macOS Security Guide for Enterprises

Macs ship with strong built-in security, but in most enterprises those protections are left at consumer defaults, users hold local admin rights and nobody can prove which machines are encrypted, patched or monitored. macOS security is less about adding products and more about owning the controls Apple already provides: enrolment, configuration profiles, Gatekeeper, XProtect, FileVault, privacy permissions and the Endpoint Security framework. This guide explains how those controls work, which settings to enforce through device management, how attackers get around them, and how to detect and measure the result. It is written for endpoint engineers, security architects and detection teams running mixed or Mac-heavy fleets, including developer Macs that hold production credentials.

Key takeaways

• Enrolment is the foundation. Automated Device Enrolment gives you supervised Macs with management users cannot remove; without it, many security payloads cannot be applied.
• Apple's malware layers stop known threats, not users who approve them. Attackers now persuade users to override Gatekeeper, paste Terminal commands or type passwords into fake prompts.
• Privacy permissions (TCC) are the real perimeter on a Mac. Full Disk Access, Accessibility and Screen Recording grants decide what malware can read or control, so manage them with Privacy Preferences Policy Control profiles and monitor changes.
• Local admin and developer secrets are the identity risk. Remove standing admin rights, use Platform SSO to tie the Mac to your identity provider, and move developer tokens out of plain-text files into short-lived credentials.
• Measure from the device, not the console. FileVault with escrowed keys, current OS and Background Security Improvements, standard-user ratio and Gatekeeper overrides are the numbers that show the fleet is actually protected.

The macOS security architecture in one table

Apple describes its malware defence in three layers: prevent launch, block on the system and remediate malware that has run. Underneath sit hardware-tied integrity controls: on Apple silicon the bootloader verifies the Signed System Volume seal before starting the kernel, and FileVault keys are handled only in the Secure Enclave.

Enrolment, supervision and declarative management

Most controls in this guide are delivered as profiles or declarations from a device management (MDM) service, and several apply only to supervised Macs. How a Mac is enrolled decides what you can enforce.

• Automated Device Enrolment (ADE): Macs assigned in Apple Business Manager enrol during Setup Assistant, become supervised and can have a non-removable MDM profile. It is the only route that survives a user erasing and reinstalling the Mac.
• User-approved enrolment: works for existing Macs, but users can remove the profile. Treat it as a migration step to ADE.
• Declarative Device Management (DDM): the Mac holds declarations and reports status on its own instead of waiting to be polled. Software update enforcement and Background Security Improvement settings are DDM configurations.
• Bootstrap token: escrowed at enrolment, it lets MDM grant secure tokens and authorise updates on Apple silicon; from macOS 26.4 it can also enable FileVault in unattended deployments.

Check enrolment with profiles status -type enrollment. The MDM console is one of the most privileged systems you own: its administrators can wipe or push code to every Mac, as the Stryker cyberattack showed with one hijacked admin account.

Malware defences: Gatekeeper, notarisation and XProtect

Notarisation is an Apple malware scan of developer software that produces a ticket Gatekeeper can verify offline. Apple can revoke tickets for software later found malicious, and macOS checks revocations more often than it fetches XProtect signatures, which update independently of OS updates and are checked daily by default.

Settings to enforce

• Gatekeeper: use the System Policy Control payload (com.apple.systempolicy.control) with EnableAssessment true and AllowIdentifiedDevelopers true, and prevent users from switching Gatekeeper off. Allowing only App Store software is rarely workable for enterprises.
• User override: from macOS 15, users can no longer bypass Gatekeeper with Control-click; they must approve the app in System Settings, Privacy & Security. That makes override a deliberate act worth alerting on, and macOS 15 and later reports these overrides to Endpoint Security clients.
• Background updates: keep automatic XProtect and system data file updates on; blocking Apple update endpoints at a proxy silently ages every Mac's protection.
• Extensions: pre-approve the system extensions your security tools need by team identifier, and avoid approving legacy kernel extensions.

Where the built-in layers stop

Apple's layers target known malicious content and unsigned code, so current macOS threats rely on the user: fake installers with instructions to approve them in System Settings, commands pasted into Terminal (which never receive the quarantine attribute that triggers Gatekeeper), and AppleScript dialogs asking for the password. ATT&CK v20 tracks T1553.001 Gatekeeper Bypass under Defense Impairment, centred on the com.apple.quarantine attribute. To restrict execution further, see the Application Allowlisting Guide; for EDR, see the Endpoint Security Guide.

Privacy permissions: TCC and PPPC profiles

Transparency, Consent and Control (TCC) decides whether an app can read Mail, Messages, browser data and other users' files, record the screen or control the Mac. Grants live in per-user and system TCC.db databases, the system one protected by SIP. Malware holding Full Disk Access or Accessibility can reach almost everything the user can, hence ATT&CK T1548.006 TCC Manipulation.

The Privacy Preferences Policy Control payload (com.apple.TCC.configuration-profile-policy) sets these grants centrally. It requires supervision, and where payloads overlap the more restrictive setting wins. Each entry pairs a bundle ID or path with the code requirement from codesign -dr -, so a re-signed binary does not inherit the grant.

Keep Full Disk Access and Accessibility holders few, owned and reviewed; an agent holding them is itself a high-value target.

Persistence: launch agents, launch daemons and login items

Launch agents and daemons are property list files read by launchd. ATT&CK T1543.001 Launch Agent describes plists placed in ~/Library/LaunchAgents or /Library/LaunchAgents with RunAtLoad or KeepAlive set to true, so the payload runs at every login. Launch daemons (T1543.004) in /Library/LaunchDaemons run as root, and login items (T1547.015) start at sign-in. SIP protects the /System/Library equivalents.

• Background Task Management (macOS 13 and later): registers new login and launch items, lists them in System Settings, General, Login Items, and notifies the user. sfltool dumpbtm lists everything registered.
• Managed Login Items: the Service Management payload approves items by TeamIdentifier, BundleIdentifier, BundleIdentifierPrefix, Label or LabelPrefix. Approve your own agents by team identifier so unapproved items stand out.
• Inventory: collect the BTM inventory or the launch directory plists on a schedule and diff it. A new item pointing into a user-writable or hidden directory is high signal.

For the full catalogue across operating systems, see the Persistence Techniques Guide.

Encryption, patching, firewall and Lockdown Mode

FileVault with escrow

On Apple silicon and T2 Macs the volume is always encrypted; FileVault adds the user's password to the key protection. Require FileVault in Setup Assistant so the Mac waits until it is on and the recovery key is escrowed. From macOS 26.4 it is on by default there, but you still need management to escrow the key and stop users turning it off. There is one personal recovery key per volume, encrypted to your certificate before escrow and rotatable after use. Unlocking accounts need a secure token and, on Apple silicon, volume ownership.

Patching and Background Security Improvements

Background Security Improvements are, in Apple's words, "a type of software release for applying security fixes to users more frequently". They apply only to the latest minor OS version, ignore the managed update delay, carry a letter suffix such as (a) and need a restart when they touch the OS. In DDM, set InstallSecurityUpdate to AlwaysOn and EnableRollback to false, and read StatusDeviceOperatingSystemSupplementalExtraVersion to confirm installation. Deferring minor updates defers these fixes too. See the Patch Management Guide for rings and deadlines.

Firewall

The Application Firewall is off by default. Enforce it with the firewall payload (com.apple.security.firewall) using EnableFirewall and EnableStealthMode, and consider BlockAllIncoming for laptops that never serve content. ATT&CK v20 tracks disabling it as T1686 Disable or Modify System Firewall, so alert when a managed Mac reports it off.

Lockdown Mode

Lockdown Mode (macOS Ventura and later) is, in Apple's description, an extreme protection for "the very few individuals" who might be personally targeted. It blocks most message attachments and complex web technologies, and prevents MDM enrolment and new profiles while on, though an enrolled Mac stays managed. Offer it to targeted staff after enrolment, not as a fleet baseline.

Where identity fits

Local admin rights

A standard user cannot install launch daemons, change system settings or load extensions without admin credentials, which closes off many persistence and tampering options. Make users standard during ADE, create a separate managed administrator with the AccountConfiguration command, and rotate its password from MDM (SetAutoAdminPassword) so no fleet-wide admin password exists. Grant temporary elevation through a time-limited, logged workflow. See the Endpoint Privilege Management Guide and the JIT Access Guide.

Platform SSO and the identity provider

Platform SSO (macOS 13 and later) links the Mac login to your identity provider through the provider's SSO extension.

• Secure Enclave key: hardware-bound and phishing-resistant; the user still unlocks the Mac with a local password. The default choice for most staff.
• Password (with sync): aligns local and identity provider passwords, including WS-Trust federation; simpler for shared Macs but inherits password weaknesses.
• Smart card: fits organisations already issuing PIV-style credentials.
• Admin by group (macOS 14 and later): identity provider groups map to Standard, Administrator or specific authorisation rights, refreshed at each sign-in, which brings admin entitlement into access reviews.
• ADE integration (macOS 26 and later): registration can be enforced in Setup Assistant, so the first account comes from the corporate identity.

A full identity provider login is required every 18 hours by default. For session protection see the Identity Provider and SSO Security Guide and, for compliant-device conditions and attestation, the Device Trust and Posture Guide.

Keychain and developer secrets

The login keychain (T1555.001) holds saved passwords and tokens, and browser stores (T1555.003) and session cookies (T1539) are what macOS infostealers collect. Developer Macs add cloud CLI credentials, Kubernetes configs, registry tokens and SSH keys in plain-text files. Replace long-lived keys with short-lived SSO-issued credentials, restrict iCloud Keychain sync (allowCloudKeychainSync) where corporate secrets could reach personal accounts, and treat a compromised developer Mac as a credential incident. The GlassWorm campaign showed how tokens taken from developer workstations become the next infection route. See the Secrets Management Guide.

Detection: Endpoint Security, eslogger and unified logging

The Endpoint Security framework is Apple's supported interface for security tools. Clients run as entitled system extensions with Full Disk Access and subscribe to authorisation events such as ES_EVENT_TYPE_AUTH_EXEC (which can block execution) and notifications such as ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED and ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE. Newer events cover background task registration, XProtect detections and Gatekeeper overrides. The built-in eslogger (macOS 13 and later) prints the same events as JSON for testing detections. Unified logging (log show, log collect) and sysdiagnose add investigation context.

Metrics that show it is working

• Enrolment coverage: percentage of Macs enrolled through ADE and supervised, against hardware inventory.
• Encryption assurance: percentage with FileVault on and a valid escrowed recovery key.
• Patch currency: percentage on the latest minor release plus current Background Security Improvement within your deadline.
• Standard-user ratio: percentage of primary users without standing admin rights.
• Gatekeeper overrides and new persistence items: count per week, with the share triaged within one working day.
• Telemetry health: percentage of Macs with the security agent reporting in the last 24 hours and its Full Disk Access grant present.

Rolling out a macOS security baseline

The NIST macOS Security Compliance Project (mSCP), run jointly by NIST, NASA, DISA and Los Alamos National Laboratory, turns rules derived from NIST SP 800-53 into profiles, DDM assets, documentation and compliance scripts, with baselines including CIS Benchmark Levels 1 and 2, DISA STIG and NIST SP 800-171. Build from it rather than from scratch.

1. Inventory and enrol: reconcile Apple Business Manager, MDM and asset records, and plan ADE re-enrolment for manually enrolled Macs.
2. Choose a baseline: start with CIS Level 1 or the 800-53 low or moderate rules, recording each exception with an owner.
3. Audit before enforcing: run the compliance script in check-only mode on a sample, then deploy to an IT pilot ring covering each chip type and OS version.
4. Deploy in rings: IT, early adopters including developers, then everyone, holding each ring at least a week, with a help desk script for TCC and login item prompts.
5. Remove admin rights and add Platform SSO: once elevation works for the pilot, convert users to standard and register them.
6. Connect detection: confirm telemetry reaches the SIEM and the detections above fire in test.
7. Roll back safely: removing a profile reverses most settings at the next check-in, so keep the previous version ready. FileVault and admin removal are slow to reverse; pilot them longest.

Small organisations get most of the value from ADE, an MDM service, CIS Level 1, FileVault escrow, standard users and Apple's malware layers, with eslogger and MDM inventory for basic monitoring. Large or regulated organisations should add an Endpoint Security based EDR, DDM status reporting, Platform SSO with group-based admin, separate developer and high-risk baselines, and mSCP evidence for auditors.

Framework mapping

Common failure patterns

• Manual enrolment left in place: users remove the MDM profile or reinstall macOS, and the Mac silently drops out of every control.
• Escrow assumed, never tested: the recovery key was never escrowed or no longer matches, so a forgotten password means wiping the Mac. Test a recovery each quarter.
• Everyone is an admin: one fake password prompt then gives malware root. Elevation on request removes the excuse.
• Over-broad PPPC grants: Full Disk Access granted by path rather than code requirement, or to scripting hosts such as Terminal, gives any script the agent's reach.
• Corporate credentials synced to personal accounts: passwords saved in a personal browser profile or personal keychain sync leave the organisation's control, as the Okta support system breach showed with a service account saved to a personal Google profile.
• Updates deferred indefinitely: long minor-update deferrals also hold back Background Security Improvements, and blocked Apple endpoints stall XProtect.

Practitioner checklist

• Assign every corporate Mac to Automated Device Enrolment and make the MDM profile non-removable.
• Protect MDM administrator accounts as tier-zero identities with phishing-resistant MFA and approval for bulk actions.
• Build the configuration baseline from mSCP and record every exception with an owner.
• Enforce Gatekeeper, keep XProtect and Background Security Improvements automatic, and prevent rollback.
• Require FileVault at Setup Assistant, escrow and rotate personal recovery keys, and test recovery.
• Manage Full Disk Access, Accessibility and AppleEvents through PPPC with code requirements, and review holders quarterly.
• Approve your own agents with Managed Login Items rules and alert on new unapproved persistence items.
• Remove standing local admin rights, use a rotated managed admin account and a time-limited elevation workflow.
• Deploy Platform SSO with Secure Enclave keys and map admin rights to identity provider groups.
• Stream Endpoint Security telemetry to the SIEM and track the six metrics above monthly.

Standards and references

• Apple Platform Security: Protecting against malware in macOS
• Apple Platform Security: Volume encryption with FileVault in macOS
• Apple Platform Deployment: Platform SSO for macOS
• Apple Platform Deployment: Privacy Preferences Policy Control payload settings
• Apple Platform Deployment: Manage login items and background tasks on Mac
• Apple Platform Deployment: Background Security Improvements on Apple devices
• NIST: macOS Security Compliance Project
• MITRE ATT&CK: macOS Matrix

Related NHI Mgmt Group resources: Endpoint Security Guide · Mobile Device Security Guide · Device Trust and Posture Guide · Endpoint Privilege Management Guide · Secrets Management Guide