diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png index 674bd944f4..6697a9c025 100644 Binary files a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png and b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_16_PreferenceDomain.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png index f33c8959c0..7f7ba22250 100644 Binary files a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png and b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_17_approvedKernelExtensions.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png new file mode 100644 index 0000000000..13cf4d6ba8 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_35_JAMF_PrivacyPreferences.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png index be6bc477b4..d38e5a7760 100644 Binary files a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png and b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_6_SystemConfigurationProfiles.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md index ba4afb804d..da58cfffbd 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md @@ -83,6 +83,9 @@ The installation proceeds. > [!NOTE] > If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled. +> [!NOTE] +> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted. + ### Fixing disabled Real-Time Protection If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it: @@ -166,6 +169,13 @@ After installation, you'll see the Microsoft Defender icon in the macOS status b ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) +## Catalina + +> [!CAUTION] +> macOS 10.15 (Catalina) does not allow us to scan certain user's directories (Documents, etc.) without a user's consent. + +To grant consent, open System Preferences, Security & Privacy, Privacy, Full Disk Access. Click the lock to make changes (bottom of the dialog box). Select Microsoft Defender. + ## Logging installation issues See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index 1abf3471f5..f96ca326c6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -116,8 +116,77 @@ You may now enroll more devices. You can also enroll them later, after you have 5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. 6. Repeat steps 1 through 5 for more profiles. -7. Create a new profile one more time, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. -8. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. +7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. +8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it. + + ```xml + + + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc + PayloadOrganization + Microsoft Corp. + PayloadRemovalDisallowed + + PayloadScope + system + PayloadType + Configuration + PayloadUUID + C234DF2E-DFF6-11E9-B279-001C4299FB44 + PayloadVersion + 1 + PayloadContent + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc.C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadOrganization + Microsoft Corp. + PayloadType + com.apple.TCC.configuration-profile-policy + PayloadUUID + C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadVersion + 1 + Services + + SystemPolicyAllFiles + + + Allowed + + CodeRequirement + identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9 + Comment + Allow SystemPolicyAllFiles control for Microsoft Defender ATP + Identifier + com.microsoft.wdav + IdentifierType + bundleID + + + + + + + + ``` + + > [!CAUTION] + > This is a new configuration we add for Catalina. If you previously configured Defender in Intune without it, please modify it and add this option. + +9. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 621dee60a6..78ae0346b9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -90,6 +90,20 @@ To approve the kernel extension: ![Approved kernel extensions screenshot](images/MDATP_17_approvedKernelExtensions.png) +### Privacy Preferences Policy Control + +By default, starting with Catalina, Microsoft Defender cannot access files in a user's home directory. To resolve it, add a JAMF policy to allow Defender Full Disk Access. + +1. Select **Options > Privacy Preferences Policy Control**. +2. Use any identifier and identifier type = Bundle. +3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. +4. Set app or service to SystemPolicyAllFiles and access to Allow. + +![Privacy Preferences Policy Control](images/MDATP_35_JAMF_PrivacyPreferences.png) + +> [!CAUTION] +> This is a new configuration we add for Catalina. If you set your configuration profile for Defender without it, please modify it and add this option. + #### Configuration Profile's Scope Configure the appropriate scope to specify the devices that will receive the configuration profile.