From bfb6f3b010ec03ba3fa5631fcc3c91d23a27e623 Mon Sep 17 00:00:00 2001
From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Date: Wed, 6 May 2026 13:04:07 -0500
Subject: [PATCH] Enable Apple hardware attestation for workstations (#44860)

Set apple_require_hardware_attestation: true in
it-and-security/fleets/workstations.yml under controls to require
hardware-backed attestation for Apple devices. This strengthens security
for managed macOS workstations by enforcing hardware attestation checks.
---
 it-and-security/default.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/it-and-security/default.yml b/it-and-security/default.yml
index c76d9ebca2..0729cf779d 100644
--- a/it-and-security/default.yml
+++ b/it-and-security/default.yml
@@ -87,6 +87,7 @@ reports:
   - path: ./lib/macos/reports/detect-apns-certificate.yml
   - path: ./lib/macos/reports/collect-xprotect-reports.yml
 controls:
+  apple_require_hardware_attestation: true
   enable_disk_encryption: true
   macos_migration:
     enable: true