Test-MtMacOSGatekeeper
SYNOPSIS
Ensure macOS devices are restricted to trusted app download locations by Gatekeeper.
SYNTAX
Test-MtMacOSGatekeeper [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gatekeeper decides which app download locations are permitted on macOS. Intune can address it two ways, and both count for this check:
- A macOS compliance policy evaluates the device's current Gatekeeper state through gatekeeperAllowedAppSource and marks the device non-compliant if it is looser than required, which feeds Conditional Access. Acceptable values are macAppStore and macAppStoreAndIdentifiedDevelopers.
- A macOS configuration policy pushes the com.apple.systempolicy.control payload, enforcing the setting on the device rather than merely observing it. The macOS endpoint protection template is deprecated, so this is authored in the settings catalog.
Unrestricted app sources are a direct initial-access path. Unsigned or ad-hoc signed binaries delivered by phishing or a drive-by download execute without Gatekeeper objection, which is how macOS infostealers are routinely installed. Restricting the allowed source breaks that chain at execution.
The check passes if at least one assigned policy of either kind restricts app sources. A compliance policy set to anywhere or left unconfigured does not count, and neither does a configuration policy that disables Gatekeeper assessment. Unassigned policies are reported but do not count towards a pass, because they are never applied or evaluated.
EXAMPLES
EXAMPLE 1
Test-MtMacOSGatekeeper
Returns true if at least one assigned policy restricts macOS app download locations.
PARAMETERS
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.