The macOS system must enforce enrollment in Mobile Device Management (MDM).

Description

<VulnDiscussion>Users must enroll their Mac in MDM software. User Approved MDM (UAMDM) enrollment or enrollment via Apple Business Manager (ABM)/Apple School Manager (ASM) is required to manage certain security settings. Currently, these include: * Allowed Kernel Extensions. * Allowed Approved System Extensions. * Privacy Preferences Policy Control Payload. * ExtensibleSingleSignOn. * FDEFileVault. * Activation Lock Bypass. * Access to Bootstrap Tokens. * Scheduling Software Updates. * Query list and delete local users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>