macOS-enterprise-privileges VS ProfileManifestsMirror

Also, if you need them to have admin rights, you can use something like https://github.com/SAP/macOS-enterprise-privileges

> For technically-inclined users, I'm still largely unconvinced of the value of SIP.

Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week.

Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator.

https://github.com/SAP/macOS-enterprise-privileges

This helps* prevent drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.

* Helps prevent, not prevents.

You can make custom profiles in Jamf using the same json imazing uses/same repo. This will give you access to all of the keys available in the software. I think the reason they say it’s not enterprise software is there is no central control like chrome or edge. https://github.com/Jamf-Custom-Profile-Schemas/ProfileManifestsMirror

If you are using Jamf, this custom settings json should help with the vast majority of what you are wanting to do.

It might be easier to use a custom settings json. Here is one from a source that Jamf featured on their blog last year.

You should look into using Custom Settings json files to handle this. Here's one from a Jamf recommended source that I use in my environment. It works really well, and it's much easier to understand at a glance than a plist is.

If you're using Jamf Pro, you may be better off using a Custom Settings JSON to apply these settings.

Are you wanting to completely disable it or just skip it during initial sign in? This custom settings json should help with the latter, and if you then restrict access to the "Screen Time" preference pane that should be a roundabout way to fully disable it.

Rather than putting the energy towards this script, you should start working on how to deploy the official one. All of the config settings are available now. If you are using Jamf, you can even use this custom settings json to handle like 90% of the work. The only major thing to know in advance is that the settings "KFMOptInWithWizard" and "KFMSilentOptIn" are looking for your tenant ID.

If you're using Jamf, this custom settings json should help with managing most of those kinds of settings.

One and done setup, though a Custom Settings json file can really streamline any modifications you have to do down the line.

I believe WebAppInstallForceList is the setting you are looking for. It looks like that is included in this custom settings json though I have not verified that it will work.