Configure Microsoft Defender for Endpoint on macOS with Jamf Pro

You can use Jamf Pro, a third-party mobile device management (MDM) platform for Apple devices, to deploy and manage Microsoft Defender for Endpoint on organization-owned macOS devices.

Jamf Pro is a separate product that isn't part of Defender for Endpoint and isn't included with Defender for Endpoint subscriptions. To use these procedures, your organization needs a separate Jamf Pro subscription. For product and subscription information, see Jamf Pro. If your organization doesn't use Jamf Pro, you can deploy Defender for Endpoint with Microsoft Intune or use another MDM solution.

The procedures configure onboarding, antivirus and endpoint detection and response (EDR) settings, notifications, Microsoft AutoUpdate, Full Disk Access, system extensions, network extensions, background services, Bluetooth permissions, and package deployment.

Prerequisites

Before you configure Defender for Endpoint policies in Jamf Pro, make sure you meet the following requirements:

• Review the Defender for Endpoint on macOS prerequisites, including licensing, supported macOS versions, and network connectivity.
• Verify that your organization has a Jamf Pro subscription and that you have permission to create configuration profiles, policies, packages, scripts, and smart computer groups.
• Set up the macOS device groups in Jamf Pro.

Step 1: Get the Defender for Endpoint packages

To download the onboarding and installation packages, follow these steps:

1. On the Onboarding page in the Microsoft Defender portal at https://security.microsoft.com/securitysettings/endpoints/onboarding, configure the following settings:

   • Step 1: Select an operating system to start deployment: Select macOS.
   • Connectivity type: Select Streamlined. Before continuing, verify that the devices and network meet the streamlined connectivity prerequisites.
   • Deployment method: Select Mobile Device Management / Microsoft Intune.

2. Select Download onboarding package, and save GatewayWindowsDefenderATPOnboardingPackage.zip to a location that's easy to find.

3. Extract the contents of GatewayWindowsDefenderATPOnboardingPackage.zip. In the extracted package, open the jamf folder, which contains WindowsDefenderATPOnboarding.plist.

4. Select Download installation package, and save wdav.pkg for use in Step 12: Deploy Microsoft Defender for Endpoint on macOS.

Step 2: Create a configuration profile in Jamf Pro using the onboarding package

Create and assign a Jamf Pro configuration profile that contains the Defender for Endpoint onboarding information. For current Jamf Pro instructions, see Deploying Custom Computer Configuration Profiles Using the Application & Custom Settings Payload.

Use these Defender-specific values:

• Configuration file: In the extracted onboarding package, use jamf\WindowsDefenderATPOnboarding.plist.
• Name: Enter a descriptive name, such as MDE onboarding for macOS.
• Description: Enter a description, such as MDE EDR onboarding for macOS.
• Category: Select an organization-defined category, or leave this value set to None.
• Distribution Method: Select Install Automatically.
• Level: Select Computer Level.
• Payload: Select Application & Custom Settings, and upload the property list.
• Preference Domain: Enter com.microsoft.wdav.atp.
• Scope: Select the computer group that contains the target macOS devices.

Step 3: Configure Microsoft Defender for Endpoint settings

Configure antivirus and EDR settings in either the Microsoft Defender portal or Jamf Pro.

Configure policies in the Microsoft Defender portal

Before you begin, complete the setup described in Configure Microsoft Defender for Endpoint in Intune.

Use the Microsoft Defender portal to create and assign macOS security policies to your devices.

For detailed instructions, see Create an endpoint security policy (link opens in a new tab).

When you create a policy on the macOS policies tab of the Endpoint security policies page in the Defender portal at https://security.microsoft.com/policy-inventory?osPlatform=Mac, use these specific settings:

• Select platform: Select macOS.
• Select template: Select one of the following values, depending on the settings you want to configure:
  • Microsoft Defender Antivirus
  • Endpoint detection and response

In the policy creation wizard, use these settings:

• Configuration settings tab: Configure the settings you want to manage with this profile.
• Assignments tab: Assignment group limitations apply to devices managed through Defender for Endpoint security settings management. For details, see the Assignments step.

For more information about managing security settings, see the following articles:

• Manage Microsoft Defender for Endpoint on devices with Microsoft Intune
• Manage security settings for Windows, macOS, and Linux natively in Defender for Endpoint

Configure policies in Jamf Pro

Use the Jamf Pro graphical user interface (GUI) to configure individual Defender for Endpoint settings. Alternatively, use the legacy method to create a property list (.plist) file in a text editor and upload the file to Jamf Pro.

• Use the exact value com.microsoft.wdav as the Preference Domain. Defender for Endpoint uses this domain and com.microsoft.wdav.ext to load managed settings.
• Use com.microsoft.wdav.ext only when you use the GUI method and need to configure a setting that isn't yet available in the schema.

Configure Defender settings using the Jamf Pro GUI

Use this method to import Defender's JSON schema into Jamf Pro and configure settings through the GUI.

1. Download the Defender for Endpoint schema.json file from the Microsoft Defender for Endpoint GitHub repository. Jamf Pro uses the schema to populate the available configuration settings in the GUI:

   curl -o ~/Documents/schema.json https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/schema/schema.json
   

2. Follow the Jamf instructions to deploy a custom computer configuration profile. Use these Defender-specific values:

   • Name: Enter a descriptive name, such as MDATP MDAV configuration settings.
   • Category: Select an organization-defined category, or leave this value set to None.
   • Level: Select Computer Level.
   • Distribution Method: Select Install Automatically.
   • Payload: Select Application & Custom Settings > External Applications.
   • Source: Select Custom Schema, and upload schema.json.
   • Preference Domain: Enter com.microsoft.wdav.
   • Preference Domain Properties: Select the settings you want Jamf Pro to manage. Settings you don't select remain available for users to configure locally.
   • Scope: Select the computer group that contains the target macOS devices.

Microsoft Defender for Endpoint adds new settings over time. New Defender for Endpoint settings are added to the schema, and a new version is published to GitHub. To get updates, download an updated schema and edit your existing configuration profile. On the Application & Custom Settings tab, select Edit schema.

Configure Defender settings using the legacy method

Use this legacy method to manually create a configuration plist in a text editor and upload it to Jamf Pro.

1. Include the following Defender for Endpoint settings in the property list:

   • enableRealTimeProtection
   • passiveMode (This setting is off by default. If you plan to run non-Microsoft antivirus software on the Mac, set it to true.)
   • exclusions
   • excludedPath
   • excludedFileExtension
   • excludedFileName
   • exclusionsMergePolicy
   • allowedThreats (The sample includes EICAR. Remove the EICAR entry for a proof of concept, especially if you plan to use EICAR to verify protection.)
   • disallowedThreatActions
   • potentially_unwanted_application
   • archive_bomb
   • cloudService
   • automaticSampleSubmission
   • tags
   • hideStatusMenuIcon

   For more information, see Property list for Jamf full configuration profile.

     <?xml version="1.0" encoding="UTF-8"?>
     <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
     <plist version="1.0">
     <dict>
         <key>antivirusEngine</key>
         <dict>
             <key>enableRealTimeProtection</key>
             <true/>
             <key>passiveMode</key>
             <false/>
             <key>exclusions</key>
             <array>
                 <dict>
                     <key>$type</key>
                     <string>excludedPath</string>
                     <key>isDirectory</key>
                     <false/>
                     <key>path</key>
                     <string>/var/log/system.log</string>
                 </dict>
                 <dict>
                     <key>$type</key>
                     <string>excludedPath</string>
                     <key>isDirectory</key>
                     <true/>
                     <key>path</key>
                     <string>/home</string>
                 </dict>
                 <dict>
                     <key>$type</key>
                     <string>excludedFileExtension</string>
                     <key>extension</key>
                     <string>pdf</string>
                 </dict>
                 <dict>
                     <key>$type</key>
                     <string>excludedFileName</string>
                     <key>name</key>
                     <string>cat</string>
                 </dict>
             </array>
             <key>exclusionsMergePolicy</key>
             <string>merge</string>
             <key>allowedThreats</key>
             <array>
                 <string>EICAR-Test-File (not a virus)</string>
             </array>
             <key>disallowedThreatActions</key>
             <array>
                 <string>allow</string>
                 <string>restore</string>
             </array>
             <key>threatTypeSettings</key>
             <array>
                 <dict>
                     <key>key</key>
                     <string>potentially_unwanted_application</string>
                     <key>value</key>
                     <string>block</string>
                 </dict>
                 <dict>
                     <key>key</key>
                     <string>archive_bomb</string>
                     <key>value</key>
                     <string>audit</string>
                 </dict>
             </array>
             <key>threatTypeSettingsMergePolicy</key>
             <string>merge</string>
         </dict>
         <key>cloudService</key>
         <dict>
             <key>enabled</key>
             <true/>
             <key>diagnosticLevel</key>
             <string>optional</string>
             <key>automaticSampleSubmission</key>
             <true/>
         </dict>
         <key>edr</key>
         <dict>
             <key>tags</key>
             <array>
                 <dict>
                     <key>key</key>
                     <string>GROUP</string>
                     <key>value</key>
                     <string>ExampleTag</string>
                 </dict>
             </array>
         </dict>
         <key>userInterface</key>
         <dict>
             <key>hideStatusMenuIcon</key>
             <false/>
         </dict>
     </dict>
     </plist>
   

2. Save the file as MDATP_MDAV_configuration_settings.plist.

3. Follow the Jamf instructions to deploy a custom computer configuration profile. Use these Defender-specific values:

   • Name: Enter a descriptive name, such as MDATP MDAV configuration settings.
   • Category: Select an organization-defined category, or leave this value set to None.
   • Distribution Method: Select Install Automatically.
   • Level: Select Computer Level.
   • Payload: Select Application & Custom Settings, and upload MDATP_MDAV_configuration_settings.plist.
   • Preference Domain: Enter com.microsoft.wdav.
   • Scope: Select the computer group that contains the target macOS devices.

Step 4: Configure notification settings

Create a Jamf Pro configuration profile that allows notifications from Defender for Endpoint and Microsoft AutoUpdate.

1. Download notif.mobileconfig.

2. Follow the Jamf instructions to upload a configuration profile.

3. Scope the profile to the computer group that contains the target macOS devices.

The profile enables banners, badges, sounds, and Notification Center notifications. It hides notifications on the lock screen and disables critical alerts for these bundle IDs:

• com.microsoft.wdav.tray
• com.microsoft.autoupdate2

Step 5: Configure Microsoft AutoUpdate (MAU)

Microsoft AutoUpdate (MAU) keeps Microsoft applications up to date on macOS, including Microsoft Defender for Endpoint. Configure the following settings to manage how updates are delivered to your devices.

1. Use the following Microsoft Defender for Endpoint configuration settings:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
    <key>ChannelName</key>
    <string>Current</string>
    <key>HowToCheck</key>
    <string>AutomaticDownload</string>
    <key>EnableCheckForUpdatesButton</key>
    <true/>
    <key>DisableInsiderCheckbox</key>
    <false/>
    <key>SendAllTelemetryEnabled</key>
    <true/>
   </dict>
   </plist>
   

2. Save the property list as MDATP_MDAV_MAU_settings.plist.

3. Follow the Jamf instructions to deploy a custom computer configuration profile. Use these Defender-specific values:

   • Name: Enter a descriptive name, such as MDATP MDAV MAU settings.
   • Category: Select an organization-defined category, or leave this value set to None.
   • Distribution Method: Select Install Automatically.
   • Level: Select Computer Level.
   • Payload: Select Application & Custom Settings, and upload MDATP_MDAV_MAU_settings.plist.
   • Preference Domain: Enter com.microsoft.autoupdate2.
   • Scope: Select the computer group that contains the target macOS devices.

For descriptions of the available settings and supported values, see Microsoft AutoUpdate preferences.

Step 6: Grant Full Disk Access to Microsoft Defender for Endpoint

Create a Jamf Pro configuration profile that grants Full Disk Access to Defender for Endpoint.

1. Download fulldisk.mobileconfig.

2. Follow the Jamf instructions to upload a configuration profile.

3. Scope the profile to the computer group that contains the target macOS devices.

The profile grants SystemPolicyAllFiles access to these bundle IDs:

• com.microsoft.wdav
• com.microsoft.wdav.epsext
• com.microsoft.dlp.daemon

Step 7: Approve system extensions for Microsoft Defender for Endpoint

Create a Jamf Pro configuration profile that approves the Defender for Endpoint system extensions.

1. Download sysext.mobileconfig.

2. Follow the Jamf instructions to upload a configuration profile.

3. Scope the profile to the computer group that contains the target macOS devices.

The profile uses Microsoft Team ID UBF8T346G9 to approve these system extensions:

• com.microsoft.wdav.epsext
• com.microsoft.wdav.netext

Step 8: Configure the network extension

The Defender for Endpoint network extension inspects network traffic to support Network Protection, web content filtering, and custom network indicators.

1. Download netfilter.mobileconfig.

2. Follow the Jamf instructions to upload a configuration profile.

3. Scope the profile to the computer group that contains the target macOS devices.

The profile configures these Defender-specific values:

• Filter name: Microsoft Defender Content Filter
• Identifier: com.microsoft.wdav
• Filter order: Inspector
• Socket filter: com.microsoft.wdav.netext
• Microsoft Team ID: UBF8T346G9

Step 9: Configure background services

Download background_services.mobileconfig from the Microsoft Defender for Endpoint macOS mobileconfig profiles repository.

Follow the Jamf instructions to upload a configuration profile, and scope the profile to the computer group that contains the target macOS devices.

Step 10: Grant Bluetooth permissions

Download bluetooth.mobileconfig from the Microsoft Defender for Endpoint macOS mobileconfig profiles repository.

You need at least one signing certificate in your macOS keychain. A self-signed certificate is sufficient. List the available code-signing identities to find the certificate name:

> /usr/bin/security find-identity -p codesigning -v

  1) 70E46A47F552EA8D58521DAC1E7F5144BA3012BC "DevCert"
  2) 67FC43F3FAB77662BB7688C114585BAA37CA8175 "Mac Developer: John Doe (1234XX234)"
  3) E142DFD879E5EB60FA249FB5B24CEAE3B370394A "Apple Development: Jane Doe 7XX7778888)"
  4) 21DE31645BBF1D9F5C46E82E87A6968111E41C75 "Apple Development: me@example.com (8745XX123)"
     4 valid identities found

Choose one of the listed signing identities, and provide the quoted certificate name as the -N parameter. The command signs the Bluetooth configuration profile so Jamf Pro doesn't modify its payload:

/usr/bin/security cms -S -N "DevCert" -i bluetooth.mobileconfig -o bluetooth-signed.mobileconfig

Follow the Jamf instructions to upload a configuration profile. Upload bluetooth-signed.mobileconfig, and scope the profile to the computer group that contains the target macOS devices.

Step 11: Schedule scans with Microsoft Defender for Endpoint on macOS

To configure recurring quick or full scans, see Schedule scans with Microsoft Defender for Endpoint on macOS.

Step 12: Deploy Microsoft Defender for Endpoint on macOS

Upload the Microsoft Defender for Endpoint package to Jamf Pro and create a deployment policy to distribute it to your macOS devices.

For current Jamf Pro instructions, see Package Deployment. Use these Defender-specific values:

• Package: Upload the wdav.pkg file that you downloaded in Step 1.
• Display Name: Enter a descriptive name, such as Microsoft Defender for Endpoint.
• Manifest File: Leave this value blank. Defender for Endpoint doesn't require a manifest file.
• Options and Limitations: Defender for Endpoint doesn't require specific values. Configure these settings based on your organization's package deployment requirements.
• Policy trigger: Select Recurring Check-in.
• Packages payload: Add the Defender for Endpoint package, and configure it to install.
• Scope: Select the smart computer group described in Create a smart computer group for devices with Defender profiles.
• Self Service: Optionally make the policy available in Self Service for on-demand installation.

Create a smart computer group for devices with Defender profiles

Install the required configuration profiles on enrolled devices before you install the Defender for Endpoint package. Jamf Pro typically pushes configuration profiles immediately, but policies run when the device checks in. Profile deployment might be delayed, for example, when a device is locked.

To enforce the correct deployment order, create a smart computer group for devices that received a Defender for Endpoint configuration profile. Scope the package policy to that group so Jamf Pro installs Defender for Endpoint only after the profile is present.

For current Jamf Pro instructions, see Creating a Smart Group. Use these Defender-specific settings:

• Add a Profile Name criterion for each required Defender for Endpoint configuration profile.
• Combine the profile criteria with AND so the group includes only devices that received all required profiles.
• Scope the Defender for Endpoint package policy to this smart computer group.

Verify configuration profile scope for all Defender profiles

Jamf Pro requires a scope for each configuration profile. Make sure every device that receives the Defender for Endpoint package also receives all applicable profiles:

• Onboarding (Step 2)
• Defender for Endpoint settings (Step 3)
• Notifications (Step 4)
• Microsoft AutoUpdate (Step 5)
• Full Disk Access (Step 6)
• System extensions (Step 7)
• Network extension (Step 8)
• Background services (Step 9)
• Bluetooth permissions (Step 10)