Skip to main content
Version: 2.2.0

Test-MtMacOSDefenderRiskScore

SYNOPSIS​

Ensure at least one assigned macOS compliance policy requires a Microsoft Defender machine risk score level.

SYNTAX​

Test-MtMacOSDefenderRiskScore [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Microsoft Defender for Endpoint calculates a machine risk score for every onboarded device from its active alerts and detections. Intune compliance policy can consume that score through advancedThreatProtectionRequiredSecurityLevel, so a Mac whose risk rises above an accepted threshold is marked non-compliant and can be blocked by Conditional Access.

Without this setting, the Defender signal never reaches the access decision. A Mac with active high-severity Defender alerts stays compliant and keeps its access to corporate resources, which removes the automatic containment that Zero Trust assumes is present.

The property accepts secured, low, medium and high as thresholds. The values unavailable and notSet mean the risk score is not evaluated at all, and neither counts as configured.

This test passes if at least one assigned macOS compliance policy sets a real threshold. It also reports whether "Require the device to be at or under the machine risk score" has a matching Defender for Endpoint connector expectation, because a threshold on its own has no effect until the macOS devices are onboarded to Defender.

EXAMPLES​

EXAMPLE 1​

Test-MtMacOSDefenderRiskScore

Returns true if at least one assigned macOS compliance policy requires a Defender machine risk score level.

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtMacOSDefenderRiskScore