---
id: os_facetime_app_disable
title: Disable FaceTime.app
discussion: |
  The macOS built-in FaceTime.app _MUST_ be disabled.

  The FaceTime.app establishes a connection to Apple's iCloud service, even when security controls have been put in place to disable iCloud access.

  [IMPORTANT]
  ====
  Apple has deprecated the use of link:https://github.com/apple/device-management/blob/eb51fb0cb9626cac4717858556912c257a734ce0/mdm/profiles/com.apple.applicationaccess.new.yaml#L67-L70[application restriction controls], using these controls may not work as expected. Third party software may be required to fulfill the compliance requirements.
  ====
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95189-7
      macos_15:
        - CCE-94189-8
      macos_14:
        - CCE-92788-9
    800-53r5:
      - AC-20
      - CM-7
      - CM-7(1)
    800-171r3:
      - 03.01.20
      - 03.04.06
  disa:
    cci:
      - CCI-000381
    srg:
      - SRG-OS-000095-GPOS-00049
    disa_stig:
      macos_26:
        - APPL-26-002010
      macos_15:
        - APPL-15-002010
      macos_14:
        - APPL-14-002010
    cmmc:
      - AC.L1-3.1.20
      - CM.L2-3.4.6
      - CM.L2-3.4.7
  hhs:
    hicp:
      - 2.L.A
  cis:
    controls_v8:
      - 4.1
      - 4.8
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          function run() {
            let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
            .objectForKey('familyControlsEnabled'))
            let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
            .objectForKey('pathBlackList').js
            for ( let app in pathlist ) {
                if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){
                    return("true")
                }
            }
            return("false")
            }
          EOS
        result:
          string: 'true'
    introduced: '10.7'
tags:
  - cnssi-1253_low
  - cnssi-1253_high
  - cnssi-1253_moderate
  - hicp_lp
  - test
mobileconfig_info:
  - PayloadType: com.apple.applicationaccess.new
    PayloadContent:
      - familyControlsEnabled: true
      - pathBlackList:
          - /Applications/FaceTime.app
ddm_info:
  declarationtype: com.apple.configuration.app.settings
  ddm_key: Allowed
  ddm_value: { 'DeniedBinaries': [ { "SigningID": "com.apple.FaceTime" } ] }