macOS - Firewall policy is created and assigned

Overview

Without a centrally managed firewall policy, macOS devices might rely on default or user-modified settings, which often fail to meet corporate security standards. This exposes devices to unsolicited inbound connections, enabling threat actors to exploit vulnerabilities, establish outbound command-and-control (C2) traffic for data exfiltration, and move laterally within the network—significantly escalating the scope and impact of a breach.

Enforcing macOS Firewall policies ensures consistent control over inbound and outbound traffic, reducing exposure to unauthorized access and supporting Zero Trust through device-level protection and network segmentation.

Remediation

Configure and assign macOS Firewall profiles in Intune to block unauthorized traffic and enforce consistent network protections across all managed macOS devices:

• Configure the built-in firewall on macOS devices
• Assign policies in Intune

For more information, see:

• Available macOS firewall settings

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	High
Impact on users	High
Pillar	Devices
Category	Device management
Product	Intune
Feature	Endpoint security
Area	Devices and endpoints
ATT&CK	T1021 Remote Services, T1210 Exploitation of Remote Services
Licence	Intune
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.