Microsoft 365 Endpoint AdministratorManage devices and apps (55-60%)Hard
A company is using Microsoft Intune to manage its macOS devices. They want to prevent users from installing applications from outside the Mac App Store to enhance security. Which Intune policy setting should be configured to achieve this?
- AEndpoint security > Security baselines > macOS > App Store settings > Enforce Mac App Store only.
- BDevices > macOS > Configuration profiles > Create profile > Settings catalog > Search for 'App Store' and configure 'Allow installation of applications'.
- CDevices > macOS > Configuration profiles > Create profile > Templates > Device restrictions > App Store, Doc viewing, Gaming > Require apps from Mac App Store.
- DApps > macOS > App configuration policies > Managed apps > Restrict app sources.
Show answer & explanationAnswer & explanation
Correct answer: C. Devices > macOS > Configuration profiles > Create profile > Templates > Device restrictions > App Store, Doc viewing, Gaming > Require apps from Mac App Store.
To restrict macOS application installations to only the Mac App Store, you configure a 'Device restrictions' profile. This specific setting is found under 'App Store, Doc viewing, Gaming' within the macOS device restrictions template.
Why the other options are wrong
- A. While security baselines apply security settings, there isn't a dedicated macOS security baseline with this specific granular control over App Store sources. Device restrictions are more appropriate for this specific user experience control.
- B. The Settings catalog offers granular settings, but the specific setting for 'Allow installation of applications' from the App Store only is typically found within the structured 'Device restrictions' template, making it the more direct and intended method.
- D. App configuration policies are used to configure settings *within* managed applications, not to restrict the source of application installations for the entire device.
Intune macOS App Source Restriction
A Microsoft Intune device restriction setting for macOS devices that limits users to installing applications only from the official Mac App Store, preventing installations from unknown developers or third-party sources.
- Enhances security by controlling application provenance.
- Configured within a macOS 'Device restrictions' configuration profile.
- Prevents side-loading or installation of potentially malicious software.
Memory trick: Mac App Store: Device Restrictions Seal the Source.