Merge pull request #40 from SkipToTheEndpoint/MacOSBeta

MacOS-v1.0

.gitattributes

@@ -1 +1,2 @@
-*.json diff working-tree-encoding=UTF-16LE-BOM eol=CRLF
+/**/IntuneManagement/**/* diff working-tree-encoding=UTF-16LE-BOM eol=CRLF
+/**/NativeImport/*.json diff working-tree-encoding=UTF-8 eol=CRLF

CHANGELOG.md

@@ -1,5 +1,9 @@
 # OIB Project Changelog
 
+# 2024-09-02
+## Release
+**[OIB MacOS v1.0](/MACOS/README.md)**
+
 # 2024-08-29
 ## Added
 **Repo Changelog**
@@ -16,4 +20,4 @@ Added [Contributors](CONTRIBUTORS.md) file to track contributors to the project,
 To support the OIB expanding into new territories, the repo structure has been redesigned to support multiple OS's. Each OS will have its own folder, with OS-specific files (readme, changelog, baseline JSON's, supporting information etc.) contained within.
 The root of the repo will now contain a README.md that will act as a "hub" for the project, linking to the various OS's and their respective README.md files.
 
-As such, some of the files previously in the root of the repo have been moved to the WINDOWS folder.
+As such, some of the files previously in the root of the repo have been moved to the WINDOWS folder.

MACOS/CHANGELOG.md

@@ -0,0 +1,46 @@
+# OIB MacOS Change Log
+
+# MacOS v1.0 Release - 2024-09-02
+As per PR [#35](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/pull/35) by @ugurkocde
+
+## Changed/Updated
+### Settings Catalog
+**MacOS - OIB - Defender Antivirus - D - Antivirus Configuration**
+* Changed the setting “Show / hide status menu icon” from enabled to disabled: Set to disabled so the icon is displayed in the menu bar, allowing users to see the status and manually force updates if needed. Key is hideStatusMenuIcon, so disable (default) shows the icon in the menubar.
+
+**MacOS - OIB - Device Security - D - Accounts and Login**
+* Changed the setting “Hide Admin Users” from true to false: Setting "Hide Admin Users" to true is super annoying. Most users are still local admins on their macOS devices, and when trying to log in, the username is not pre-filled, requiring manual entry on the login screen.
+
+**MacOS - OIB - Disk Encryption - D - FileVault**
+* Added “Recovery Key Rotation In Months” and set it to 6 months. This makes it more secure and aligns with a lot of the security baseline in enterprises (same with Bitlocker Key rotation on Windows Devices)
+Removed Defer setting as this causes problems activating it in the Setup Assistant. Despite what Microsoft Techcommunity suggests, it works better without it.
+
+**MacOS - OIB - Firewall - D - Gatekeeper**
+* Changed the setting “Allow Identified Developers” (Gatekeeper) from false to true: Some apps are installed with scripts, like Company Portal and M365. Setting "Allow Identified Developers" to false means only Apps from the App Store are allowed.
+Changed the setting “Block all incoming” (Firewall) from true to false. This prevents connection issues with devices on the same network, e.g., AirPrint, headphones, and external displays or TVs.
+
+* Enabled the setting “Guard against app modification” to enable delta updates.
+Changed Update Channel from Current Channel to Current Channel (Monthly). This is the monthly enterprise channel on Windows M365 apps.
+Changed the setting for “Updater optimization technique” from Lower network overhead to Lower processor overhead. This is because updates are only installing beta updates when Guard against app modification is enabled, and most problems users experience are related to processor performance (e.g., the device getting warmer and slower).
+
+**MacOS - OIB - Microsoft OneDrive - D - Service and Access**
+* Login → Service Management - Managed Login Items:
+<br>> Removed 2 Rules besides OneDrive (Standalone) and Launcher. KFM is only supported for the Standalone version that is part of the M365 Apps installation. You can only run one instance of OneDrive at a time, so it doesn't make sense to manage all different versions, in my opinion.
+Changed the Rule Type of OneDrive Standalone from Label to Label Prefix.
+* Privacy → Privacy Preferences Policy Control:
+<br>>Removed the identifier for com.microsoft.OneDrive-mac, which is the Store App that does not support KFM.
+* System Configuration → System Extension:
+<br>>Removed com.microsoft.OneDrive-mac.FinderSync from the identifier as this is not needed.
+
+**MacOS - OIB - Microsoft OneDrive - U - Known Folder Move**
+Added the setting “Open at login” and set it to True. This automatically starts OneDrive after the user signs in.
+
+## Removed
+### Settings Catalog
+**MacOS - OIB - Microsoft Office - D - Updates - v1.0**
+* Policy not needed as those apps are getting auto-registered into MAU. Only necessary if using different update channels for these apps, but generally not advised. The MAU Configuration is perfectly fine.
+
+---
+
+# MacOS v1.0 Beta - 2024-08-22
+Initial release for testing and feedback.

MACOS/IntuneManagement/CompliancePolicies/MacOS - OIB - Compliance - U - Device Health - v1.0.json

@@ -0,0 +1,95 @@
+{
+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/deviceCompliancePolicies(assignments(),scheduledActionsForRule(scheduledActionConfigurations()))/$entity",
+ "@odata.type": "#microsoft.graph.macOSCompliancePolicy",
+ "@odata.id": "deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)",
+ "@odata.editLink": "deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy",
+ "roleScopeTagIds@odata.type": "#Collection(String)",
+ "roleScopeTagIds": [
+ "0"
+ ],
+ "id": "5f3ba962-c068-4162-a14c-2a7917d0c0cd",
+ "createdDateTime@odata.type": "#DateTimeOffset",
+ "createdDateTime": "2024-08-19T17:12:34.7254044Z",
+ "description": null,
+ "lastModifiedDateTime@odata.type": "#DateTimeOffset",
+ "lastModifiedDateTime": "2024-08-19T17:12:34.7254044Z",
+ "displayName": "MacOS - OIB - Compliance - U - Device Health - v1.0",
+ "version": 1,
+ "passwordRequired": false,
+ "passwordBlockSimple": false,
+ "passwordExpirationDays": null,
+ "passwordMinimumLength": null,
+ "passwordMinutesOfInactivityBeforeLock": null,
+ "passwordPreviousPasswordBlockCount": null,
+ "passwordMinimumCharacterSetCount": null,
+ "passwordRequiredType@odata.type": "#microsoft.graph.requiredPasswordType",
+ "passwordRequiredType": "deviceDefault",
+ "osMinimumVersion": null,
+ "osMaximumVersion": null,
+ "osMinimumBuildVersion": null,
+ "osMaximumBuildVersion": null,
+ "systemIntegrityProtectionEnabled": true,
+ "deviceThreatProtectionEnabled": false,
+ "deviceThreatProtectionRequiredSecurityLevel@odata.type": "#microsoft.graph.deviceThreatProtectionLevel",
+ "deviceThreatProtectionRequiredSecurityLevel": "unavailable",
+ "advancedThreatProtectionRequiredSecurityLevel@odata.type": "#microsoft.graph.deviceThreatProtectionLevel",
+ "advancedThreatProtectionRequiredSecurityLevel": "unavailable",
+ "storageRequireEncryption": false,
+ "gatekeeperAllowedAppSource@odata.type": "#microsoft.graph.macOSGatekeeperAppSources",
+ "gatekeeperAllowedAppSource": "notConfigured",
+ "firewallEnabled": false,
+ "firewallBlockAllIncoming": false,
+ "firewallEnableStealthMode": false,
+ "assignments@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/assignments",
+ "assignments@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/assignments/$ref",
+ "assignments@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/assignments",
+ "scheduledActionsForRule@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/scheduledActionsForRule(scheduledActionConfigurations())",
+ "scheduledActionsForRule@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/scheduledActionsForRule/$ref",
+ "scheduledActionsForRule@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/scheduledActionsForRule",
+ "scheduledActionsForRule": [
+ {
+ "@odata.type": "#microsoft.graph.deviceComplianceScheduledActionForRule",
+ "@odata.id": "deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionsForRule(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)",
+ "@odata.editLink": "deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionsForRule(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)",
+ "id": "5f3ba962-c068-4162-a14c-2a7917d0c0cd",
+ "ruleName": null,
+ "scheduledActionConfigurations@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/scheduledActionsForRule(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionConfigurations",
+ "scheduledActionConfigurations@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionsForRule(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionConfigurations/$ref",
+ "scheduledActionConfigurations@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionsForRule(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionConfigurations",
+ "scheduledActionConfigurations": [
+ {
+ "@odata.type": "#microsoft.graph.deviceComplianceActionItem",
+ "@odata.id": "deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionsForRule(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionConfigurations(\u00273e333afe-83aa-4fe0-b5ca-0cf1401c1dbb\u0027)",
+ "@odata.editLink": "deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionsForRule(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/scheduledActionConfigurations(\u00273e333afe-83aa-4fe0-b5ca-0cf1401c1dbb\u0027)",
+ "id": "3e333afe-83aa-4fe0-b5ca-0cf1401c1dbb",
+ "gracePeriodHours": 6,
+ "actionType@odata.type": "#microsoft.graph.deviceComplianceActionType",
+ "actionType": "block",
+ "notificationTemplateId": "00000000-0000-0000-0000-000000000000",
+ "notificationMessageCCList@odata.type": "#Collection(String)",
+ "notificationMessageCCList": [
+
+ ]
+ }
+ ]
+ }
+ ],
+ "deviceSettingStateSummaries@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/deviceSettingStateSummaries/$ref",
+ "deviceSettingStateSummaries@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/deviceSettingStateSummaries",
+ "deviceStatuses@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/deviceStatuses/$ref",
+ "deviceStatuses@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/deviceStatuses",
+ "deviceStatusOverview@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/deviceStatusOverview/$ref",
+ "deviceStatusOverview@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/deviceStatusOverview",
+ "userStatuses@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/userStatuses/$ref",
+ "userStatuses@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/userStatuses",
+ "userStatusOverview@odata.associationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/userStatusOverview/$ref",
+ "userStatusOverview@odata.navigationLink": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.macOSCompliancePolicy/userStatusOverview",
+ "#microsoft.graph.assign": {
+ "title": "microsoft.graph.assign",
+ "target": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.deviceCompliancePolicy/microsoft.graph.assign"
+ },
+ "#microsoft.graph.scheduleActionsForRules": {
+ "title": "microsoft.graph.scheduleActionsForRules",
+ "target": "https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies(\u00275f3ba962-c068-4162-a14c-2a7917d0c0cd\u0027)/microsoft.graph.deviceCompliancePolicy/microsoft.graph.scheduleActionsForRules"
+ }
+}