⚙️🍏💻CP - Firewall - Firewall and Gatekeeper
Two controls Apple ships and half of them off by default. One decides who can reach the Mac, the other decides what the Mac will run.
What this policy is about 🧱
Two separate controls that end up in one profile because they answer the two halves of the same question.
The firewall decides what can reach the Mac from the network. macOS ships with it switched off, which surprises people who assume Apple defaults are the secure ones. On a laptop that spends its life on café, hotel and client wifi, off is the wrong answer.
Gatekeeper decides what the Mac will run. It checks that an application is signed by a developer Apple knows and has been notarised, and it blocks the ones that are not. It is also the control users route around, because macOS puts a right-click Open anyway within reach of anyone who wants the thing badly enough.
Gatekeeper checks provenance: is this app signed by somebody Apple recognises. It does not check behaviour, and a signed application can still be malicious. This raises the floor; Defender for Endpoint does the detection.
Why this matters 🕵️
The firewall matters most in the place Macs actually get used. A laptop on the office network sits behind something; the same laptop on hotel wifi is on a flat network with strangers, and stealth mode means it does not even answer a ping, so it does not appear in a scan of that network at all. That is a meaningful reduction in how interesting the machine looks to somebody sweeping the subnet.
Gatekeeper matters because the most common macOS compromise is not an exploit, it is an install. Somebody downloads a cracked app, a fake Zoom update, a "codec" for a video that will not play, and macOS says it cannot verify the developer. Left to default, the user right-clicks and opens it anyway. Enforcing assessment means that path closes for everything outside the signed-and-notarised world.
Logging is the third piece and the one people skip. A firewall that blocks silently tells you nothing after the fact. Turning logging on costs nothing and means there is something to look at when a question comes up later.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → macOS → Settings catalog → Firewall and System Policy Control.
Firewall
| Setting | Value |
|---|---|
| Enable Firewall | True |
| Enable Stealth Mode | True |
| Block All Incoming | False |
| Enable Logging | True |
Gatekeeper
| Setting | Value |
|---|---|
| Enable Assessment | True |
| Allow Identified Developers | True |
| Enable XProtect Malware Upload | Disabled |
| Assignment, include | All devices, macOS filter |
Block All Incoming stays False, and that is not a compromise. Set to True it blocks essentially everything inbound including services the user relies on: screen sharing for remote support, AirPrint discovery, and a long tail of line-of-business applications that listen locally. Firewall on with stealth mode gives most of the benefit; Block All Incoming turns a security control into a support queue.
Allow Identified Developers rather than App Store only. Restricting to the App Store alone sounds stronger and breaks a normal working Mac within the hour, because a large share of legitimate business software ships outside it. Signed and notarised by a known developer is the line that holds.
XProtect Malware Upload off is a privacy choice, not a security one. It controls whether samples go to Apple. Leaving it disabled avoids sending customer data to a third party without anyone having agreed to it. Defender handles the sample-sharing conversation on its own terms.
Caveats ⚠️
Stealth mode makes the Mac harder to find on purpose. It stops responding to ping and to probes on closed ports, which is the point, and it also means the machine will not show up in a network discovery scan. Tell whoever runs the network inventory before they open a ticket about missing devices.
Gatekeeper enforcement will surface unsigned line-of-business software. Older internal tools, a niche vendor utility, something built by a contractor five years ago. Find them before the rollout rather than during it, and take the discovery as a prompt to ask the vendor about notarisation rather than as a reason to weaken the policy.
An admin can still override locally. macOS users are frequently local administrators, and the MDM profile raises the floor rather than sealing the box. If a customer needs a genuine boundary, that is a conversation about removing local admin rights, not about this profile.
The firewall is application-level, not port-level. macOS controls which applications may accept incoming connections; it is not a stateful port filter you can write rules against. Anyone arriving from a Windows or network-appliance background will look for controls that do not exist here.
Clean-revert. Remove the profile and both payloads go with it: the firewall reverts to its previous state and Gatekeeper to the local setting. No inverse policy needed, which is the macOS pattern throughout.
👥 Assignment scope
Baseline for every managed Mac, assigned to all devices with a macOS platform filter.
No exception group. A Mac that needs the firewall off is a Mac with a problem to solve elsewhere, and an unsigned application that cannot be notarised is a vendor conversation rather than a policy exemption.
Worth verifying at tenant takeover: whether the firewall was ever on. It is off by default, so on an unmanaged estate the honest assumption is that every Mac has been running without one since it was unboxed.
🔗 Related
- ⚙️🍏💻CP - Device Security - Accounts and Login: the login window equivalent of closing default-open doors.
- ⚙️🍏💻CP - Disk Encryption - FileVault: protects the data if the machine is taken rather than reached.
- 🧱🪟💻ES - Attack Surface Reduction Rules: the Windows control with the closest intent, blocking techniques rather than files.
Turn on the firewall Apple left off, and take away the right-click that makes Gatekeeper optional. 🧱