mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge branch 'master' into repo_sync_working_branch
This commit is contained in:
Jeff Borsecnik
GitHub
commit
d4dc3948c9
@ -29,104 +29,104 @@ Endpoint detection and response capabilities in Microsoft Defender ATP for Mac a
|
||||
|
||||
## Enable the Insider program with Jamf
|
||||
|
||||
a. Create configuration profile com.microsoft.wdav.plist with the following content:
|
||||
1. Create configuration profile com.microsoft.wdav.plist with the following content:
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>edr</key>
|
||||
<dict>
|
||||
<key>earlyPreview</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>edr</key>
|
||||
<dict>
|
||||
<key>earlyPreview</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
b. From the JAMF console, navigate to **Computers > Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**.
|
||||
1. From the JAMF console, navigate to **Computers > Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**.
|
||||
|
||||
c. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist created earlier.
|
||||
1. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist created earlier.
|
||||
|
||||
>[!WARNING]
|
||||
>You must enter the correct preference domain (com.microsoft.wdav), otherwise the preferences will not be recognized by the product
|
||||
> [!WARNING]
|
||||
> You must enter the correct preference domain (com.microsoft.wdav), otherwise the preferences will not be recognized by the product
|
||||
|
||||
## Enable the Insider program with Intune
|
||||
|
||||
a. Create configuration profile com.microsoft.wdav.plist with the following content:
|
||||
1. Create configuration profile com.microsoft.wdav.plist with the following content:
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1">
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>edr</key>
|
||||
<dict>
|
||||
<key>earlyPreview</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1">
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>edr</key>
|
||||
<dict>
|
||||
<key>earlyPreview</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
b. Open **Manage > Device configuration**. Select **Manage > Profiles > Create Profile**.
|
||||
1. Open **Manage > Device configuration**. Select **Manage > Profiles > Create Profile**.
|
||||
|
||||
c. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**.
|
||||
1. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**.
|
||||
|
||||
d. Save the .plist created earlier as com.microsoft.wdav.xml.
|
||||
1. Save the .plist created earlier as com.microsoft.wdav.xml.
|
||||
|
||||
e. Enter com.microsoft.wdav as the custom configuration profile name.
|
||||
1. Enter com.microsoft.wdav as the custom configuration profile name.
|
||||
|
||||
f. Open the configuration profile and upload com.microsoft.wdav.xml. This file was created in step 1.
|
||||
1. Open the configuration profile and upload com.microsoft.wdav.xml. This file was created in step 1.
|
||||
|
||||
g. Select **OK**.
|
||||
1. Select **OK**.
|
||||
|
||||
h. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
1. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
|
||||
>[!WARNING]
|
||||
>You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product.
|
||||
> [!WARNING]
|
||||
> You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product.
|
||||
|
||||
## Enable the Insider program manually on a single device
|
||||
|
||||
@ -134,7 +134,7 @@ In terminal, run:
|
||||
|
||||
```bash
|
||||
mdatp --edr --early-preview true
|
||||
```
|
||||
```
|
||||
|
||||
For versions earlier than 100.78.0, run:
|
||||
|
||||
@ -161,4 +161,4 @@ After a successful deployment and onboarding of the correct version, check that
|
||||
|
||||
* Check that you enabled the early preview flag. In terminal run “mdatp –health” and look for the value of “edrEarlyPreviewEnabled”. It should be “Enabled”.
|
||||
|
||||
If you followed the manual deployment instructions, you were prompted to enable Kernel Extensions. Pay attention to the “System Extension note” in the [manual deployment documentation](mac-install-manually.md#application-installation) and use the “Manual Deployment” section in the [troubleshoot kernel extension documentation](mac-support-kext.md#manual-deployment).
|
||||
If you followed the manual deployment instructions, you were prompted to enable Kernel Extensions. Pay attention to the “System Extension note” in the [manual deployment documentation](mac-install-manually.md#application-installation-macos-1015-and-older-versions) and use the “Manual Deployment” section in the [troubleshoot kernel extension documentation](mac-support-kext.md#manual-deployment).
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 717 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 751 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 382 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 869 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 395 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 297 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 118 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 266 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 328 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 306 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 231 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 235 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 361 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 381 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 288 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 359 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 328 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 397 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 406 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 406 KiB |
@ -28,7 +28,8 @@ ms.topic: conceptual
|
||||
|
||||
This topic describes how to deploy Microsoft Defender ATP for macOS manually. A successful deployment requires the completion of all of the following steps:
|
||||
- [Download installation and onboarding packages](#download-installation-and-onboarding-packages)
|
||||
- [Application installation](#application-installation)
|
||||
- [Application installation (macOS 10.15 and older versions)](#application-installation-macos-1015-and-older-versions)
|
||||
- [Application installation (macOS 11 and newer versions)](#application-installation-macos-11-and-newer-versions)
|
||||
- [Client configuration](#client-configuration)
|
||||
|
||||
## Prerequisites and system requirements
|
||||
@ -48,7 +49,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
||||
|
||||
5. From a command prompt, verify that you have the two files.
|
||||
|
||||
## Application installation
|
||||
## Application installation (macOS 10.15 and older versions)
|
||||
|
||||
To complete this process, you must have admin privileges on the device.
|
||||
|
||||
@ -65,7 +66,7 @@ To complete this process, you must have admin privileges on the device.
|
||||
|
||||
|
||||
|
||||
3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**:
|
||||
3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**:
|
||||
|
||||
|
||||
|
||||
@ -77,6 +78,34 @@ To complete this process, you must have admin privileges on the device.
|
||||
> [!NOTE]
|
||||
> macOS may request to reboot the device upon the first installation of Microsoft Defender. Real-time protection will not be available until the device is rebooted.
|
||||
|
||||
## Application installation (macOS 11 and newer versions)
|
||||
|
||||
To complete this process, you must have admin privileges on the device.
|
||||
|
||||
1. Navigate to the downloaded wdav.pkg in Finder and open it.
|
||||
|
||||
|
||||
|
||||
2. Select **Continue**, agree with the License terms, and enter the password when prompted.
|
||||
|
||||
3. At the end of the installation process, you will be promoted to approve the system extensions used by the product. Select **Open Security Preferences**.
|
||||
|
||||
|
||||
|
||||
4. From the **Security & Privacy** window, select **Allow**.
|
||||
|
||||
|
||||
|
||||
5. Repeat steps 3 & 4 for all system extensions distributed with Microsoft Defender ATP for Mac.
|
||||
|
||||
6. As part of the Endpoint Detection and Response capabilities, Microsoft Defender ATP for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. When prompted to grant Microsoft Defender ATP permissions to filter network traffic, select **Allow**.
|
||||
|
||||
|
||||
|
||||
7. Open **System Preferences** > **Security & Privacy** and navigate to the **Privacy** tab. Grant **Full Disk Access** permission to **Microsoft Defender ATP** and **Microsoft Defender ATP Endpoint Security Extension**.
|
||||
|
||||
|
||||
|
||||
## Client configuration
|
||||
|
||||
1. Copy wdav.pkg and MicrosoftDefenderATPOnboardingMacOs.py to the device where you deploy Microsoft Defender ATP for macOS.
|
||||
|
||||
@ -34,6 +34,7 @@ This topic describes how to deploy Microsoft Defender ATP for Mac through Intune
|
||||
|
||||
1. [Download installation and onboarding packages](#download-installation-and-onboarding-packages)
|
||||
1. [Client device setup](#client-device-setup)
|
||||
1. [Approve system extensions](#approve-system-extensions)
|
||||
1. [Create System Configuration profiles](#create-system-configuration-profiles)
|
||||
1. [Publish application](#publish-application)
|
||||
|
||||
@ -48,24 +49,30 @@ The following table summarizes the steps you would need to take to deploy and ma
|
||||
| Step | Sample file names | BundleIdentifier |
|
||||
|-|-|-|
|
||||
| [Download installation and onboarding packages](#download-installation-and-onboarding-packages) | WindowsDefenderATPOnboarding__MDATP_wdav.atp.xml | com.microsoft.wdav.atp |
|
||||
| [Approve System Extension for Microsoft Defender ATP](#approve-system-extensions) | MDATP_SysExt.xml | N/A |
|
||||
| [Approve Kernel Extension for Microsoft Defender ATP](#download-installation-and-onboarding-packages) | MDATP_KExt.xml | N/A |
|
||||
| [Grant full disk access to Microsoft Defender ATP](#create-system-configuration-profiles-step-8) | MDATP_tcc_Catalina_or_newer.xml | com.microsoft.wdav.tcc |
|
||||
| [Network Extension policy](#create-system-configuration-profiles-step-9) | MDATP_NetExt.xml | N/A |
|
||||
| [Configure Microsoft AutoUpdate (MAU)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates#intune) | MDATP_Microsoft_AutoUpdate.xml | com.microsoft.autoupdate2 |
|
||||
| [Microsoft Defender ATP configuration settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#intune-profile-1)<br/><br/> **Note:** If you are planning to run a third party AV for macOS, set `passiveMode` to `true`. | MDATP_WDAV_and_exclusion_settings_Preferences.xml | com.microsoft.wdav |
|
||||
| [Configure Microsoft Defender ATP and MS AutoUpdate (MAU) notifications](#create-system-configuration-profiles-step-9) | MDATP_MDAV_Tray_and_AutoUpdate2.mobileconfig | com.microsoft.autoupdate2 or com.microsoft.wdav.tray |
|
||||
| [Configure Microsoft Defender ATP and MS AutoUpdate (MAU) notifications](#create-system-configuration-profiles-step-10) | MDATP_MDAV_Tray_and_AutoUpdate2.mobileconfig | com.microsoft.autoupdate2 or com.microsoft.wdav.tray |
|
||||
|
||||
## Download installation and onboarding packages
|
||||
|
||||
Download the installation and onboarding packages from Microsoft Defender Security Center:
|
||||
|
||||
1. In Microsoft Defender Security Center, go to **Settings** > **Device Management** > **Onboarding**.
|
||||
|
||||
2. Set the operating system to **macOS** and the deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
|
||||
|
||||
|
||||
3. Select **Download installation package**. Save it as _wdav.pkg_ to a local directory.
|
||||
|
||||
4. Select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
||||
|
||||
5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos).
|
||||
|
||||
6. From a command prompt, verify that you have the three files.
|
||||
|
||||
|
||||
@ -130,203 +137,85 @@ You do not need any special provisioning for a Mac device beyond a standard [Com
|
||||
|
||||
2. Select **Continue** and complete the enrollment.
|
||||
|
||||
You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.
|
||||
You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.
|
||||
|
||||
3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed:
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Approve System Extensions
|
||||
|
||||
To approve the system extensions:
|
||||
|
||||
1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**.
|
||||
|
||||
2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Extensions**. Select **Create**.
|
||||
|
||||
3. In the `Basics` tab, give a name to this new profile.
|
||||
|
||||
4. In the `Configuration settings` tab, add the following entries in the `Allowed system extensions` section:
|
||||
|
||||
Bundle identifier | Team identifier
|
||||
--------------------------|----------------
|
||||
com.microsoft.wdav.epsext | UBF8T346G9
|
||||
com.microsoft.wdav.netext | UBF8T346G9
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. In the `Assignments` tab, assign this profile to **All Users & All devices**.
|
||||
|
||||
6. Review and create this configuration profile.
|
||||
|
||||
## Create System Configuration profiles
|
||||
|
||||
1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**.
|
||||
|
||||
2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**.
|
||||
|
||||
3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.
|
||||
|
||||
4. Select **OK**.
|
||||
|
||||
|
||||
|
||||
5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
|
||||
6. Repeat steps 1 through 5 for more profiles.
|
||||
|
||||
7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file.
|
||||
8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it.<a name="create-system-configuration-profiles-step-8" id = "create-system-configuration-profiles-step-8"></a>
|
||||
|
||||
8. Download `fulldisk.mobileconfig` from [our GitHub repository](https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mobileconfig/profiles/fulldisk.mobileconfig) and save it as `tcc.xml`. Create another profile, give it any name and upload this file to it.<a name="create-system-configuration-profiles-step-8" id = "create-system-configuration-profiles-step-8"></a>
|
||||
|
||||
> [!CAUTION]
|
||||
> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device.
|
||||
>
|
||||
> The following configuration profile grants Full Disk Access to Microsoft Defender ATP. If you previously configured Microsoft Defender ATP through Intune, we recommend you update the deployment with this configuration profile.
|
||||
> This configuration profile grants Full Disk Access to Microsoft Defender ATP. If you previously configured Microsoft Defender ATP through Intune, we recommend you update the deployment with this configuration profile.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Allows Microsoft Defender to access all files on Catalina+</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>TCC - Microsoft Defender</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav.tcc</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corp.</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>system</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>C234DF2E-DFF6-11E9-B279-001C4299FB44</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Allows Microsoft Defender to access all files on Catalina+</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>TCC - Microsoft Defender</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav.tcc.C233A5E6-DFF6-11E9-BDAD-001C4299FB44</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft Corp.</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.TCC.configuration-profile-policy</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>C233A5E6-DFF6-11E9-BDAD-001C4299FB44</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>Services</key>
|
||||
<dict>
|
||||
<key>SystemPolicyAllFiles</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>Allowed</key>
|
||||
<true/>
|
||||
<key>CodeRequirement</key>
|
||||
<string>identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9</string>
|
||||
<key>Comment</key>
|
||||
<string>Allow SystemPolicyAllFiles control for Microsoft Defender ATP</string>
|
||||
<key>Identifier</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>IdentifierType</key>
|
||||
<string>bundleID</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
9. As part of the Endpoint Detection and Response capabilities, Microsoft Defender ATP for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality. Download `netfilter.mobileconfig` from [our GitHub repository](https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mobileconfig/profiles/netfilter.mobileconfig), save it as netext.xml and deploy it using the same steps as in the previous sections. <a name = "create-system-configuration-profiles-step-9" id = "create-system-configuration-profiles-step-9"></a>
|
||||
|
||||
9. To allow Defender and Auto Update to display notifications in UI on macOS 10.15 (Catalina), import the following .mobileconfig as a custom payload: <a name = "create-system-configuration-profiles-step-9" id = "create-system-configuration-profiles-step-9"></a>
|
||||
10. To allow Defender and Auto Update to display notifications in UI on macOS 10.15 (Catalina), download `notif.mobileconfig` from [our GitHub repository](https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mobileconfig/profiles/notif.mobileconfig) and import it as a custom payload. <a name = "create-system-configuration-profiles-step-10" id = "create-system-configuration-profiles-step-10"></a>
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>NotificationSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>AlertType</key>
|
||||
<integer>2</integer>
|
||||
<key>BadgesEnabled</key>
|
||||
<true/>
|
||||
<key>BundleIdentifier</key>
|
||||
<string>com.microsoft.autoupdate2</string>
|
||||
<key>CriticalAlertEnabled</key>
|
||||
<false/>
|
||||
<key>GroupingType</key>
|
||||
<integer>0</integer>
|
||||
<key>NotificationsEnabled</key>
|
||||
<true/>
|
||||
<key>ShowInLockScreen</key>
|
||||
<false/>
|
||||
<key>ShowInNotificationCenter</key>
|
||||
<true/>
|
||||
<key>SoundsEnabled</key>
|
||||
<true/>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>AlertType</key>
|
||||
<integer>2</integer>
|
||||
<key>BadgesEnabled</key>
|
||||
<true/>
|
||||
<key>BundleIdentifier</key>
|
||||
<string>com.microsoft.wdav.tray</string>
|
||||
<key>CriticalAlertEnabled</key>
|
||||
<false/>
|
||||
<key>GroupingType</key>
|
||||
<integer>0</integer>
|
||||
<key>NotificationsEnabled</key>
|
||||
<true/>
|
||||
<key>ShowInLockScreen</key>
|
||||
<false/>
|
||||
<key>ShowInNotificationCenter</key>
|
||||
<true/>
|
||||
<key>SoundsEnabled</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>notifications</string>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>BB977315-E4CB-4915-90C7-8334C75A7C64</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.notificationsettings</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>BB977315-E4CB-4915-90C7-8334C75A7C64</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>mdatp - allow notifications</string>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>85F6805B-0106-4D23-9101-7F1DFD5EA6D6</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>85F6805B-0106-4D23-9101-7F1DFD5EA6D6</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
10. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
11. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
|
||||
Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**:
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Publish application
|
||||
|
||||
1. In Intune, open the **Manage > Client apps** blade. Select **Apps > Add**.
|
||||
|
||||
2. Select **App type=Other/Line-of-business app**.
|
||||
|
||||
3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload.
|
||||
|
||||
4. Select **Configure** and add the required information.
|
||||
|
||||
5. Use **macOS High Sierra 10.13** as the minimum OS.
|
||||
|
||||
6. Set *Ignore app version* to **Yes**. Other settings can be any arbitrary value.
|
||||
|
||||
> [!CAUTION]
|
||||
@ -334,24 +223,30 @@ Once the Intune changes are propagated to the enrolled devices, you can see them
|
||||
>
|
||||
> If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Defender. This could result in a non-functioning application. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated. If you deployed Defender with *Ignore app version* set to **No**, please change it to **Yes**. If Defender still cannot be installed on a client device, then uninstall Defender and push the updated policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Select **OK** and **Add**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. Change **Assignment type** to **Required**.
|
||||
|
||||
10. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Select **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
11. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**:
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Verify client device state
|
||||
|
||||
@ -365,7 +260,8 @@ Once the Intune changes are propagated to the enrolled devices, you can see them
|
||||
|
||||
3. You should also see the Microsoft Defender icon in the top-right corner:
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ Most modern MDM solutions include these features, however, they may call them di
|
||||
You can deploy Defender without the last requirement from the preceding list, however:
|
||||
|
||||
- You will not be able to collect status in a centralized way
|
||||
- If you decide to uninstall Defender, you will need to logon to the client device locally as an administrator
|
||||
- If you decide to uninstall Defender, you will need to log on to the client device locally as an administrator
|
||||
|
||||
## Deployment
|
||||
|
||||
@ -70,13 +70,44 @@ Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be ext
|
||||
Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case.
|
||||
Alternatively, it may require you to convert the property list to a different format first.
|
||||
|
||||
Typically, your custom profile has an id, name, or domain attribute. You must use exactly "com.microsoft.wdav.atp" for this value.
|
||||
Typically, your custom profile has an ID, name, or domain attribute. You must use exactly "com.microsoft.wdav.atp" for this value.
|
||||
MDM uses it to deploy the settings file to **/Library/Managed Preferences/com.microsoft.wdav.atp.plist** on a client device, and Defender uses this file for loading the onboarding information.
|
||||
|
||||
### Kernel extension policy
|
||||
|
||||
Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to allow kernel extensions provided by Microsoft.
|
||||
|
||||
### System extension policy
|
||||
|
||||
Set up a system extension policy. Use team identifier **UBF8T346G9** and approve the following bundle identifiers:
|
||||
|
||||
- com.microsoft.wdav.epsext
|
||||
- com.microsoft.wdav.netext
|
||||
|
||||
### Full disk access policy
|
||||
|
||||
Grant Full Disk Access to the following components:
|
||||
|
||||
- Microsoft Defender ATP
|
||||
- Identifier: `com.microsoft.wdav`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /\* exists \*/ and certificate leaf[field.1.2.840.113635.100.6.1.13] /\* exists \*/ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
|
||||
- Microsoft Defender ATP Endpoint Security Extension
|
||||
- Identifier: `com.microsoft.wdav.epsext`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
|
||||
### Network extension policy
|
||||
|
||||
As part of the Endpoint Detection and Response capabilities, Microsoft Defender ATP for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality.
|
||||
|
||||
- Filter type: Plugin
|
||||
- Plugin bundle identifier: `com.microsoft.wdav`
|
||||
- Filter data provider bundle identifier: `com.microsoft.wdav.netext`
|
||||
- Filter data provider designated requirement: identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
- Filter sockets: `true`
|
||||
|
||||
## Check installation status
|
||||
|
||||
Run [mdatp](mac-install-with-jamf.md) on a client device to check the onboarding status.
|
||||
|
||||
@ -44,9 +44,13 @@ You'll need to take the following steps:
|
||||
|
||||
7. [Approve Kernel extension for Microsoft Defender ATP](#step-7-approve-kernel-extension-for-microsoft-defender-atp)
|
||||
|
||||
8. [Schedule scans with Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp)
|
||||
8. [Approve System extensions for Microsoft Defender ATP](#step-8-approve-system-extensions-for-microsoft-defender-atp)
|
||||
|
||||
9. [Deploy Microsoft Defender ATP for macOS](#step-9-deploy-microsoft-defender-atp-for-macos)
|
||||
9. [Configure Network Extension](#step-9-configure-network-extension)
|
||||
|
||||
10. [Schedule scans with Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp)
|
||||
|
||||
11. [Deploy Microsoft Defender ATP for macOS](#step-11-deploy-microsoft-defender-atp-for-macos)
|
||||
|
||||
|
||||
## Step 1: Get the Microsoft Defender ATP onboarding package
|
||||
@ -155,106 +159,106 @@ You'll need to take the following steps:
|
||||
|
||||
For information, see [Property list for Jamf configuration profile](mac-preferences.md#property-list-for-jamf-configuration-profile).
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>antivirusEngine</key>
|
||||
<dict>
|
||||
<key>enableRealTimeProtection</key>
|
||||
<true/>
|
||||
<key>passiveMode</key>
|
||||
<false/>
|
||||
<key>exclusions</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedPath</string>
|
||||
<key>isDirectory</key>
|
||||
<false/>
|
||||
<key>path</key>
|
||||
<string>/var/log/system.log</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedPath</string>
|
||||
<key>isDirectory</key>
|
||||
<true/>
|
||||
<key>path</key>
|
||||
<string>/home</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedFileExtension</string>
|
||||
<key>extension</key>
|
||||
<string>pdf</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedFileName</string>
|
||||
<key>name</key>
|
||||
<string>cat</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>exclusionsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
<key>allowedThreats</key>
|
||||
<array>
|
||||
<string>EICAR-Test-File (not a virus)</string>
|
||||
</array>
|
||||
<key>disallowedThreatActions</key>
|
||||
<array>
|
||||
<string>allow</string>
|
||||
<string>restore</string>
|
||||
</array>
|
||||
<key>threatTypeSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>potentially_unwanted_application</string>
|
||||
<key>value</key>
|
||||
<string>block</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>archive_bomb</string>
|
||||
<key>value</key>
|
||||
<string>audit</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>threatTypeSettingsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
</dict>
|
||||
<key>cloudService</key>
|
||||
<dict>
|
||||
<key>enabled</key>
|
||||
<true/>
|
||||
<key>diagnosticLevel</key>
|
||||
<string>optional</string>
|
||||
<key>automaticSampleSubmission</key>
|
||||
<true/>
|
||||
</dict>
|
||||
<key>edr</key>
|
||||
<dict>
|
||||
<key>tags</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>GROUP</string>
|
||||
<key>value</key>
|
||||
<string>ExampleTag</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
<key>userInterface</key>
|
||||
<dict>
|
||||
<key>hideStatusMenuIcon</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>antivirusEngine</key>
|
||||
<dict>
|
||||
<key>enableRealTimeProtection</key>
|
||||
<true/>
|
||||
<key>passiveMode</key>
|
||||
<false/>
|
||||
<key>exclusions</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedPath</string>
|
||||
<key>isDirectory</key>
|
||||
<false/>
|
||||
<key>path</key>
|
||||
<string>/var/log/system.log</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedPath</string>
|
||||
<key>isDirectory</key>
|
||||
<true/>
|
||||
<key>path</key>
|
||||
<string>/home</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedFileExtension</string>
|
||||
<key>extension</key>
|
||||
<string>pdf</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedFileName</string>
|
||||
<key>name</key>
|
||||
<string>cat</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>exclusionsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
<key>allowedThreats</key>
|
||||
<array>
|
||||
<string>EICAR-Test-File (not a virus)</string>
|
||||
</array>
|
||||
<key>disallowedThreatActions</key>
|
||||
<array>
|
||||
<string>allow</string>
|
||||
<string>restore</string>
|
||||
</array>
|
||||
<key>threatTypeSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>potentially_unwanted_application</string>
|
||||
<key>value</key>
|
||||
<string>block</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>archive_bomb</string>
|
||||
<key>value</key>
|
||||
<string>audit</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>threatTypeSettingsMergePolicy</key>
|
||||
<string>merge</string>
|
||||
</dict>
|
||||
<key>cloudService</key>
|
||||
<dict>
|
||||
<key>enabled</key>
|
||||
<true/>
|
||||
<key>diagnosticLevel</key>
|
||||
<string>optional</string>
|
||||
<key>automaticSampleSubmission</key>
|
||||
<true/>
|
||||
</dict>
|
||||
<key>edr</key>
|
||||
<dict>
|
||||
<key>tags</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>GROUP</string>
|
||||
<key>value</key>
|
||||
<string>ExampleTag</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
<key>userInterface</key>
|
||||
<dict>
|
||||
<key>hideStatusMenuIcon</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
2. Save the file as `MDATP_MDAV_configuration_settings.plist`.
|
||||
|
||||
@ -266,11 +270,12 @@ You'll need to take the following steps:
|
||||
4. Enter the following details:
|
||||
|
||||
**General**
|
||||
- Name: MDATP MDAV configuration settings
|
||||
- Description:\<blank\>
|
||||
- Category: None (default)
|
||||
- Distribution Method: Install Automatically(default)
|
||||
- Level: Computer Level(default)
|
||||
|
||||
- Name: MDATP MDAV configuration settings
|
||||
- Description:\<blank\>
|
||||
- Category: None (default)
|
||||
- Distribution Method: Install Automatically(default)
|
||||
- Level: Computer Level(default)
|
||||
|
||||
|
||||
|
||||
@ -336,100 +341,21 @@ You'll need to take the following steps:
|
||||
|
||||
These steps are applicable of macOS 10.15 (Catalina) or newer.
|
||||
|
||||
1. Use the following Microsoft Defender ATP notification configuration settings:
|
||||
1. Download `notif.mobileconfig` from [our GitHub repository](https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mobileconfig/profiles/notif.mobileconfig)
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>NotificationSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>AlertType</key>
|
||||
<integer>2</integer>
|
||||
<key>BadgesEnabled</key>
|
||||
<true/>
|
||||
<key>BundleIdentifier</key>
|
||||
<string>com.microsoft.autoupdate2</string>
|
||||
<key>CriticalAlertEnabled</key>
|
||||
<false/><key>GroupingType</key>
|
||||
<integer>0</integer>
|
||||
<key>NotificationsEnabled</key>
|
||||
<true/>
|
||||
<key>ShowInLockScreen</key>
|
||||
<false/>
|
||||
<key>ShowInNotificationCenter</key>
|
||||
<true/>
|
||||
<key>SoundsEnabled</key>
|
||||
<true/>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>AlertType</key>
|
||||
<integer>2</integer><key>BadgesEnabled</key>
|
||||
<true/><key>BundleIdentifier</key>
|
||||
<string>com.microsoft.wdav.tray</string>
|
||||
<key>CriticalAlertEnabled</key>
|
||||
<false/><key>GroupingType</key>
|
||||
<integer>0</integer>
|
||||
<key>NotificationsEnabled</key>
|
||||
<true/><key>ShowInLockScreen</key>
|
||||
<false/><key>ShowInNotificationCenter</key>
|
||||
<true/><key>SoundsEnabled</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string/><key>PayloadDisplayName</key>
|
||||
<string>notifications</string>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/><key>PayloadIdentifier</key>
|
||||
<string>BB977315-E4CB-4915-90C7-8334C75A7C64</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.notificationsettings</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>BB977315-E4CB-4915-90C7-8334C75A7C64</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string/><key>PayloadDisplayName</key>
|
||||
<string>mdatp - allow notifications</string>
|
||||
<key>PayloadEnabled</key><true/>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>85F6805B-0106-4D23-9101-7F1DFD5EA6D6</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/><key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>85F6805B-0106-4D23-9101-7F1DFD5EA6D6</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
2. Save it as `MDATP_MDAV_notification_settings.plist`.
|
||||
2. Save it as `MDATP_MDAV_notification_settings.plist`.
|
||||
|
||||
3. In the Jamf Pro dashboard, select **General**.
|
||||
|
||||
4. Enter the following details:
|
||||
|
||||
**General**
|
||||
- Name: MDATP MDAV Notification settings
|
||||
- Description: macOS 10.15 (Catalina) or newer
|
||||
- Category: None (default)
|
||||
- Distribution Method: Install Automatically(default)
|
||||
- Level: Computer Level(default)
|
||||
|
||||
- Name: MDATP MDAV Notification settings
|
||||
- Description: macOS 10.15 (Catalina) or newer
|
||||
- Category: None (default)
|
||||
- Distribution Method: Install Automatically(default)
|
||||
- Level: Computer Level(default)
|
||||
|
||||
|
||||
|
||||
@ -475,11 +401,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer.
|
||||
|
||||
1. Use the following Microsoft Defender ATP configuration settings:
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>ChannelName</key>
|
||||
<string>Production</string>
|
||||
<key>HowToCheck</key>
|
||||
@ -490,9 +416,9 @@ These steps are applicable of macOS 10.15 (Catalina) or newer.
|
||||
<false/>
|
||||
<key>SendAllTelemetryEnabled</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
2. Save it as `MDATP_MDAV_MAU_settings.plist`.
|
||||
|
||||
@ -503,11 +429,12 @@ These steps are applicable of macOS 10.15 (Catalina) or newer.
|
||||
4. Enter the following details:
|
||||
|
||||
**General**
|
||||
- Name: MDATP MDAV MAU settings
|
||||
- Description: Microsoft AutoUpdate settings for MDATP for macOS
|
||||
- Category: None (default)
|
||||
- Distribution Method: Install Automatically(default)
|
||||
- Level: Computer Level(default)
|
||||
|
||||
- Name: MDATP MDAV MAU settings
|
||||
- Description: Microsoft AutoUpdate settings for MDATP for macOS
|
||||
- Category: None (default)
|
||||
- Distribution Method: Install Automatically(default)
|
||||
- Level: Computer Level(default)
|
||||
|
||||
5. In **Application & Custom Settings** select **Configure**.
|
||||
|
||||
@ -582,10 +509,7 @@ These steps are applicable of macOS 10.15 (Catalina) or newer.
|
||||
|
||||
- Identifier: `com.microsoft.wdav`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier `com.microsoft.wdav` and anchor apple generic and
|
||||
certificate 1[field.1.2.840.113635.100.6.2.6] /\* exists \*/ and certificate
|
||||
leaf[field.1.2.840.113635.100.6.1.13] /\* exists \*/ and certificate
|
||||
leaf[subject.OU] = UBF8T346G9
|
||||
- Code Requirement: identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /\* exists \*/ and certificate leaf[field.1.2.840.113635.100.6.1.13] /\* exists \*/ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
|
||||
|
||||
|
||||
@ -594,32 +518,53 @@ leaf[subject.OU] = UBF8T346G9
|
||||
|
||||
|
||||
|
||||
- Under App or service: Set to **SystemPolicyAllFiles**
|
||||
|
||||
- Under App or service: Set to **SystemPolicyAllFiles**
|
||||
|
||||
- Under "access": Set to **Allow**
|
||||
- Under "access": Set to **Allow**
|
||||
|
||||
7. Select **Save** (not the one at the bottom right).
|
||||
|
||||
|
||||
|
||||
8. Select the **Scope** tab.
|
||||
8. Click the `+` sign next to **App Access** to add a new entry.
|
||||
|
||||
|
||||
|
||||
9. Enter the following details:
|
||||
|
||||
- Identifier: `com.microsoft.wdav.epsext`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
|
||||
10. Select **+ Add**.
|
||||
|
||||
|
||||
|
||||
- Under App or service: Set to **SystemPolicyAllFiles**
|
||||
|
||||
- Under "access": Set to **Allow**
|
||||
|
||||
11. Select **Save** (not the one at the bottom right).
|
||||
|
||||
|
||||
|
||||
12. Select the **Scope** tab.
|
||||
|
||||
|
||||
|
||||
9. Select **+ Add**.
|
||||
13. Select **+ Add**.
|
||||
|
||||
|
||||
|
||||
10. Select **Computer Groups** > under **Group Name** > select **Contoso's MachineGroup**.
|
||||
14. Select **Computer Groups** > under **Group Name** > select **Contoso's MachineGroup**.
|
||||
|
||||
|
||||
|
||||
11. Select **Add**.
|
||||
15. Select **Add**.
|
||||
|
||||
12. Select **Save**.
|
||||
16. Select **Save**.
|
||||
|
||||
13. Select **Done**.
|
||||
17. Select **Done**.
|
||||
|
||||
|
||||
|
||||
@ -635,11 +580,12 @@ leaf[subject.OU] = UBF8T346G9
|
||||
2. Enter the following details:
|
||||
|
||||
**General**
|
||||
- Name: MDATP MDAV Kernel Extension
|
||||
- Description: MDATP kernel extension (kext)
|
||||
- Category: None
|
||||
- Distribution Method: Install Automatically
|
||||
- Level: Computer Level
|
||||
|
||||
- Name: MDATP MDAV Kernel Extension
|
||||
- Description: MDATP kernel extension (kext)
|
||||
- Category: None
|
||||
- Distribution Method: Install Automatically
|
||||
- Level: Computer Level
|
||||
|
||||
|
||||
|
||||
@ -648,11 +594,10 @@ leaf[subject.OU] = UBF8T346G9
|
||||
|
||||
|
||||
|
||||
|
||||
4. In **Approved Kernel Extensions** Enter the following details:
|
||||
|
||||
- Display Name: Microsoft Corp.
|
||||
- Team ID: UBF8T346G9
|
||||
- Display Name: Microsoft Corp.
|
||||
- Team ID: UBF8T346G9
|
||||
|
||||
|
||||
|
||||
@ -677,10 +622,119 @@ leaf[subject.OU] = UBF8T346G9
|
||||
|
||||
|
||||
|
||||
## Step 8: Schedule scans with Microsoft Defender ATP for Mac
|
||||
## Step 8: Approve System extensions for Microsoft Defender ATP
|
||||
|
||||
1. In the **Configuration Profiles**, select **+ New**.
|
||||
|
||||
|
||||
|
||||
2. Enter the following details:
|
||||
|
||||
**General**
|
||||
|
||||
- Name: MDATP MDAV System Extensions
|
||||
- Description: MDATP system extensions
|
||||
- Category: None
|
||||
- Distribution Method: Install Automatically
|
||||
- Level: Computer Level
|
||||
|
||||
|
||||
|
||||
3. In **System Extensions** select **Configure**.
|
||||
|
||||
|
||||
|
||||
4. In **System Extensions** enter the following details:
|
||||
|
||||
- Display Name: Microsoft Corp. System Extensions
|
||||
- System Extension Types: Allowed System Extensions
|
||||
- Team Identifier: UBF8T346G9
|
||||
- Allowed System Extensions:
|
||||
- **com.microsoft.wdav.epsext**
|
||||
- **com.microsoft.wdav.netext**
|
||||
|
||||
|
||||
|
||||
5. Select the **Scope** tab.
|
||||
|
||||
|
||||
|
||||
6. Select **+ Add**.
|
||||
|
||||
7. Select **Computer Groups** > under **Group Name** > select **Contoso's Machine Group**.
|
||||
|
||||
8. Select **+ Add**.
|
||||
|
||||
|
||||
|
||||
9. Select **Save**.
|
||||
|
||||
|
||||
|
||||
10. Select **Done**.
|
||||
|
||||
|
||||
|
||||
## Step 9: Configure Network Extension
|
||||
|
||||
As part of the Endpoint Detection and Response capabilities, Microsoft Defender ATP for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality.
|
||||
|
||||
>[!NOTE]
|
||||
>JAMF doesn’t have built-in support for content filtering policies, which are a pre-requisite for enabling the network extensions that Microsoft Defender ATP for Mac installs on the device. Furthermore, JAMF sometimes changes the content of the policies being deployed.
|
||||
>As such, the following steps provide a workaround that involve signing the configuration profile.
|
||||
|
||||
1. Download `netfilter.mobileconfig` from [our GitHub repository](https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/macos/mobileconfig/profiles/netfilter.mobileconfig) to your device and save it as `com.microsoft.network-extension.mobileconfig`
|
||||
|
||||
2. Follow the instructions on [this page](https://www.jamf.com/jamf-nation/articles/649/creating-a-signing-certificate-using-jamf-pro-s-built-in-certificate-authority) to create a signing certificate using JAMF’s built-in certificate authority
|
||||
|
||||
3. After the certificate is created and installed to your device, run the following command from the Terminal from a macOS device:
|
||||
|
||||
```bash
|
||||
$ security cms -S -N "<certificate name>" -i com.microsoft.network-extension.mobileconfig -o com.microsoft.network-extension.signed.mobileconfig
|
||||
```
|
||||
|
||||
|
||||
|
||||
4. From the JAMF portal, navigate to **Configuration Profiles** and click the **Upload** button.
|
||||
|
||||
|
||||
|
||||
5. Select **Choose File** and select `microsoft.network-extension.signed.mobileconfig`.
|
||||
|
||||
|
||||
|
||||
6. Select **Upload**.
|
||||
|
||||
|
||||
|
||||
7. After uploading the file, you are redirected to a new page to finalize the creation of this profile.
|
||||
|
||||
|
||||
|
||||
8. Select the **Scope** tab.
|
||||
|
||||
|
||||
|
||||
9. Select **+ Add**.
|
||||
|
||||
10. Select **Computer Groups** > under **Group Name** > select **Contoso's Machine Group**.
|
||||
|
||||
11. Select **+ Add**.
|
||||
|
||||
|
||||
|
||||
12. Select **Save**.
|
||||
|
||||
|
||||
|
||||
13. Select **Done**.
|
||||
|
||||
|
||||
|
||||
## Step 10: Schedule scans with Microsoft Defender ATP for Mac
|
||||
Follow the instructions on [Schedule scans with Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp).
|
||||
|
||||
## Step 9: Deploy Microsoft Defender ATP for macOS
|
||||
## Step 11: Deploy Microsoft Defender ATP for macOS
|
||||
|
||||
1. Navigate to where you saved `wdav.pkg`.
|
||||
|
||||
@ -729,10 +783,12 @@ Follow the instructions on [Schedule scans with Microsoft Defender ATP for Mac](
|
||||
|
||||
|
||||
9. Select **Save**. The package is uploaded to Jamf Pro.
|
||||
|
||||
|
||||
It can take a few minutes for the package to be available for deployment.
|
||||
|
||||
|
||||
|
||||
It can take a few minutes for the package to be available for deployment.
|
||||
|
||||
|
||||
|
||||
10. Navigate to the **Policies** page.
|
||||
|
||||
@ -765,25 +821,31 @@ Follow the instructions on [Schedule scans with Microsoft Defender ATP for Mac](
|
||||
|
||||
|
||||
17. Select **Save**.
|
||||
|
||||
|
||||
|
||||
18. Select the **Scope** tab.
|
||||
|
||||
|
||||
|
||||
19. Select the target computers.
|
||||
|
||||
|
||||
|
||||
**Scope**<br>
|
||||
**Scope**
|
||||
|
||||
Select **Add**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**Self-Service** <br>
|
||||
**Self-Service**
|
||||
|
||||
|
||||
|
||||
20. Select **Done**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user