This documentation explains the legacy method for deploying and configuring Microsoft Defender for Endpoint on macOS devices. The native experience is now available in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and deploy the application and send it down to macOS devices.
The blog post MEM simplifies deployment of Microsoft Defender for Endpoint for macOS explains the new features. To configure the app, go to Settings for Microsoft Defender for Endpoint for Mac in Microsoft InTune. To deploy the app, go to Add Microsoft Defender for Endpoint to macOS devices using Microsoft Intune.
Enroll your macOS device with the Intune Company Portal app to gain secure access to your work or school email, files, and apps. Organizations typically require you to enroll your device before you can access proprietary data. After your device is enrolled, it becomes managed. Your organization can assign policies and apps to the device through. Download Microsoft Intune - Ensure all your company-owned and bring-your-own (BYO) devices are managed and always up to date with the most flexible control over any Windows, Apple, and Android. Intune and Mac Device Management. Intune natively support Mac Device management. But, the Intune Mac device support is very generic. Jamf is the one third party solution which Microsoft advised all the organizations to look into if they are looking for more deep level management of Mac Devices with Intune. More details available https://nohuman. Hello everyone, today we have a fantastic article from Intune Sr. Support Engineer and resident Jamf expert Shonda Hodge.Shonda walks through the entire process of configuring integration of Microsoft Intune and Jamf Pro, creating and deploying policies and profiles, as well as enrolling and registering your Mac computers.
This topic describes how to deploy Microsoft Defender for Endpoint for Mac through Intune. A successful deployment requires the completion of all of the following steps:
Prerequisites and system requirements
Before you get started, see the main Microsoft Defender for Endpoint for Mac page for a description of prerequisites and system requirements for the current software version.
The following table summarizes the steps you would need to take to deploy and manage Microsoft Defender for Endpoint for Macs, via Intune. More detailed steps are available below.
|Step||Sample file names||BundleIdentifier|
|Download installation and onboarding packages||WindowsDefenderATPOnboarding__MDATP_wdav.atp.xml||com.microsoft.wdav.atp|
|Approve System Extension for Microsoft Defender for Endpoint||MDATP_SysExt.xml||N/A|
|Approve Kernel Extension for Microsoft Defender for Endpoint||MDATP_KExt.xml||N/A|
|Grant full disk access to Microsoft Defender for Endpoint||MDATP_tcc_Catalina_or_newer.xml||com.microsoft.wdav.tcc|
|Network Extension policy||MDATP_NetExt.xml||N/A|
|Configure Microsoft AutoUpdate (MAU)||MDATP_Microsoft_AutoUpdate.xml||com.microsoft.autoupdate2|
|Microsoft Defender for Endpoint configuration settings|
Note: If you're planning to run a third-party AV for macOS, set
|Configure Microsoft Defender for Endpoint and MS AutoUpdate (MAU) notifications||MDATP_MDAV_Tray_and_AutoUpdate2.mobileconfig||com.microsoft.autoupdate2 or com.microsoft.wdav.tray|
Download installation and onboarding packages
Download the installation and onboarding packages from Microsoft Defender Security Center:
In Microsoft Defender Security Center, go to Settings > Device Management > Onboarding.
Set the operating system to macOS and the deployment method to Mobile Device Management / Microsoft Intune.
Select Download installation package. Save it as wdav.pkg to a local directory.
Select Download onboarding package. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
Download IntuneAppUtil from https://docs.microsoft.com/intune/lob-apps-macos.
From a command prompt, verify that you have the three files.
Extract the contents of the .zip files:
Make IntuneAppUtil an executable:
Create the wdav.pkg.intunemac package from wdav.pkg:
Client device setup
You don't need any special provisioning for a Mac device beyond a standard Company Portal installation.
Confirm device management.
Select Open System Preferences, locate Management Profile on the list, and select Approve... Your Management Profile would be displayed as Verified:
Select Continue and complete the enrollment.
You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.
In Intune, open Manage > Devices > All devices. Here you can see your device among those listed:
Approve System Extensions
To approve the system extensions:
In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.
Choose a name for the profile. Change Platform=macOS to Profile type=Extensions. Select Create.
In the Basics tab, give a name to this new profile.
In the Configuration settings tab, add the following entries in the Allowed system extensions section:
Bundle identifier Team identifier com.microsoft.wdav.epsext UBF8T346G9 com.microsoft.wdav.netext UBF8T346G9
In the Assignments tab, assign this profile to All Users & All devices.
Review and create this configuration profile.
Create System Configuration profiles
In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.
Choose a name for the profile. Change Platform=macOS to Profile type=Custom. Select Configure.
Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.
Apple laptop update. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.
Repeat steps 1 through 5 for more profiles.
Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file.
Download fulldisk.mobileconfig from our GitHub repository and save it as tcc.xml. Create another profile, give it any name and upload this file to it.
macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint is not able to fully protect your device.
This configuration profile grants Full Disk Access to Microsoft Defender for Endpoint. If you previously configured Microsoft Defender for Endpoint through Intune, we recommend you update the deployment with this configuration profile.
As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality. Download netfilter.mobileconfig from our GitHub repository, save it as netext.xml and deploy it using the same steps as in the previous sections.
To allow Microsoft Defender for Endpoint for Mac and Microsoft Auto Update to display notifications in UI on macOS 10.15 (Catalina), download
notif.mobileconfigfrom our GitHub repository and import it as a custom payload.
Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.
Once the Intune changes are propagated to the enrolled devices, you can see them listed under Monitor > Device status:
In Intune, open the Manage > Client apps blade. Select Apps > Add.
Select App type=Other/Line-of-business app.
Select file=wdav.pkg.intunemac. Select OK to upload.
Select Configure and add the required information.
Use macOS High Sierra 10.14 as the minimum OS.
Set Ignore app version to Yes. Other settings can be any arbitrary value.
Setting Ignore app version to No impacts the ability of the application to receive updates through Microsoft AutoUpdate. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated.
If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Microsoft Defender for Endpoint. This could result in a non-functioning application. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated. If you deployed Microsoft Defender for Endpoint with Ignore app version set to No, please change it to Yes. If Microsoft Defender for Endpoint still cannot be installed on a client device, then uninstall Microsoft Defender for Endpoint and push the updated policy.
Select OK and Add.
It may take a few moments to upload the package. After it's done, select the package from the list and go to Assignments and Add group.
Change Assignment type to Required.
Select Included Groups. Select Make this app required for all devices=Yes. Select Select group to include and add a group that contains the users you want to target. Select OK and Save.
After some time the application will be published to all enrolled devices. You can see it listed in Monitor > Device, under Device install status:
Intune Download Mac Download
Verify client device state
After the configuration profiles are deployed to your devices, open System Preferences > Profiles on your Mac device.
Verify that the following configuration profiles are present and installed. The Management Profile should be the Intune system profile. Wdav-config and wdav-kext are system configuration profiles that were added in Intune:
You should also see the Microsoft Defender icon in the top-right corner:
Intune Download Mac Software
Issue: No license found
Intune Download Mac
Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml
Logging installation issues
For more information on how to find the automatically generated log that is created by the installer when an error occurs, see Logging installation issues.
See Uninstalling for details on how to remove Microsoft Defender for Endpoint for Mac from client devices.