macOS settings
- macOS Kernel Extension settings
- macOS restrictions
- macOS Apple App Store restrictions
- Disc settings for macOS
- Media Control setting for macOS
macOS Kernel Extension settings
Starting from macOS High Sierra 10.13.2, Apple introduced the concept of “User Approved” MDM Enrollment. This optional enrollment type allows MDM management of certain security-sensitive settings. Using the macOS Kernel Extension loading enables the device user to one of the following:
- Device user manually installs an MDM enrollment profile using System Preferences
- All Device-enrolled Macs are considered user-approved enrollment.
The Kernel Extension Policy payload is designated by specifying com.apple.syspolicy.kernel-extension-policy as the PayloadType. This payload controls restrictions and settings for User Approved Kernel Extension Loading on macOS v10.13.2 and later. The profile containing the payload must be delivered via a User Approved MDM server, and it must be installed as a device profile.
In addition to the settings common to all payloads, this payload defines the following keys.
Procedure
- Go to Policies & Configs > Configurations.
- Select Add New > Apple > macOS Only > macOS Kernel Extensions. The New macOS Kernel Extension Setting dialog box opens.
-
Select Add+ and configure the settings as described in the table below.
Item
Description
Example
Name
Enter the name of the kernel extension policy. This will display in the Configurations page.
Test_kext
Description
Enter an optional description for the policy.
Kernel Ext Policy Name
Allow User Overrides
Select this check box to allow device users to approve additional kernel extensions not explicitly allowed by this configuration.
N/A
Allowed Team Identifiers
Enter the name of team identifiers that all validly-signed kernel extensions are allowed to load. The type used should be string.
PXPZ95SK77
(for Application: Global Protect VPN)
Allowed Kernel Extensions
Enter a dictionary that represents a set of validly-signed kernel extensions that will always be allowed to load on the user's device.
com.paloaltonetworks.kext.pangpd
This corresponds to Allowed Team Identifier example PXPZ95SK77
- Repeat step 3 for any additional team identifiers and kernel extensions.
- Select Save. The kernel extension displays in the Configurations page.
macOS restrictions
The macOS restrictions setting can be configured for the user or device channel. For devices running macOS 10.12 or supported newer versions, the default is user channel. If you want to apply the restrictions setting to macOS devices regardless of what user is logged in, select Device channel. If you want the restrictions setting to apply to a specific user, select User channel.
A macOS device should only have a single managed user. However, a macOS device may also have an administrator user. If you want the restrictions setting to apply to the whole device regardless of whatever user logs in, select Device channel.
Procedure
- Go to Policies & Configs > Configurations.
- Select Add New > Apple > macOS Only > macOS Restrictions to specify lockdown capabilities for macOS.
- Configure the settings as described in macOS restrictions settings .
- Select Save.
- If Notes for Audit Logs is enabled, a text dialog box opens. Enter the reason for the change and then select Confirm. For more information, see Best practices: label management.
macOS restrictions settings
The following table describes the macOS restrictions settings.
macOS Apple App Store restrictions
The macOS Apple App Store restrictions setting allows you to restrict user or device interactions with the Apple App Store. For example, you can restrict app installations and updates to administrator users only, or to MDM-installed apps in updates only.
Procedure
- Configure the settings as described in macOS App Store Restrictions options .
- Select Save.
macOS AppStore restriction options
The following table describes the macOS App Store restrictions.
The new restrictions are not automatically pushed to the devices when you upgrade. Instead, to force-push the restriction to all devices, open it and save it.
Disc settings for macOS
You can use the Finder and Disc Burning restriction settings to restrict the ability of managed macOS devices to burn data to disc. You must configure both settings to control the burning of data to disc on managed macOS devices.
Configuring Finder disc burning settings for macOS
The Finder restriction for macOS devices allow you to disable disc burning capabilities using macOS Finder on managed macOS devices. Disabling disc burning through Finder using this restriction setting will also disable disc burning regardless of the disc burning restriction setting described in Configuring the Disc Burning setting for macOS.
Procedure
- Go to Policies & Configs > Configurations.
- Select Add New > Apple > macOS Only > Disc > Finder.
- Enter a name for the Finder restriction setting.
- Select Disable Finder's Disc Burning Support to disable the disc burning capability on managed macOS devices. If you want to enable support for burning to disc using Finder, leave this option unchecked.
- Select Save.
- Select the setting you just created.
- Go to Actions > Apply to label.
- Select the labels you want to apply.
- Select Apply.
Configuring the Disc Burning setting for macOS
The Disc Burning restriction allows you to control whether users can burn data to disc on managed macOS devices. You can enable or disable disc burning, or allow the burning of data to disc only after users have gone through an authentication process. You must also create a Finder restriction in addition to the Disc Burning restriction to control disc burning on managed macOS devices.
Procedure
- Go to Policies & Configs > Configurations.
- Select Add New > Apple > macOS Only > Disc > Disc Burning.
The New Disc Burning dialog box opens. - Configure the settings as described in Disc Burning settings (macOS) .
- Select Save.
- Select the setting you just created.
- Go to Actions > Apply to label.
- Select the labels you want to apply.
- Select Apply.
Disc burning settings (macOS)
The following table describes the settings for disc buning.
Media Control setting for macOS
The Media Control setting allows you to permit or forbid users to mount, unmount, and eject on logout a variety of media, such as DVDs, network disks, and external drives. This setting enables you to fine-tune your control over media use on macOS devices, for example, you can configure all blank DVDs to be rejected by the macOS media drive, or require user authentication when connecting to a network drive.
The Supported media types are:
- BD
- Blank BD
- Blank CD
- Blank DVD
- CD
- Disk Image
- DVD
- Hard Disk External
- Hard Disk Internal
- Network Disk
Procedure
- Go to Policies & Configs > Configurations.
- Select Add New > Apple > macOS Only > Media Control.
The New Media Control Setting dialog box opens. - Configure the settings as described in Media Control Setting (macOS) .
- Select Save.
- Select the setting you just created.
- Go to Actions > Apply to label.
- Select the labels you want to apply.
- Select Apply.
Accessibility Settings Restrictions
A new Accessibility Settings Restrictions is added, which will provide the administrator to control the Mac device accessibility settings.
- Bold Text Enabled (Boolean): If true, enables bold text.
- Increase Contrast Enabled (Boolean): If true, enables increase contrast.
- Reduced Motion Enabled (Boolean): If true, enables reduced motion.
- Reduce Transparency Enabled (Boolean): If true, enables reduced transparency.
- Text Size: The accessibility text size apps that support dynamic text use. 0 is the smallest value, and 11 is the largest value available. Default 4 possible values.
- Touch Accommodations Enabled (Boolean): If true, enables touch accommodations.
- Voice Over Enabled (Boolean): If true, enables voice over.
- Zoom Enabled (Boolean): If true, enables zoom.
Associated Domains for macOS
Associated domains help to build a secure connection between the website and the application. Associated Domain allows you to share credentials or add functionality to your app from your website.
Procedure
To configure associated domains:
- Go to Policies & Configs > Configurations.
- Select Add New > Apple > macOS Only > Associated Domains.
The new Associated Domain dialog box opens. - Configure the settings as described in Associated Domain Setting (macOS) .
- Select Save to add the configuration.
- Once the configuration is added to the Configurations page, select the added configuration.
- Go to Actions > Apply to label.
- Select the labels you want to apply.
- Select Apply.