Big Sur - Enforce Enrollment in Mobile Device Management

Information

You _MUST_ enroll your Mac in a Mobile Device Management (MDM) software.

User Approved MDM (UAMDM) enrollment or enrollment via Apple Business Manager (ABM)/Apple School Manager (ASM) is required to manage certain security settings. Currently these include:

* Allowed Kernel Extensions
* Allowed Approved System Extensions
* Privacy Preferences Policy Control Payload
* ExtensibleSingleSignOn
* FDEFileVault

In macOS 11, UAMDM grants Supervised status on a Mac, unlocking the following MDM features, which were previously locked behind ABM:

* Activation Lock Bypass
* Access to Bootstrap Tokens
* Scheduling Software Updates
* Query list and delete local users

Solution

Ensure that system is enrolled via UAMDM.

See Also

https://github.com/usnistgov/macos_security

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-2, 800-53|CM-6, CCE|CCE-85338-2

Plugin: Unix

Control ID: 8095657913444e1dd17ffa7a7bc976e1f2b2dd3033f389015eee1a8840045a51