Mobile Phone Device Restriction on MacOS

michaelsysec242 — Tue, 11 Jul 2023 12:20:15 GMT

Hello all,

I am currently looking into creating a Device Restriction Policy in which I block a physical connection of a Mobile Phone to MacOS endpoint. Once blocked I would expect to receive an alert on the Device Policy Violation page. Is this possible?

In regards to Windows endpoints, this works seamlessly as expected and the device is recognized as Windows Portable Device.

On MacOS what would be expected?

Re: Mobile Phone Device Restriction on MacOS

anlynch — Tue, 11 Jul 2023 15:44:36 GMT

Hi @michaelsysec242,

Thanks for reaching out to LIVEcommunity!

I haven't been able to test this method just yet and I highly recommend that you do. It's unlikely that you will have the same functionality with a Mac device. In order to get this done with Windows you'd have to use the Microsoft official ClassGuid identifier. I don't believe Apple has provided the same type of guidance to allow for more granular device control.

I recommend testing now and trying to block Disk Drives as a phone can appear as a drive. However, I don't think this will work for Mac devices with iPhones connected. Again, I highly recommend testing.

If this method doesn't work I recommend putting in a ticket with Support. They may be able to help you come up with a different method to achieve the same goal.

I hope you find this information helpful.

topic Re: Mobile Phone Device Restriction on MacOS in Cortex XDR Discussions

Mobile Phone Device Restriction on MacOS

Re: Mobile Phone Device Restriction on MacOS