Get-MtMacOSGatekeeperEnforcement
SYNOPSIS
Retrieves macOS configuration policies that enforce Gatekeeper through the System Policy Control payload.
SYNTAX
Get-MtMacOSGatekeeperEnforcement [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gatekeeper can be approached two ways in Intune, and they are different controls:
- A macOS compliance policy evaluates the device's current Gatekeeper state and marks the device non-compliant if it is looser than required. That feeds Conditional Access.
- A configuration policy pushes the com.apple.systempolicy.control payload to the device, which enforces the setting rather than merely observing it.
This helper covers the second. The macOS endpoint protection template is deprecated, so new Gatekeeper configuration is authored in the settings catalog, where the payload appears as a group setting collection with the individual keys nested underneath.
Two keys matter:
- enableassessment - whether Gatekeeper assessment is on at all. With it disabled, any app runs.
- allowidentifieddevelopers - whether Developer ID signed apps are permitted in addition to App Store apps. Disabling it is the stricter App Store only posture. This is reported as $null when the key is absent from the payload, because an omitted key leaves the device's existing setting untouched and is not the same as disabling it.
Returns $null when the configuration policies could not be read, so that callers can report a skip rather than a failure.
Errors are deliberately not caught here. The calling check maps 401/403 to NotAuthorized and anything else to a skip, so swallowing the exception at this level would lose the status code and turn a permission problem into a false security finding.
EXAMPLES
EXAMPLE 1
Get-MtMacOSGatekeeperEnforcement
Returns the macOS configuration policies that configure the Gatekeeper payload.
PARAMETERS
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.