deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 06:17:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Did some reordering and code cleanup

Browse Source
This commit is contained in:
Beth Levin 2019-11-04 16:09:51 -08:00
parent d195fb550d
commit bac50e06c2
2 changed files with 68 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac-resources.md
View File

@ -18,7 +18,7 @@ ms.collection: M365-security-compliance
ms.topic: conceptual ms.topic: conceptual
--- ---
# Resources # Microsoft Defender ATP for Mac Resources
**Applies to:** **Applies to:**

126
windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md
View File

@ -35,20 +35,34 @@ If you have any feedback that you would like to share, submit it by opening Micr
### Prerequisites ### Prerequisites
- Access to the Microsoft Defender Security Center portal - A Microsoft Defender ATP subscription and access to the Microsoft Defender Security Center portal
- Beginner-level experience in macOS and BASH scripting - Beginner-level experience in macOS and BASH scripting
- Administrative privileges on the device (in case of manual deployment) - Administrative privileges on the device (in case of manual deployment)
### Installation instructions
There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac.
- Third-party management tools:
- [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md)
- [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md)
- [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md)
- Command-line tool:
- [Manual deployment](microsoft-defender-atp-mac-install-manually.md)
### System requirements ### System requirements
> [!CAUTION] The three most recent major releases of macOS are supported:
> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported.
>
> macOS Sierra (10.12) support will end on January 1, 2020.
- Supported macOS versions: 10.15 (Catalina), 10.14 (Mojave), 10.13 (High Sierra) - 10.15 (Catalina), 10.14 (Mojave), 10.13 (High Sierra)
- Disk space: 650 MB - Disk space: 650 MB
Beta versions of macOS are not supported. macOS Sierra (10.12) support will end on January 1, 2020.
### Network connections
After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints.
The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them.
@ -88,32 +102,18 @@ Once Microsoft Defender ATP is installed, connectivity can be validated by runni
$ mdatp --connectivity-test $ mdatp --connectivity-test
``` ```
### Installation instructions ## Enable Endpoint Detection and Response preview features
There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. If you are an Endpoint Detection and Response (EDR) private or public preview customer, you can set up your machine to receive EDR preview features. Currently this flag enables or disables the entire EDR functionality.
In general you need to take the following steps: ### Intune-based EDR preview set up
- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal Create configuration profile com.microsoft.wdav.plist with the following content:
- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: ```XML
- Via third-party management tools:
- [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md)
- [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md)
- [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md)
- Via the command-line tool:
- [Manual deployment](microsoft-defender-atp-mac-install-manually.md)
## How to enable EDR preview
If you are an EDR private \ public preview customer, you can enable your machine to receive EDR preview features.
Currently this flag enables \ disables the entire EDR functionality.
- Intune-based enable
- Create configuration profile com.microsoft.wdav.plist with the following content:
```XML
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1"> <plist version="1">
<dict> <dict>
<key>PayloadUUID</key> <key>PayloadUUID</key>
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string> <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
<key>PayloadType</key> <key>PayloadType</key>
@ -160,55 +160,63 @@ Currently this flag enables \ disables the entire EDR functionality.
</dict> </dict>
</dict> </dict>
</array> </array>
</dict> </dict>
</plist> </plist>
``` ```
For more info, refer to [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md)
- JAMF-based enable For more info, refer to [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md).
- Create configuration profile com.microsoft.wdav.plist with the following content:
```XML ### JAMF-based EDR preview set up
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> Create configuration profile com.microsoft.wdav.plist with the following content:
<plist version="1.0">
<dict> ```XML
<key>edr</key> <?xml version="1.0" encoding="UTF-8"?>
<dict> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<key>earlyPreview</key> <plist version="1.0">
<true/> <dict>
</dict> <key>edr</key>
</dict> <dict>
</plist> <key>earlyPreview</key>
``` <true/>
For more info, refer to [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) </dict>
- Manual enable </dict>
- In command prompt, run </plist>
```bash ```
For more info, refer to [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md).
### Manual EDR preview set up
In command prompt, run
```bash
$ mdatp --early-preview true $ mdatp --early-preview true
``` ```
For more info, refer to [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md)
For more info, refer to [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md).
### Test EDR set up
To test if EDR is enabled and functioning properly on a machine, visit machine details. Timeline tab should contain events. To test if EDR is enabled and functioning properly on a machine, visit machine details. Timeline tab should contain events.
- If timeline shows no events, please make sure System Extension were approved for machine. - If timeline shows no events, please make sure System Extension were approved for machine.
- If you are on Catalina and seeing no file events, make sure Full Disk Access was allowed. - If you are on Catalina and seeing no file events, make sure Full Disk Access was allowed.
For more info, refer to deployment instructions: For more info, refer to deployment instructions:
- [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md)
- [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md)
- [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md)
- Via the command-line tool:
- [Manual deployment](microsoft-defender-atp-mac-install-manually.md) - [Manual deployment](microsoft-defender-atp-mac-install-manually.md)
## How to update Microsoft Defender ATP for Mac ## Update Microsoft Defender ATP for Mac
Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used.
To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md)
## How to configure Microsoft Defender ATP for Mac
Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md).
## Resources ## Resources
- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page. - [Microsoft Defender ATP for Mac Resources](microsoft-defender-atp-mac-resources.md) has more information about logging, uninstalling, or other topics
- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) has guidance on how to configure the product in enterprise environments
- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) - [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) has privacy info