This guide demonstrates different methods to enable or disable stealth mode on macOS using Intune that include endpoint security, configuration profiles, and settings catalog. I will cover all the mentioned ways, but the method you choose is entirely up to you.
Stealth Mode is NOT enabled by default on macOS, and most importantly, it is a sub-feature of the built-in firewall and cannot function if the firewall is disabled. If your organization uses Intune as your MDM solution, you can efficiently manage this configuration to prevent users from manually adjusting the settings on their devices.
On Mac devices, the firewall must be enabled before enabling stealth mode via Intune. In my previous guide, I demonstrated multiple methods for configuring macOS firewall settings with Intune. Make sure the Mac devices are enrolled in Intune before configuring the stealth mode.
Note: If you have already configured most of your Firewall settings on Mac via Intune, you can turn on or off the stealth mode by simply editing the configuration settings. This should be much easier than configuring a separate policy for stealth mode.
Enabling vs. Disabling Stealth Mode
Enabling stealth mode prevents the Mac from responding to probing requests. The computer still answers incoming requests for authorized apps. Your Mac basically doesn’t respond to either “ping” requests or connection attempts from a closed TCP or UDP network.
Disabling this stealth mode can make the computer vulnerable to attack, even in managed corporate domain networks and behind edge firewalls. Therefore, it is strongly recommended that you keep stealth mode active and disable it only if it is required.
1. Enable or Disable macOS Stealth Mode via Endpoint Security Policy
In this method, I’ll create a firewall policy for endpoint security, and from here you can either enable or disable macOS stealth mode. Sign in to the Microsoft Intune admin center. Go to Endpoint Security > Firewall and select Create Policy. Choose macOS as the platform and profile as macOS firewall and click Create.
Specify the policy name and description. On the Configuration Settings page, make sure the firewall is enabled. Next, set the Enable Stealth Mode to Yes if you want to turn it on, and if you would like to disable it, set the Enable Stealth Mode to No. Click Next.
Assign this policy to your Mac device groups and complete the remaining steps. That is it; when the Mac devices sync with Intune, the stealth mode is enabled.
2. Use Settings Catalog Policy to Enable or Disable Stealth Mode on macOS
In this method, I’ll use the settings catalog policy to enable stealth mode on macOS. Again, this method requires enabling the firewall before you manage the stealth mode.
In the Intune admin center, go to Devices > macOS devices and select Configuration. Under Policies, select Create > New Policy. Select Settings Catalog as Profile type and click Create.
In the Configuration Settings section, under Settings Catalog, click Add Settings. In the Settings picker window, type “Stealth Mode” in the search box and click Search. From the search results, click on the category Networking > Firewall, select the setting “Enable Stealth Mode,” and close the Settings Picker.
Make sure you configure the settings.
- Enable Firewall: Yes
- Enable Stealth Mode: Select Yes if you want to enable it and No to disable it.
Click Next and assign this policy to your Mac device groups. When the Mac devices sync the policies with Intune again, the settings are applied, and stealth mode is enabled.
3. Turn on or off stealth mode on macOS using Endpoint Protection Settings
The endpoint protection settings control security on macOS devices, such as FileVault 2 encryption, Gatekeeper, and the firewall. You can enable both firewall and stealth mode by creating a new device configuration profile and assigning it to macOS devices.
In the Intune admin center, go to Devices > macOS > Configuration. On the Policies tab, select Create. On the Create a profile page, set the following options, and then select Create:
- Platform: macOS
- Profile type: Templates
- Template name: Endpoint protection
On the Configuration Settings page, configure the following settings:
- Enable Firewall: Set this to Yes
- Enable Stealth Mode: Set this to Yes to enable stealth mode. Set this to No to disable stealth mode.
Continue to the next step: assign the configuration profile to your macOS devices. On the Review + Create page, when you’re done, choose Create. When this configuration profile is applied to targeted Mac devices, both the firewall and stealth mode are enabled.
Verify Stealth Mode Configuration on Mac devices
After enabling stealth mode on macOS devices with Intune, we will now verify if our Mac devices have successfully received those settings. The only way to accomplish this is to log into one of the Mac devices and check the firewall configuration.
Here is how you can check if stealth mode is enabled by the Intune policy on your Mac device:
- In the top-left corner, click on the Apple icon and select System Settings.
- Go to Network and select Firewall > Options.
- Here you can find out whether the stealth mode is enabled or disabled.
In the below screenshot, you can see the Enable Stealth Mode setting is enabled using the Intune policy. For Mac users, the stealth mode setting is greyed out, suggesting that it is now managed by Intune.
