Skip to main content
Version: 2.2.1-preview

MT.1216 - Ensure macOS compliance policy requires a Defender machine risk score level

Daniel Lystad
Contributed by Daniel LystadAll contributors →

Overview​

Ensure at least one assigned macOS compliance policy requires a Microsoft Defender machine risk score level.

Microsoft Defender for Endpoint calculates a machine risk score for every onboarded device based on its active alerts and detections. Intune compliance policy can consume that score through Require the device to be at or under the machine risk score, so a Mac whose risk rises above an accepted threshold is marked non-compliant and can then be blocked by Conditional Access.

Without this setting the Defender signal never reaches the access decision. A Mac with active high-severity Defender alerts stays compliant and keeps its access to corporate resources, which removes exactly the automatic containment that a Zero Trust architecture assumes is present. Detection without enforcement leaves a compromised endpoint fully trusted.

The threshold accepts Secured, Low, Medium and High. The values unavailable and notSet mean the risk score is not evaluated at all, and neither counts as configured by this test.

Note that a threshold has no effect until the macOS devices are actually onboarded to Microsoft Defender for Endpoint and the Intune connector is enabled. This test reports whether Require the device to be at or under the machine risk score is paired with device threat protection, so a threshold that can never evaluate is visible.

Remediation action​

  1. Navigate to the Microsoft Intune admin center.
  2. Confirm the Defender for Endpoint connector is enabled under Endpoint security > Microsoft Defender for Endpoint, and that Connect macOS devices is set to On.
  3. Go to Devices > Manage devices > Compliance.
  4. Select an existing macOS policy, or select + Create policy with Platform set to macOS.
  5. Under Compliance settings > Microsoft Defender for Endpoint, set Require the device to be at or under the machine risk score to Medium or stricter.
  6. On the Assignments tab, assign the policy to your macOS device or user groups.
  7. Select Next and then Create or Save.

Test Metadata​

FieldValue
Test IDMT.1216
SeverityMedium
SuiteMaester
CategoryIntune
PowerShell testTest-MtMacOSDefenderRiskScore
TagsIntune, Maester, MT.1216

Source​

  • Pester test: tests/Maester/Intune/Test-MtIntunePlatform.Tests.ps1
  • PowerShell source: powershell/public/maester/intune/Test-MtMacOSDefenderRiskScore.ps1