This is already here, Apple[0] can report to a MDM whether or not SIP is enabled, and then Microsoft's Intune[1] can use this to allow or deny access to corpora

This is already here, Apple[0] can report to a MDM whether or not SIP is enabled, and then Microsoft's Intune[1] can use this to allow or deny access to corporate resources (similar to some stuff that Google had in the BeyondCorp paper). 0: https://developer.apple.com/documentation/devicemanagement/securityinforesponse/securityinfo https://developer.apple.com/documentation/devicemanagement/s... 1: https://docs.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os https://docs.microsoft.com/en-us/mem/intune/protect/complian...