268569	SRG-OS-000480-GPOS-00227	APPL-15-005110	SV-268569r1034647_rule	2025-02-20	1

Description
Users must enroll their Mac in MDM software. User Approved MDM (UAMDM) enrollment or enrollment via Apple Business Manager (ABM)/Apple School Manager (ASM) is required to manage certain security settings. Currently, these include: * Allowed Kernel Extensions. * Allowed Approved System Extensions. * Privacy Preferences Policy Control Payload. * ExtensibleSingleSignOn. * FDEFileVault. * Activation Lock Bypass. * Access to Bootstrap Tokens. * Scheduling Software Updates. * Query list and delete local users.

Description

Users must enroll their Mac in MDM software. User Approved MDM (UAMDM) enrollment or enrollment via Apple Business Manager (ABM)/Apple School Manager (ASM) is required to manage certain security settings. Currently, these include: * Allowed Kernel Extensions. * Allowed Approved System Extensions. * Privacy Preferences Policy Control Payload. * ExtensibleSingleSignOn. * FDEFileVault. * Activation Lock Bypass. * Access to Bootstrap Tokens. * Scheduling Software Updates. * Query list and delete local users.

ℹ️ Check
Verify the macOS system is configured to enforce enrollment in mobile device management with the following command: /usr/bin/profiles status -type enrollment \| /usr/bin/awk -F: '/MDM enrollment/ {print $2}' \| /usr/bin/grep -c "Yes (User Approved)" If the result is not "1", this is a finding.

✔️ Fix
Configure the macOS system by ensuring that the system is enrolled via UAMDM.