Microsoft's enterprise security platform Windows Defender Advanced Threat Protection (ATP) can now protect macOS devices in addition to Windows 10 ones, Microsoft announced today. The Microsoft Defender Advanced Threat Protection (ATP) endpoint security platform now provides users with a new report designed to help them keep track of vulnerable Windows and macOS devices. Microsoft has created a dedicated Defender ATP client for Mac, and it offers full virus and threat protection mixed with the usual ability to perform quick or full scans. Key Features; Integration with Windows Security Center. Microsoft and Bitdefender are collaborating to integrate Bitdefender’s GravityZone Cloud with Microsoft’s Windows Defender Advanced Threat Protection and enable Microsoft customers to detect, view, investigate, and respond to advanced cyber-attacks and data breaches on macOS and Linux-based endpoints within the WDATP Management.

-->

Important

Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender Advanced Threat Protection. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.

Applies to:

This page will guide you through the steps you need to take to set up macOS policies in Jamf Pro.

You'll need to take the following steps:

Step 1: Get the Microsoft Defender ATP onboarding package

In Microsoft Defender Security Center, navigate to Settings > Onboarding.
Select macOS as the operating system and Mobile Device Management / Microsoft Intune as the deployment method.
Select Download onboarding package (WindowsDefenderATPOnboardingPackage.zip).
Extract WindowsDefenderATPOnboardingPackage.zip.
Copy the file to your preferred location. For example, C:UsersJaneDoe_or_JohnDoe.contosoDownloadsWindowsDefenderATPOnboardingPackage_macOS_MDM_contosojamfWindowsDefenderATPOnboarding.plist.

Step 2: Create a configuration profile in Jamf Pro using the onboarding package

Locate the file WindowsDefenderATPOnboarding.plist from the previous section.
In the Jamf Pro dashboard, select New.
Enter the following details:
General
- Name: MDATP onboarding for macOS
- Description: MDATP EDR onboarding for macOS
- Category: None
- Distribution Method: Install Automatically
- Level: Computer Level
In Application & Custom Settings select Configure.
Select Upload File (PLIST file) then in Preference Domain enter: com.microsoft.wdav.atp.
Select Open and select the onboarding file.
Select Upload.
Select the Scope tab.
Select the target computers.
Select Save.
Select Done.

Step 3: Configure Microsoft Defender ATP settings

Use the following Microsoft Defender ATP configuration settings:
- enableRealTimeProtection
- passiveMode
Note
Not turned on by default, if you are planning to run a third-party AV for macOS, set it to true.
- exclusions
- excludedPath
- excludedFileExtension
- excludedFileName
- exclusionsMergePolicy
- allowedThreats
Note
EICAR is on the sample, if you are going through a proof-of-concept, remove it especially if you are testing EICAR.
- disallowedThreatActions
- potentially_unwanted_application
- archive_bomb
- cloudService
- automaticSampleSubmission
- tags
- hideStatusMenuIcon
For information, see Property list for Jamf configuration profile.
Save the file as MDATP_MDAV_configuration_settings.plist.
In the Jamf Pro dashboard, select General.
Enter the following details:
General
- Name: MDATP MDAV configuration settings
- Description:<blank>
- Category: None (default)
- Distribution Method: Install Automatically(default)
- Level: Computer Level(default)
In Application & Custom Settings select Configure.
Select Upload File (PLIST file).
In Preferences Domain, enter com.microsoft.wdav, then select Upload PLIST File.
Select Choose File.
Select the MDATP_MDAV_configuration_settings.plist, then select Open.
Select Upload.
Note
If you happen to upload the Intune file, you'll get the following error:
Select Save.
The file is uploaded.
Select the Scope tab.
Select Contoso's Machine Group.
Select Add, then select Save.
Select Done. You'll see the new Configuration profile.

Step 4: Configure notifications settings

These steps are applicable of macOS 10.15 (Catalina) or newer.

Download notif.mobileconfig from our GitHub repository
Save it as MDATP_MDAV_notification_settings.plist.
In the Jamf Pro dashboard, select General.
Enter the following details:
General
- Name: MDATP MDAV Notification settings
- Description: macOS 10.15 (Catalina) or newer
- Category: None (default)
- Distribution Method: Install Automatically(default)
- Level: Computer Level(default)
Select Upload File (PLIST file).
Select Choose File > MDATP_MDAV_Notification_Settings.plist.
Select Open > Upload.
Select the Scope tab, then select Add.
Select Contoso's Machine Group.
Select Add, then select Save.
Select Done. You'll see the new Configuration profile.

Step 5: Configure Microsoft AutoUpdate (MAU)

Use the following Microsoft Defender ATP configuration settings:
Save it as MDATP_MDAV_MAU_settings.plist.
In the Jamf Pro dashboard, select General.
Enter the following details:
General
- Name: MDATP MDAV MAU settings
- Description: Microsoft AutoUpdate settings for MDATP for macOS
- Category: None (default)
- Distribution Method: Install Automatically(default)
- Level: Computer Level(default)
In Application & Custom Settings select Configure.
Select Upload File (PLIST file).
In Preference Domain enter: com.microsoft.autoupdate2, then select Upload PLIST File.
Select Choose File.
Select MDATP_MDAV_MAU_settings.plist.
Select Upload.
Select Save.
Select the Scope tab.
Select Add.
Select Done.

Step 6: Grant full disk access to Microsoft Defender ATP

In the Jamf Pro dashboard, select Configuration Profiles.
Select + New.
Enter the following details:
General
- Name: MDATP MDAV - grant Full Disk Access to EDR and AV
- Description: On macOS Catalina or newer, the new Privacy Preferences Policy Control
- Category: None
- Distribution method: Install Automatically
- Level: Computer level
In Configure Privacy Preferences Policy Control select Configure.

Microsoft Defender Advanced Threat Protection For Mac Download