Skip to main content
Version: 2.2.0

Test-MtMacOSSystemIntegrityProtection

SYNOPSIS​

Ensure at least one assigned macOS compliance policy requires System Integrity Protection.

SYNTAX​

Test-MtMacOSSystemIntegrityProtection [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

System Integrity Protection (SIP) is a macOS kernel-level protection that stops even the root user from modifying protected system files and processes, or attaching a debugger to system binaries. It is enabled by default.

SIP cannot be configured or enforced by an MDM. It is toggled from macOS Recovery on the device itself. What Intune can do is require it as a compliance condition, so a device with SIP disabled is marked non-compliant and can then be blocked by Conditional Access.

That distinction matters. Disabling SIP takes a deliberate, physically present action, and it is how unsigned kernel extensions get loaded, how security agents such as Microsoft Defender for Endpoint are tampered with, and how persistence is established in protected locations. Without a compliance rule, Intune reports such a device as healthy.

This test passes if at least one macOS compliance policy that is assigned to a group sets "Require a system integrity protection" to Require. Policies with no assignment are reported but do not count towards a pass, because an unassigned compliance policy is never evaluated.

EXAMPLES​

EXAMPLE 1​

Test-MtMacOSSystemIntegrityProtection

Returns true if at least one assigned macOS compliance policy requires System Integrity Protection.

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtMacOSSystemIntegrityProtection