Skip to main content

​
Platform compatibility

Intel Macs don’t support recovery lock. Primo skips them, and they show no recoveryOS protection status in compliance.

​
Set up the control

1

Go to MDM > Controls > Add new control

Select recoveryOS protection.
2

Select targeting

No additional configuration is required. Choose which devices to apply the control to: all macOS devices, specific device groups, or a custom target.

​
How it works

Primo sends the MDM SetRecoveryLock command to each targeted Apple Silicon Mac, with a 12-character password it generates. The Mac then asks for this password before anyone can use recoveryOS. Each device gets its own password. To see it, open the device panel and click Display recoveryOS password. MDM compliance reports the protection status of each targeted Apple Silicon Mac.

​
Modify or remove the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement but does not remove existing configurations from devices.