Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

macos-intune-baseline

Étoiles158

Forks34

Mis à jour18 juin 2026 à 15:39

Guidance for hardening macOS endpoints managed by Microsoft Intune — automated device enrollment via Apple Business Manager (ABM), platform single sign-on (PSSO) with Entra ID, FileVault disk encryption escrow, security configuration profiles (Gatekeeper, XProtect, system extensions allowlist, firewall, login window, Privacy Preferences Policy Control / PPPC), Microsoft Defender for Endpoint on macOS, app management (VPP / managed apps / shell scripts via Intune), patching strategy (managed software updates / DDM), Conditional Access compliance signal, and cross-platform identity model. WHEN: Mac Intune baseline, macOS hardening Intune, FileVault escrow, ABM Apple Business Manager, Platform SSO macOS, PSSO Entra, MDE on Mac, Gatekeeper Intune, system extensions Intune, PPPC Intune, macOS compliance Conditional Access. DO NOT USE for general Intune device management end-to-end (use intune-device-mgmt), MDE config alone (use defender-for-endpoint), or iOS device management.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

vinayaklatthe

vinayaklatthe/microsoft-security-skills

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

Plus depuis ce dépôt

même dépôt

agent-identity-governance

vinayaklatthe/microsoft-security-skills

Guidance for governing the identities of AI agents and non-human identities (NHIs) — Microsoft 365 Copilot Studio agents, Microsoft Foundry agents, custom AI agents, and traditional service principals/managed identities — through their full lifecycle. Covers ownership and tagging, scoped permissions and consent (delegated vs application; Sites.Selected; mailbox-scoped Graph), credential hygiene (federated credentials, certificates, no secrets), Conditional Access for workloads, agent-level access reviews via Entra ID Governance, lifecycle workflows for agent decommissioning, audit (agent prompts, agent actions, agent identity sign-ins), incident response when an agent is compromised, and integration with Purview AI Hub for usage signals. WHEN: AI agent identity governance, non-human identity governance, NHI lifecycle, Copilot Studio agent identity, Foundry agent governance, agent service principal, scoped Graph permissions agent, agent access review, decommission AI agent, agent credential rotation, compromis

2026-06-18158

azure-ai-content-safety

vinayaklatthe/microsoft-security-skills

Guidance for Azure AI Content Safety — programmatic content moderation for text, images, multimodal, and generative AI guardrails. Covers Content Safety categories (hate, violence, sexual, self-harm) with severity levels, Prompt Shields for jailbreak and indirect prompt injection detection, groundedness detection (hallucination check vs grounding sources), protected material detection (text and code), custom categories, blocklists, Content Safety Studio for tuning, integration with Azure OpenAI as input/output filters (built-in plus custom), latency/cost trade-offs, agent guardrails, and deployment patterns (sidecar in app, integrated with Azure OpenAI). WHEN: Azure AI Content Safety, prompt shields, jailbreak detection, indirect prompt injection, groundedness check, protected material detection, content moderation, generative AI guardrails, harmful content categories, custom blocklist AI, agent guardrail. DO NOT USE for AI workload threat detection / SOC alerts (use defender-for-cloud-ai), end-user AI usage

2026-06-18158

azure-bastion-jit

vinayaklatthe/microsoft-security-skills

Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access. Covers Bastion SKU selection (Developer / Basic / Standard / Premium), IP-based and shareable-link connections, native client (RDP/SSH from local machine via az CLI), session recording (Premium), private-only deployment, JIT request workflow and policy, RBAC for connect operations, integration with Conditional Access (via Bastion + Entra login on the VM), Azure Policy enforcement to require Bastion + JIT and prohibit public IP on VMs, and migration off VPN/jump-box patterns. WHEN: Azure Bastion design, Bastion SKU comparison, JIT VM access, just-in-time access Azure, Bastion shareable link, native client Bastion, session recording Bastion, eliminate public IP on VMs, replace jump host with Bastion, secure RDP SSH Azure, Bastion Premium recording. DO NOT USE for hybrid/SD-WAN VPN design, GSA Private Access (use entra-global-secure-access), or cluster-only K8s access.

2026-06-18158

azure-confidential-computing

vinayaklatthe/microsoft-security-skills

Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs). Covers Confidential VMs (AMD SEV-SNP, Intel TDX), Confidential containers on AKS (Kata + AMD SEV-SNP), confidential GPU VMs (NVIDIA H100 with TDX), Azure Key Vault Managed HSM and Premium with secure-key-release for confidential workloads, attestation (Microsoft Azure Attestation service), confidential ledger, scenarios (multi-party data sharing, regulated workload isolation, AI training on sensitive data), key-release policies tying secrets to attested TEE state, and decision criteria vs CMK/Customer Key. WHEN: Azure Confidential Computing, AMD SEV-SNP, Intel TDX, confidential VM, confidential AKS container, confidential GPU H100, Azure Attestation, secure key release, multi-party computation, confidential AI, encrypted memory Azure, hardware enclave Azure. DO NOT USE for general data-at-rest CMK (use azure-key-vault), application encryption SDK only, or non-Azure TEE design.

2026-06-18158

azure-ddos-protection

vinayaklatthe/microsoft-security-skills

Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform. Covers tier selection vs free Basic infrastructure protection, scope (VNet vs single IP), traffic profiling and mitigation policy auto-tuning, attack analytics and metrics, attack alerts to Sentinel, DDoS Rapid Response engagement, integration with Azure WAF and Front Door, cost-protection guarantee, mitigation reports for compliance, and per-region capacity planning. WHEN: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, layer 3/4 DDoS, attack analytics Azure, DDoS rapid response, cost protection DDoS, DDoS metrics, mitigation report, simulate DDoS Azure. DO NOT USE for layer 7 / app-layer attack mitigation alone (use azure-waf), Azure Firewall design (use azure-firewall), or hybrid network DDoS via on-prem appliances.

2026-06-18158

azure-monitor-security

vinayaklatthe/microsoft-security-skills

Guidance for the security-side use of Azure Monitor and Log Analytics — designing the workspace strategy that feeds Microsoft Sentinel and Defender for Cloud, choosing analytics vs basic vs auxiliary log tiers, retention and archive, table-level transformations to drop noise pre-ingestion, Data Collection Rules (DCRs) and Azure Monitor Agent (AMA), workspace topology (single vs regional vs sovereign), commitment tiers and cost control, customer-managed keys for the workspace, RBAC including table-level RBAC, integration with Sentinel (workspace requirements), and decommissioning legacy MMA. WHEN: Log Analytics workspace design, Azure Monitor security data, Sentinel workspace, log tier basic auxiliary, AMA Azure Monitor Agent, DCR data collection rule, drop columns ingestion transform, log retention archive, workspace CMK, table-level RBAC, log ingestion cost control. DO NOT USE for Sentinel detection authoring (use sentinel-detection-engineering), App Insights instrumentation (use appinsights-instrumentation)

2026-06-18158

name	macos-intune-baseline
description	Guidance for hardening macOS endpoints managed by Microsoft Intune — automated device enrollment via Apple Business Manager (ABM), platform single sign-on (PSSO) with Entra ID, FileVault disk encryption escrow, security configuration profiles (Gatekeeper, XProtect, system extensions allowlist, firewall, login window, Privacy Preferences Policy Control / PPPC), Microsoft Defender for Endpoint on macOS, app management (VPP / managed apps / shell scripts via Intune), patching strategy (managed software updates / DDM), Conditional Access compliance signal, and cross-platform identity model. WHEN: Mac Intune baseline, macOS hardening Intune, FileVault escrow, ABM Apple Business Manager, Platform SSO macOS, PSSO Entra, MDE on Mac, Gatekeeper Intune, system extensions Intune, PPPC Intune, macOS compliance Conditional Access. DO NOT USE for general Intune device management end-to-end (use intune-device-mgmt), MDE config alone (use defender-for-endpoint), or iOS device management.
license	MIT
metadata	{"author":"Microsoft","version":"0.1.0"}

macOS Hardening with Microsoft Intune

Mac fleets in Microsoft-shop enterprises are usually under-governed compared to Windows. Intune-managed macOS with the right configuration profiles, FileVault escrow, Defender for Endpoint, and Platform SSO with Entra ID closes most of the gap and gives you a Conditional Access compliance signal that actually means something.

When to use

Designing or hardening macOS endpoint management in an Intune + Entra ID environment (workforce devices, BYOD via user-enrollment is a separate model).

Do not use this skill for end-to-end Intune (intune-device-mgmt), MDE policy authoring (defender-for-endpoint), or iOS / iPadOS management.

Capability map

Layer	Tool / Profile
Provisioning	Apple Business Manager + Intune Automated Device Enrollment
Identity / SSO	Platform SSO (Entra ID), Enterprise SSO plug-in
Disk encryption	FileVault enabled + escrow recovery key to Intune
App control	Gatekeeper, XProtect (Apple-managed), notarized apps allowlist via system extensions
Endpoint protection	Microsoft Defender for Endpoint on macOS
Configuration	Settings catalog profiles (preferred), legacy templates where required
Privacy / kernel	Privacy Preferences Policy Control (PPPC), System Extensions, Notification Center policy
Updates	Managed Software Updates / Declarative Device Management (DDM)
Compliance	Intune compliance policy → Conditional Access

Approach

Enroll via ABM + Automated Device Enrollment. Manual enrollment is fine for pilots; production needs ABM so devices arrive supervised, can't be unenrolled by the user, and pick up policy at first boot.
Platform SSO (PSSO) with Entra ID is the modern macOS SSO. User signs into the Mac with their Entra credentials (password, smart card, or passkey-style secure enclave). Replaces the older Enterprise SSO plug-in for sign-in scenarios. Requires deployment of the Microsoft Enterprise SSO plug-in package + a PSSO configuration profile.
FileVault profile with escrow to Intune. Keys are recoverable by IT (with audit). Don't deploy FileVault without escrow — locked-out users brick devices.
Defender for Endpoint on macOS via Intune app deployment + onboarding profile. Includes:
- Real-time AV.
- Network protection.
- EDR.
- Vulnerability assessment. Validate via mdatp health post-onboarding.
Configuration profiles — start with the Microsoft macOS security baseline (or CIS macOS benchmark) and adapt. Critical settings:
- Gatekeeper: Mac App Store + identified developers.
- System extensions allowlist — required for Defender, your VPN, your DLP agent. Without explicit allowlist, users see prompts and may deny.
- Privacy Preferences Policy Control (PPPC) — pre-approve required accessibility / full-disk-access for management tools (Defender, Intune management agent). Without this, MDE EDR coverage is partial.
- Firewall on with stealth mode.
- Screen lock + passcode complexity + password age aligned with policy.
- Disable login as root, disable guest user, disable iCloud sync of passwords for managed devices (or scope by user group).
- Block USB mass storage for restricted populations (Defender device control).
App management. Apps via VPP (Apple Volume Purchase Program) for App Store apps; PKG/DMG for non-store apps via Intune; shell scripts for the long tail. Maintain an "approved apps" catalogue.
Patching: Managed Software Updates / DDM. Apple's modern patch model uses Declarative Device Management — deferral windows, target OS versions, force-install deadlines. Replaces the older "deferral days" model. Roll out:
- Major version: deferral 30 days, target n-1 supported.
- Minor / security: deferral 7 days, target latest within supported.
Compliance policy → Conditional Access.
- FileVault on.
- System integrity protection (SIP) enabled.
- OS version ≥ supported floor.
- Defender threat agent healthy + real-time protection on.
- Encryption + screen lock conformant. Mark non-compliant devices and enforce via CA on M365 and Azure resources.
Operate.
- Defender for Endpoint device inventory + vulnerability management prioritization for Mac.
- Quarterly review of system extensions and PPPC allowlist (apps come and go).
- Monthly compliance trend.

Guardrails

FileVault without escrow is a help-desk disaster. Escrow first, enforce later.
System extensions and PPPC allowlists must be deployed before the agents that need them. Otherwise users get prompts and click Deny — agents become ineffective.
Don't ship the Enterprise SSO plug-in and Platform SSO simultaneously without understanding the precedence. PSSO is the strategic direction; coexist carefully.
Don't mix CIS and Microsoft baselines without harmonization. Conflicting settings.
VPP apps require ABM linkage. Without ABM, you're stuck with user Apple IDs.
MDE coverage on Mac depends on accessibility + full-disk-access PPPC. Verify; otherwise EDR is partial.
Managed Software Updates needs supervised devices. User-enrolled BYOD has different capabilities.
Compliance grace periods of 14+ days defeat the model. Tighten as fleet matures.
Don't allow iCloud Drive personal accounts to sync corporate data. Restrict via policy or BYOD-grade user enrollment for those users.

Common anti-patterns

"FileVault rolled out, escrow on the to-do list" — users locked out, IT can't recover.
"Defender installed, no PPPC profile" — EDR sees user-mode events but not full-disk-access events.
"System extensions prompt the user; some users approved Defender, some didn't" — fragmented coverage. Allowlist via profile.
"Compliance check skipped OS version floor" — devices on 2-major-versions-back with unpatched CVEs marked compliant.
"Manual enrollment in production" — users can unenroll, policy isn't enforced.
"App store apps via personal Apple IDs" — license sprawl, no removal on offboard.
"Patching policy = trust users to update" — fleet drifts; CVE backlog grows.
"Conditional Access for Mac applied 'All users + All cloud apps'" — break-glass outage. Stage like Windows rollout.

Example prompts

Stand up macOS management for a 5,000-device creative workforce: ABM + Intune ADE + PSSO + FileVault escrow + MDE + baseline.
Build the system extensions and PPPC allowlist for Defender, our VPN, and our DLP agent.
Migrate from the older Enterprise SSO plug-in to Platform SSO with Entra ID password / Smart Card use case.
Compliance policy mapping macOS to Conditional Access for M365 and Azure portal.
Patching policy with Managed Software Updates / DDM for Sonoma → Sequoia cutover.
Compare Microsoft macOS baseline with CIS macOS benchmark and reconcile conflicts.
BYOD user-enrollment design vs corporate-owned ADE — capability and trade-off table.
MDE on Mac: confirm EDR coverage via PPPC, validate vulnerability assessment pipeline.

Microsoft Learn

Intune macOS overview: https://learn.microsoft.com/intune/intune-service/configuration/device-restrictions-macos
macOS enrollment (ABM / ADE): https://learn.microsoft.com/intune/intune-service/enrollment/device-enrollment-program-enroll-macos
Platform SSO for Entra ID on macOS: https://learn.microsoft.com/entra/identity-platform/apple-sso-plugin
Enterprise SSO plug-in for macOS: https://learn.microsoft.com/intune/intune-service/configuration/use-enterprise-sso-plug-in-ios-ipados-macos
FileVault: https://learn.microsoft.com/intune/intune-service/protect/encrypt-devices-filevault
Defender for Endpoint on macOS: https://learn.microsoft.com/defender-endpoint/microsoft-defender-endpoint-mac
System extensions: https://learn.microsoft.com/intune/intune-service/configuration/device-features-configure#system-extensions
Privacy Preferences Policy Control: https://learn.microsoft.com/intune/intune-service/configuration/preference-file-settings-macos
Managed Software Updates / DDM: https://learn.microsoft.com/intune/intune-service/protect/managed-software-updates-ios-macos
Compliance policies for macOS: https://learn.microsoft.com/intune/intune-service/protect/compliance-policy-create-mac-os