# macOS - Firewall policy is created and assigned
Without a centrally managed firewall policy, macOS devices might rely on default or user-modified settings, which often fail to meet corporate security…
Source: https://maester.dev/docs/tests/ZTA.24552
## Overview
Without a centrally managed firewall policy, macOS devices might rely on default or user-modified settings, which often fail to meet corporate security standards. This exposes devices to unsolicited inbound connections, enabling threat actors to exploit vulnerabilities, establish outbound command-and-control (C2) traffic for data exfiltration, and move laterally within the network—significantly escalating the scope and impact of a breach.
Enforcing macOS Firewall policies ensures consistent control over inbound and outbound traffic, reducing exposure to unauthorized access and supporting Zero Trust through device-level protection and network segmentation.
## Remediation
Configure and assign **macOS Firewall** profiles in Intune to block unauthorized traffic and enforce consistent network protections across all managed macOS devices:
- [Configure the built-in firewall on macOS devices](https://learn.microsoft.com/intune/device-configuration/endpoint-security/firewall?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Assign policies in Intune](https://learn.microsoft.com/intune/device-configuration/assign-device-profile?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
For more information, see:
- [Available macOS firewall settings](https://learn.microsoft.com/intune/device-configuration/endpoint-security/ref-firewall-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#macos-firewall-profile)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | High |
| Impact on users | High |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| ATT&CK | [T1021](/docs/tests?mitre=T1021) Remote Services, [T1210](/docs/tests?mitre=T1210) Exploitation of Remote Services |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.