Maester Packs
LowScript packFree

CIS Apple MacOS 26 Tahoe Intune Benchmark

Checks that Intune policies configure the Level 1 recommendations of the CIS Apple MacOS 26 Tahoe Intune Benchark v1.0.0. One test per setting.

Version
0.1.0
Tests
90
Connectors
0
Published
7 Nov 2026

Pacers31Colts18 · pacers31colts18.cis-macos-intune-l1 · 0 stars · Open source · MIT

PowerShell 
Install-MtPack Pacers31Colts18/maester-packs-joeloveless/cis-macos-intune-l1

Install only packs from sources you trust. This pack is made by Pacers31Colts18, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Pacers31Colts18/maester-packs-joeloveless.

maester-packs.lock.json entry 
{  "Id": "pacers31colts18.cis-macos-intune-l1",  "Source": "Pacers31Colts18/maester-packs-joeloveless/cis-macos-intune-l1",  "Version": "0.1.0",  "Commit": "e9f51edda94c14f105b9079db5525af8814a7118",  "Digest": "sha256:1fb5cd16d2d1c7f3e628eb66ac9c519c20a96bae422ea89638eb5e50634e681f"}

← All tests

MP.JL.CISMACINT.L1.037 Show Recovery Key is set to Disabled

Severity: HighGraph

Description

CIS Apple MacOS 26 Tahoe Intune Benchark, recommendation 2.3.1.4 (Level 1).

The test passes when an assigned settings catalog policy for macOS sets Full Disk Encryption > FileVault > Show Recovery Key to Disabled, and no other assigned policy sets it to something else.

Remediation action

  1. In the Microsoft Intune admin center, go to Devices > Configuration and open (or create) a settings catalog policy for macOS.
  2. Add Full Disk Encryption > FileVault > Show Recovery Key and set it to Disabled.
  3. Assign the policy to your macOS devices, and remove any other assigned policy that sets it to something else.

%TestResult%