Get-MtMacOSCompliancePolicy
SYNOPSIS
Retrieves macOS device compliance policies with their assignment state.
SYNTAX
Get-MtMacOSCompliancePolicy [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Queries Intune device compliance policies, filters to macOS policies, and returns a normalized object per policy carrying the display name, the assignment count and the settings evaluated by the macOS compliance checks.
Assignment state is included because a compliance policy that is not assigned to any group is never evaluated against a device, so it cannot satisfy a security control.
Returns $null when the compliance policies could not be read at all, so that callers can report a skip rather than a failure. The populated result is emitted with -NoEnumerate because PowerShell unrolls collections on output: an empty list would otherwise arrive at the caller as $null and be indistinguishable from a read failure. This matters because Invoke-MtGraphRequest surfaces a failed call as a non-terminating error with a null result, which collects as a single empty element. Treating that as "no policies exist" would produce a false negative: a security finding reported purely because the signed-in account lacked permission.
Used by Test-MtMacOSSystemIntegrityProtection, Test-MtMacOSGatekeeper and Test-MtMacOSDefenderRiskScore.
Errors are deliberately not caught here. The calling check wraps its logic in try/catch and maps 401/403 to NotAuthorized and anything else to a skip, so swallowing the exception at this level would lose the status code and turn a permission problem into a false security finding.
EXAMPLES
EXAMPLE 1
Get-MtMacOSCompliancePolicy
Returns the macOS compliance policies configured in the tenant.
PARAMETERS
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.