Check a T2 Mac’s External Boot Permission Before Rebuilding the Drive
A warning that security settings prevent external startup is a useful clue. On a Mac with the Apple T2 Security Chip, external boot permission is a separate control. Reformatting a prepared drive will not explain that policy warning.
Confirm the exact Mac model and that it has a T2 chip. Apple silicon uses a different startup-security procedure. Work only on a Mac you own or are authorised to administer; an organisation may intentionally prohibit external startup.
Inspect the control named in the warning
Apple documents that T2 Macs disallow startup from external or removable media by default. In macOS Recovery, open Utilities, Startup Security Utility. Authenticate with an authorised macOS administrator account when requested.
Record the current allowed-boot-media setting. If your approved task requires starting from the known external drive, permit external or removable media in that control. Keep a note of why the exception is needed and its original state.
Secure Boot is another setting in the same utility. Apple describes Full Security as the default. An external-media permission warning is not a reason by itself to change Secure Boot to No Security. Treat a later operating-system verification warning as its own finding.
Test the intended drive and close the exception
Retry the planned startup with the identified external drive. Check the drive name and operating system before proceeding with any installer or utility. A successful startup is not permission to erase the internal disk.
If the warning changes, record its exact wording instead of making several security changes together. Apple also states that T2 Macs cannot start from network volumes, regardless of this external-media setting; a network share is not an alternative covered by the permission.
When the temporary external-startup task is finished, restore the original restriction if that was the agreed plan. Confirm ordinary internal startup still works. The useful outcome is a deliberate, documented permission change for one task with the computer returned to its intended security configuration.
References: Apple: T2 Startup Security Utility.