diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index 1abf3471f5..6d2ffcb018 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -116,8 +116,75 @@ You may now enroll more devices. You can also enroll them later, after you have 5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. 6. Repeat steps 1 through 5 for more profiles. -7. Create a new profile one more time, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. -8. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. +7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. +8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it. + ```xml + + + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc + PayloadOrganization + Microsoft Corp. + PayloadRemovalDisallowed + + PayloadScope + system + PayloadType + Configuration + PayloadUUID + C234DF2E-DFF6-11E9-B279-001C4299FB44 + PayloadVersion + 1 + PayloadContent + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc.C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadOrganization + Microsoft Corp. + PayloadType + com.apple.TCC.configuration-profile-policy + PayloadUUID + C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadVersion + 1 + Services + + SystemPolicyAllFiles + + + Allowed + + CodeRequirement + identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9 + Comment + Allow SystemPolicyAllFiles control for Microsoft Defender ATP + Identifier + com.microsoft.wdav + IdentifierType + bundleID + + + + + + + +``` +> [!CAUTION] +> This is a new configuration we add for Catalina. If you set your configuration profile for Defender without it, please modify it and add this option. + +9. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: