MT.1230 - Ensure iOS compliance policy requires a minimum operating system version.
Overview
Ensure at least one assigned iOS compliance policy requires a minimum operating system version.
Apple ships security fixes only in the current iOS release. A device left on an older major version keeps every browser engine and kernel vulnerability that release carried, including the ones Apple has published as actively exploited, and nothing in Intune makes the user install the update.
A minimum OS version in a compliance policy is how the tenant notices. A device below the version is marked non-compliant and can then be blocked by Conditional Access, which turns "please update" into a condition for access rather than a request.
By default this check requires only that a minimum version is set at all, because the version that is current ages out of any value fixed in a test. Set the MinimumOsVersion parameter to hold the tenant to a specific version, for example 18.0.
A version Intune reports that cannot be compared with the required one is shown with its raw value and does not count towards a pass, rather than being guessed at in either direction. Intune accepts a single part value such as 18, which is read as 18.0.
Scope limitation
This check reads Minimum OS version from the compliance policy. It does not read Maximum OS version, and it does not look at the update policies that push an iOS release to a device. A minimum version marks a device non-compliant; it does not install anything.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an unassigned compliance policy is never evaluated against any device.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Go to Devices > Manage devices > Compliance.
- Select an existing iOS/iPadOS policy, or select + Create policy with Platform set to iOS/iPadOS.
- Under Compliance settings > Device Properties > Operating System Version, set Minimum OS version to the oldest release you support.
- On the Assignments tab, assign the policy to your iOS device or user groups.
- Select Next and then Create or Save.
Raise the value in stages. A device that cannot reach the version you set stays non-compliant until it is updated or replaced, so check the operating system versions in Devices > All devices first and give users notice.
Related links
- Microsoft Intune admin center - Device compliance
- Microsoft Learn - iOS/iPadOS compliance settings in Intune
- Apple Support - Apple security releases
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1230 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | Device compliance |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1203 Exploitation for Client Execution, T1068 Exploitation for Privilege Escalation |
| Supports controls | nist-800-53-r5:SI-2, nist-800-53-r5:CM-6 |
| PowerShell test | Test-MtIosMinimumOsVersion |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1230.ps1 - Documentation:
tests/maester/intune/Test.MT.1230.md