diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index dbb57c5791..39a4183c0e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -253,6 +253,10 @@ ##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) ##### [Set preferences](microsoft-defender-atp/mac-preferences.md) ##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +##### [Device control]() +###### [Device control overview](microsoft-defender-atp/mac-device-control-overview.md) +###### [JAMF examples](microsoft-defender-atp/mac-device-control-jamf.md) +###### [Intune examples](microsoft-defender-atp/mac-device-control-intune.md) ##### [Schedule scans](microsoft-defender-atp/mac-schedule-scan-atp.md) #### [Troubleshoot]() diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-1.png b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-1.png new file mode 100644 index 0000000000..fb946071db Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-1.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-2.png b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-2.png new file mode 100644 index 0000000000..2220e12523 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-2.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-3.png b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-3.png new file mode 100644 index 0000000000..51110a707c Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-3.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-4.png b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-4.png new file mode 100644 index 0000000000..ff9dafe040 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-lookup-4.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-notification.png b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-notification.png new file mode 100644 index 0000000000..af8250de77 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mac-device-control-notification.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-intune.md new file mode 100644 index 0000000000..8f77c8695b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-intune.md @@ -0,0 +1,426 @@ +--- +title: Examples of device control policies for Intune +description: Learn how to use device control policies using examples that can be used with Intune. +keywords: microsoft, defender, atp, mac, device, control, usb, removable, media, intune +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: security +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.topic: conceptual +ms.technology: mde +--- + +# Examples of device control policies for Intune + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Prerelease information](../../includes/prerelease.md)] + +This document contains examples of device control policies that you can customize for your own organization. These examples are applicable if you are using Intune to manage devices in your enterprise. + +## Restrict access to all removable media + +The following example restricts access to all removable media. Note the `none` permission that is applied at the top level of the policy, meaning that all file operations will be disallowed. + +```xml + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + none + + + + + + + +``` + +## Set all removable media to be read-only + +The following example configures all removable media to be read-only. Note the `read` permission that is applied at the top level of the policy, meaning that all write and execute operations will be disallowed. + +```xml + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + + + + + + + +``` + +## Disallow program execution from removable media + +The following example shows how program execution from removable media can be disallowed. Note the `read` and `write` permissions that are applied at the top level of the policy. + +```xml + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + write + + + + + + + +``` + +## Restrict all devices from specific vendors + +The following example restricts all devices from specific vendors (in this case identified by `fff0` and `4525`). All other devices will be unrestricted, since the permission defined at the top level of the policy lists all possible permissions (read, write, and execute). + +```xml + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + write + execute + + vendors + + fff0 + + permission + + none + + + 4525 + + permission + + none + + + + + + + + + +``` + +## Restrict specific devices identified by vendor ID, product ID, and serial number + +The following example restricts two specific devices, identified by vendor ID `fff0`, product ID `1000`, and serial numbers `04ZSSMHI2O7WBVOA` and `04ZSSMHI2O7WBVOB`. At all other levels of the policy the permissions include all possible values (read, write, and execute), meaning that all other devices will be unrestricted. + +```xml + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + write + execute + + vendors + + fff0 + + permission + + read + write + execute + + products + + 1000 + + permission + + read + write + execute + + serialNumbers + + 04ZSSMHI2O7WBVOA + + none + + 04ZSSMHI2O7WBVOB + + none + + + + + + + + + + + + +``` + +## Related topics + +- [Overview of device control for macOS](mac-device-control-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-jamf.md new file mode 100644 index 0000000000..a0dbbbf455 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-jamf.md @@ -0,0 +1,221 @@ +--- +title: Examples of device control policies for JAMF +description: Learn how to use device control policies using examples that can be used with JAMF. +keywords: microsoft, defender, endpoint, atp, mac, device, control, usb, removable, media, jamf +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: security +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.topic: conceptual +ms.technology: mde +--- + +# Examples of device control policies for JAMF + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Prerelease information](../../includes/prerelease.md)] + +This document contains examples of device control policies that you can customize for your own organization. These examples are applicable if you are using JAMF to manage devices in your enterprise. + +## Restrict access to all removable media + +The following example restricts access to all removable media. Note the `none` permission that is applied at the top level of the policy, meaning that all file operations will be prohibited. + +```xml + + + + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + none + + + + + +``` + +## Set all removable media to be read-only + +The following example configures all removable media to be read-only. Note the `read` permission that is applied at the top level of the policy, meaning that all write and execute operations will be disallowed. + +```xml + + + + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + + + + + +``` + +## Disallow program execution from removable media + +The following example shows how program execution from removable media can be disallowed. Note the `read` and `write` permissions that are applied at the top level of the policy. + +```xml + + + + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + write + + + + + +``` + +## Restrict all devices from specific vendors + +The following example restricts all devices from specific vendors (in this case identified by `fff0` and `4525`). All other devices will be unrestricted, since the permission defined at the top level of the policy lists all possible permissions (read, write, and execute). + +```xml + + + + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + write + execute + + vendors + + fff0 + + permission + + none + + + 4525 + + permission + + none + + + + + + + +``` + +## Restrict specific devices identified by vendor ID, product ID, and serial number + +The following example restricts two specific devices, identified by vendor ID `fff0`, product ID `1000`, and serial numbers `04ZSSMHI2O7WBVOA` and `04ZSSMHI2O7WBVOB`. At all other levels of the policy the permissions include all possible values (read, write, and execute), meaning that all other devices will be unrestricted. + +```xml + + + + + deviceControl + + removableMediaPolicy + + enforcementLevel + block + permission + + read + write + execute + + vendors + + fff0 + + permission + + read + write + execute + + products + + 1000 + + permission + + read + write + execute + + serialNumbers + + 04ZSSMHI2O7WBVOA + + none + + 04ZSSMHI2O7WBVOB + + none + + + + + + + + + + +``` + +## Related topics + +- [Overview of device control for macOS](mac-device-control-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-overview.md b/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-overview.md new file mode 100644 index 0000000000..f0445b47b4 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-device-control-overview.md @@ -0,0 +1,370 @@ +--- +title: Device control for macOS +description: Learn how to configure Microsoft Defender for Endpoint for Mac to reduce threats from removable storage such as USB devices. +keywords: microsoft, defender, atp, mac, device, control, usb, removable, media +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: security +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.topic: conceptual +ms.technology: mde +--- + +# Device control for macOS + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Prerelease information](../../includes/prerelease.md)] + +## Requirements + +Device control for macOS has the following prerequisites: + +>[!div class="checklist"] +> - Microsoft Defender for Endpoint entitlement (can be trial) +> - Minimum OS version: macOS 10.15.4 or higher +> - Minimum product version: 101.24.59 +> - Your device must be running with system extensions (this is the default on macOS 11 Big Sur). +> +> You can check if your device is running on system extensions by running the following command and verify that it is printing `endpoint_security_extension` to the console: +> +> ```bash +> mdatp health --field real_time_protection_subsystem +> ``` +> - Your device must be in `Beta` (previously called `InsiderFast`) Microsoft AutoUpdate update channel. For more information, see [Deploy updates for Microsoft Defender for Endpoint for Mac](mac-updates.md). +> +> You can check the update channel using the following command: +> +> ```bash +> mdatp health --field release_ring +> ``` +> +> If the above command does not print either `Beta` or `InsiderFast`, execute the following command from the Terminal. The channel update takes effect next time the product starts (when the next product update is installed or when the device is rebooted). +> +> ```bash +> defaults write com.microsoft.autoupdate2 ChannelName -string Beta +> ``` +> +> Alternatively, if you are in a managed environment (JAMF or Intune), you can configure the update channel remotely. For more information, see [Deploy updates for Microsoft Defender for Endpoint for Mac](mac-updates.md). + +## Device control policy + +To configure device control for macOS, you must create a policy that describes the restrictions you want to put in place within your organization. + +The device control policy is included in the configuration profile used to configure all other product settings. For more information, see [Configuration profile structure](mac-preferences.md#configuration-profile-structure). + +Within the configuration profile, the device control policy is defined in the following section: + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | deviceControl | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +The device control policy can be used to: + +- [Customize the URL target for notifications raised by device control](#customize-url-target-for-notifications-raised-by-device-control) +- [Allow or block removable devices](#allow-or-block-removable-devices) + +### Customize URL target for notifications raised by device control + +When the device control policy that you have put in place is enforced on a device (for example, access to a removable media device is restricted), a notification is displayed to the user. + +![Device control notification](images/mac-device-control-notification.png) + +When end users click this notification, a web page is opened in the default browser. You can configure the URL that is opened when end users click the notification. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | navigationTarget | +| **Data type** | String | +| **Comments** | If not defined, the product uses a default URL pointing to a generic page explaining the action taken by the product. | + +### Allow or block removable devices + +The removable media section of the device control policy is used to restrict access to removable media. + +> [!NOTE] +> The following types of removable media are currently supported and can be included in the policy: USB storage devices. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | removableMediaPolicy | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +This section of the policy is hierarchical, allowing for maximum flexibility and covering a wide range of use cases. At the top level are vendors, identified by a vendor ID. For each vendor, there are products, identified by a product ID. Finally, for each product there are serial numbers denoting specific devices. + +``` +|-- policy top level + |-- vendor 1 + |-- product 1 + |-- serial number 1 + ... + |-- serial number N + ... + |-- product N + ... + |-- vendor N +``` + +For information on how to find the device identifiers, see [Look up device identifiers](#look-up-device-identifiers). + +The policy is evaluated from the most specific entry to the most general one. Meaning, when a device is plugged in, the product tries to find the most specific match in the policy for each removable media device and apply the permissions at that level. If there is no match, then the next best match is applied, all the way to the permission specified at the top level, which is the default when a device does not match any other entry in the policy. + +#### Policy enforcement level + +Under the removable media section, there is an option to set the enforcement level, which can take one of the following values: + +- `audit` - Under this enforcement level, if access to a device is restricted, a notification is displayed to the user, however the device can still be used. This enforcement level can be useful to evaluate the effectiveness of a policy. +- `block` - Under this enforcement level, the operations that the user can perform on the device are limited to what is defined in the policy. Furthermore, a notification is raised to the user. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | enforcementLevel | +| **Data type** | String | +| **Possible values** | audit (default)
block | + +#### Default permission level + +At the top level of the removable media section, you can configure the default permission level for devices that do not match anything else in the policy. + +This setting can be set to: + +- `none` - No operations can be performed on the device +- A combination of the following values: + - `read` - Read operations are permitted on the device + - `write` - Write operations are permitted on the device + - `execute` - Execute operations are permitted on the device + +> [!NOTE] +> If `none` is present in the permission level, any other permissions (`read`, `write`, or `execute`) will be ignored. + +> [!NOTE] +> The `execute` permission only refers to execution of Mach-O binaries. It does not include execution of scripts or other types of payloads. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | permission | +| **Data type** | Array of strings | +| **Possible values** | none
read
write
execute | + +#### Restrict removable media by vendor, product, and serial number + +As described in [Allow or block removable devices](#allow-or-block-removable-devices), removable media such as USB devices can be identified by the vendor ID, product ID, and serial number. + +At the top level of the removable media policy, you can optionally define more granular restrictions at the vendor level. + +The `vendors` dictionary contains one or more entries, with each entry being identified by the vendor ID. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | vendors | +| **Data type** | Dictionary (nested preference) | + +For each vendor, you can specify the desired permission level for devices from that vendor. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | permission | +| **Data type** | Array of strings | +| **Possible values** | Same as [Default permission level](#default-permission-level) | + +Furthermore, you can optionally specify the set of products belonging to that vendor for which more granular permissions are defined. The `products` dictionary contains one or more entries, with each entry being identified by the product ID. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | products | +| **Data type** | Dictionary (nested preference) | + +For each product, you can specify the desired permission level for that product. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | permission | +| **Data type** | Array of strings | +| **Possible values** | Same as [Default permission level](#default-permission-level) | + +Furthermore, you can specify an optional set of serial numbers for which more granular permissions are defined. + +The `serialNumbers` dictionary contains one or more entries, with each entry being identified by the serial number. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | serialNumbers | +| **Data type** | Dictionary (nested preference) | + +For each serial number, you can specify the desired permission level. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | permission | +| **Data type** | Array of strings | +| **Possible values** | Same as [Default permission level](#default-permission-level) | + +#### Example device control policy + +The following example shows how all of the above concepts can be combined into a device control policy. In the following example, note the hierarchical nature of the removable media policy. + +```xml + + + + + deviceControl + + navigationTarget + [custom URL for notifications] + removableMediaPolicy + + enforcementLevel + [enforcement level] + permission + + [permission] + + + vendors + + [vendor id] + + permission + + [permission] + + + products + + [product id] + + permission + + [permission] + + + serialNumbers + + [serial-number] + + [permission] + + + + + + + + + + + + + + +``` + +We have included more examples of device control policies in the following documents: + +- [Examples of device control policies for Intune](mac-device-control-intune.md) +- [Examples of device control policies for JAMF](mac-device-control-jamf.md) + +#### Look up device identifiers + +To find the vendor ID, product ID, and serial number of a USB device: + +1. Log into a Mac device. +1. Plug in the USB device for which you want to look up the identifiers. +1. In the top-level menu of macOS, select **About This Mac**. + + ![About this Mac](images/mac-device-control-lookup-1.png) + +1. Select **System Report**. + + ![System Report](images/mac-device-control-lookup-2.png) + +1. From the left column, select **USB**. + + ![View of all USB devices](images/mac-device-control-lookup-3.png) + +1. Under **USB Device Tree**, navigate to the USB device that you plugged in. + + ![Details of a USB device](images/mac-device-control-lookup-4.png) + +1. The vendor ID, product ID, and serial number are displayed. When adding the vendor ID and product ID to the removable media policy, you must only add the part after `0x`. For example, in the below image, vendor ID is `1000` and product ID is `090c`. + +#### Discover USB devices in your organization + +You can view mount, unmount, and volume change events originating from USB devices in Microsoft Defender for Endpoint advanced hunting. These events can be helpful to identify suspicious usage activity or perform internal investigations. + +``` +DeviceEvents + | where ActionType == "UsbDriveMount" or ActionType == "UsbDriveUnmount" or ActionType == "UsbDriveDriveLetterChanged" + | where DeviceId == "" +``` + +## Device control policy deployment + +The device control policy must be included next to the other product settings, as described in [Set preferences for Microsoft Defender for Endpoint for Mac](mac-preferences.md). + +This profile can be deployed using the instructions listed in [Configuration profile deployment](mac-preferences.md#configuration-profile-deployment). + +## Troubleshooting tips + +After pushing the configuration profile through Intune or JAMF, you can check if it was successfully picked up by the product by running the following command from the Terminal: + +```bash +mdatp device-control removable-media policy list +``` + +This command will print to standard output the device control policy that the product is using. In case this prints `Policy is empty`, make sure that (a) the configuration profile has indeed been pushed to your device from the management console, and (b) it is a valid device control policy, as described in this document. + +On a device where the policy has been delivered successfully and where there are one or more devices plugged in, you can run the following command to list all devices and the effective permissions applied to them. + +```bash +mdatp device-control removable-media devices list +``` + +Example of output: + +```Output +.Device(s) +|-o Name: Untitled 1, Permission ["read", "execute"] +| |-o Vendor: General "fff0" +| |-o Product: USB Flash Disk "1000" +| |-o Serial number: "04ZSSMHI2O7WBVOA" +| |-o Mount point: "/Volumes/TESTUSB" +``` + +In the above example, there is only one removable media device plugged in and it has `read` and `execute` permissions, according to the device control policy that was delivered to the device. + +## Related topics + +- [Examples of device control policies for Intune](mac-device-control-intune.md) +- [Examples of device control policies for JAMF](mac-device-control-jamf.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-policies.md b/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-policies.md index 7fdbbda41d..5b920aba75 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-policies.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-policies.md @@ -75,12 +75,12 @@ You'll need to take the following steps: 1. Locate the file `WindowsDefenderATPOnboarding.plist` from the previous section. - ![Image of file](images/plist-onboarding-file.png) + ![Image of WindowsDefenderATPOnboarding file](images/plist-onboarding-file.png) 2. In the Jamf Pro dashboard, select **New**. - ![Image of Jamf Pro dashboard](images/jamf-pro-configure-profile.png) + ![Image of creating a new Jamf Pro dashboard](images/jamf-pro-configure-profile.png) 3. Enter the following details: @@ -93,13 +93,13 @@ You'll need to take the following steps: 4. In **Application & Custom Settings** select **Configure**. - ![Image of configuration profile](images/jamfpro-mac-profile.png) + ![Image of configurate app and custom settings](images/jamfpro-mac-profile.png) 5. Select **Upload File (PLIST file)** then in **Preference Domain** enter: `com.microsoft.wdav.atp`. - ![Image of upload file](images/jamfpro-plist-upload.png) + ![Image of jamfpro plist upload file](images/jamfpro-plist-upload.png) - ![Image of upload file](images/jamfpro-plist-file.png) + ![Image of upload file property List file](images/jamfpro-plist-file.png) 7. Select **Open** and select the onboarding file. @@ -118,17 +118,17 @@ You'll need to take the following steps: ![Image of target computers](images/jamfpro-target-computer.png) - ![Image of target computers](images/jamfpro-targets.png) + ![Image of targets](images/jamfpro-targets.png) 11. Select **Save**. - ![Image of target computers](images/jamfpro-deployment-target.png) + ![Image of deployment target computers](images/jamfpro-deployment-target.png) ![Image of target computers selected](images/jamfpro-target-selected.png) 12. Select **Done**. - ![Image of target computers](images/jamfpro-target-group.png) + ![Image of target group computers](images/jamfpro-target-group.png) ![List of configuration profiles](images/jamfpro-configuration-policies.png) @@ -268,7 +268,7 @@ You'll need to take the following steps: 3. In the Jamf Pro dashboard, select **General**. - ![Image of Jamf Pro dashboard](images/644e0f3af40c29e80ca1443535b2fe32.png) + ![Image of the new Jamf Pro dashboard](images/644e0f3af40c29e80ca1443535b2fe32.png) 4. Enter the following details: @@ -280,64 +280,64 @@ You'll need to take the following steps: - Distribution Method: Install Automatically(default) - Level: Computer Level(default) - ![Image of configuration settings](images/3160906404bc5a2edf84d1d015894e3b.png) + ![Image of MDATP MDAV configuration settings](images/3160906404bc5a2edf84d1d015894e3b.png) 5. In **Application & Custom Settings** select **Configure**. - ![Image of configuration settings](images/e1cc1e48ec9d5d688087b4d771e668d2.png) + ![Image of app and custom settings](images/e1cc1e48ec9d5d688087b4d771e668d2.png) 6. Select **Upload File (PLIST file)**. - ![Image of configuration settings](images/6f85269276b2278eca4bce84f935f87b.png) + ![Image of configuration settings plist file](images/6f85269276b2278eca4bce84f935f87b.png) 7. In **Preferences Domain**, enter `com.microsoft.wdav`, then select **Upload PLIST File**. - ![Image of configuration settings](images/db15f147dd959e872a044184711d7d46.png) + ![Image of configuration settings preferences domain](images/db15f147dd959e872a044184711d7d46.png) 8. Select **Choose File**. - ![Image of configuration settings](images/526e978761fc571cca06907da7b01fd6.png) + ![Image of configuration settings choose file](images/526e978761fc571cca06907da7b01fd6.png) 9. Select the **MDATP_MDAV_configuration_settings.plist**, then select **Open**. - ![Image of configuration settings](images/98acea3750113b8dbab334296e833003.png) + ![Image of mdatpmdav configuration settings](images/98acea3750113b8dbab334296e833003.png) 10. Select **Upload**. - ![Image of configuration settings](images/0adb21c13206861ba9b30a879ade93d3.png) + ![Image of configuration setting upload](images/0adb21c13206861ba9b30a879ade93d3.png) - ![Image of configuration settings](images/f624de59b3cc86e3e2d32ae5de093e02.png) + ![Image of configuration settings upload image](images/f624de59b3cc86e3e2d32ae5de093e02.png) >[!NOTE] >If you happen to upload the Intune file, you'll get the following error:
- >![Image of configuration settings](images/8e69f867664668796a3b2904896f0436.png) + >![Image of configuration settings intune file upload](images/8e69f867664668796a3b2904896f0436.png) 11. Select **Save**. - ![Image of configuration settings](images/1b6b5a4edcb42d97f1e70a6a0fa48e3a.png) + ![Image of configuration settings Save image](images/1b6b5a4edcb42d97f1e70a6a0fa48e3a.png) 12. The file is uploaded. - ![Image of configuration settings](images/33e2b2a1611fdddf6b5b79e54496e3bb.png) + ![Image of configuration settings file uploaded image](images/33e2b2a1611fdddf6b5b79e54496e3bb.png) - ![Image of configuration settings](images/a422e57fe8d45689227e784443e51bd1.png) + ![Image of configuration settings file uploaded](images/a422e57fe8d45689227e784443e51bd1.png) 13. Select the **Scope** tab. - ![Image of configuration settings](images/9fc17529e5577eefd773c658ec576a7d.png) + ![Image of configuration settings scope](images/9fc17529e5577eefd773c658ec576a7d.png) 14. Select **Contoso's Machine Group**. 15. Select **Add**, then select **Save**. - ![Image of configuration settings](images/cf30438b5512ac89af1d11cbf35219a6.png) + ![Image of configuration settings addsav](images/cf30438b5512ac89af1d11cbf35219a6.png) - ![Image of configuration settings](images/6f093e42856753a3955cab7ee14f12d9.png) + ![Image of configuration settings save add](images/6f093e42856753a3955cab7ee14f12d9.png) 16. Select **Done**. You'll see the new **Configuration profile**. - ![Image of configuration settings](images/dd55405106da0dfc2f50f8d4525b01c8.png) + ![Image of configuration settings config profile image](images/dd55405106da0dfc2f50f8d4525b01c8.png) ## Step 4: Configure notifications settings @@ -360,45 +360,45 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. - Distribution Method: Install Automatically(default) - Level: Computer Level(default) - ![Image of configuration settings](images/c9820a5ff84aaf21635c04a23a97ca93.png) + ![Image of configuration settings mdatpmdav](images/c9820a5ff84aaf21635c04a23a97ca93.png) 5. Select **Upload File (PLIST file)**. - ![Image of configuration settings](images/7f9138053dbcbf928e5182ee7b295ebe.png) + ![Image of configuration settings upload plistfile](images/7f9138053dbcbf928e5182ee7b295ebe.png) 6. Select **Choose File** > **MDATP_MDAV_Notification_Settings.plist**. - ![Image of configuration settings](images/4bac6ce277aedfb4a674f2d9fcb2599a.png) + ![Image of configuration settings mdatpmdav notsettings](images/4bac6ce277aedfb4a674f2d9fcb2599a.png) - ![Image of configuration settings](images/20e33b98eb54447881dc6c89e58b890f.png) + ![Image of configuration settings mdatpmdav notifsettings](images/20e33b98eb54447881dc6c89e58b890f.png) 7. Select **Open** > **Upload**. - ![Image of configuration settings](images/7697c33b9fd376ae5a8023d01f9d3857.png) + ![Image of configuration settings upl img](images/7697c33b9fd376ae5a8023d01f9d3857.png) - ![Image of configuration settings](images/2bda9244ec25d1526811da4ea91b1c86.png) + ![Image of configuration settings upl image](images/2bda9244ec25d1526811da4ea91b1c86.png) 8. Select the **Scope** tab, then select **Add**. - ![Image of configuration settings](images/441aa2ecd36abadcdd8aed03556080b5.png) + ![Image of configuration settings scope add](images/441aa2ecd36abadcdd8aed03556080b5.png) 9. Select **Contoso's Machine Group**. 10. Select **Add**, then select **Save**. - ![Image of configuration settings](images/09a275e321268e5e3ac0c0865d3e2db5.png) + ![Image of configuration settings contoso machine grp save](images/09a275e321268e5e3ac0c0865d3e2db5.png) - ![Image of configuration settings](images/4d2d1d4ee13d3f840f425924c3df0d51.png) + ![Image of configuration settings add save](images/4d2d1d4ee13d3f840f425924c3df0d51.png) 11. Select **Done**. You'll see the new **Configuration profile**. - ![Image of configuration setting](images/633ad26b8bf24ec683c98b2feb884bdf.png) + ![Image of configuration setting done img](images/633ad26b8bf24ec683c98b2feb884bdf.png) ## Step 5: Configure Microsoft AutoUpdate (MAU) @@ -410,7 +410,7 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. ChannelName - Production + Current HowToCheck AutomaticDownload EnableCheckForUpdatesButton @@ -427,7 +427,7 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 3. In the Jamf Pro dashboard, select **General**. - ![Image of configuration setting](images/eaba2a23dd34f73bf59e826217ba6f15.png) + ![Image of configuration setting general image](images/eaba2a23dd34f73bf59e826217ba6f15.png) 4. Enter the following details: @@ -441,54 +441,54 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 5. In **Application & Custom Settings** select **Configure**. - ![Image of configuration setting](images/1f72e9c15eaafcabf1504397e99be311.png) + ![Image of configuration setting app and custom settings](images/1f72e9c15eaafcabf1504397e99be311.png) 6. Select **Upload File (PLIST file)**. - ![Image of configuration setting](images/1213872db5833aa8be535da57653219f.png) + ![Image of configuration setting plist](images/1213872db5833aa8be535da57653219f.png) 7. In **Preference Domain** enter: `com.microsoft.autoupdate2`, then select **Upload PLIST File**. - ![Image of configuration setting](images/1213872db5833aa8be535da57653219f.png) + ![Image of configuration setting pref domain](images/1213872db5833aa8be535da57653219f.png) 8. Select **Choose File**. - ![Image of configuration setting](images/335aff58950ce62d1dabc289ecdce9ed.png) + ![Image of configuration setting choosefile](images/335aff58950ce62d1dabc289ecdce9ed.png) 9. Select **MDATP_MDAV_MAU_settings.plist**. - ![Image of configuration setting](images/a26bd4967cd54bb113a2c8d32894c3de.png) + ![Image of configuration setting mdatpmdavmau settings](images/a26bd4967cd54bb113a2c8d32894c3de.png) 10. Select **Upload**. - ![Image of configuration setting](images/4239ca0528efb0734e4ca0b490bfb22d.png) + ![Image of configuration setting uplimage](images/4239ca0528efb0734e4ca0b490bfb22d.png) - ![Image of configuration setting](images/4ec20e72c8aed9a4c16912e01692436a.png) + ![Image of configuration setting uplimg](images/4ec20e72c8aed9a4c16912e01692436a.png) 11. Select **Save**. - ![Image of configuration setting](images/253274b33e74f3f5b8d475cf8692ce4e.png) + ![Image of configuration setting saveimg](images/253274b33e74f3f5b8d475cf8692ce4e.png) 12. Select the **Scope** tab. - ![Image of configuration setting](images/10ab98358b2d602f3f67618735fa82fb.png) + ![Image of configuration setting scopetab](images/10ab98358b2d602f3f67618735fa82fb.png) 13. Select **Add**. - ![Image of configuration setting](images/56e6f6259b9ce3c1706ed8d666ae4947.png) + ![Image of configuration setting addimg1](images/56e6f6259b9ce3c1706ed8d666ae4947.png) - ![Image of configuration setting](images/38c67ee1905c4747c3b26c8eba57726b.png) + ![Image of configuration setting addimg2](images/38c67ee1905c4747c3b26c8eba57726b.png) - ![Image of configuration setting](images/321ba245f14743c1d5d51c15e99deecc.png) + ![Image of configuration setting addimg3](images/321ba245f14743c1d5d51c15e99deecc.png) 14. Select **Done**. - ![Image of configuration setting](images/ba44cdb77e4781aa8b940fb83e3c21f7.png) + ![Image of configuration setting doneimage](images/ba44cdb77e4781aa8b940fb83e3c21f7.png) ## Step 6: Grant full disk access to Microsoft Defender for Endpoint 1. In the Jamf Pro dashboard, select **Configuration Profiles**. - ![Image of configuration setting](images/264493cd01e62c7085659d6fdc26dc91.png) + ![Image of configuration setting config profile](images/264493cd01e62c7085659d6fdc26dc91.png) 2. Select **+ New**. @@ -502,11 +502,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. - Level: Computer level - ![Image of configuration setting](images/ba3d40399e1a6d09214ecbb2b341923f.png) + ![Image of configuration setting general](images/ba3d40399e1a6d09214ecbb2b341923f.png) 4. In **Configure Privacy Preferences Policy Control** select **Configure**. - ![Image of configuration setting](images/715ae7ec8d6a262c489f94d14e1e51bb.png) + ![Image of configuration privacy policy control](images/715ae7ec8d6a262c489f94d14e1e51bb.png) 5. In **Privacy Preferences Policy Control**, enter the following details: @@ -515,11 +515,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. - Code Requirement: `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9` - ![Image of configuration setting](images/22cb439de958101c0a12f3038f905b27.png) + ![Image of configuration setting privacy preference policy control details](images/22cb439de958101c0a12f3038f905b27.png) 6. Select **+ Add**. - ![Image of configuration setting](images/bd93e78b74c2660a0541af4690dd9485.png) + ![Image of configuration setting add system policy all files](images/bd93e78b74c2660a0541af4690dd9485.png) - Under App or service: Set to **SystemPolicyAllFiles** @@ -527,11 +527,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 7. Select **Save** (not the one at the bottom right). - ![Image of configuration setting](images/6de50b4a897408ddc6ded56a09c09fe2.png) + ![Image of configuration setting save images](images/6de50b4a897408ddc6ded56a09c09fe2.png) 8. Click the `+` sign next to **App Access** to add a new entry. - ![Image of configuration setting](images/tcc-add-entry.png) + ![Image of configuration setting app access](images/tcc-add-entry.png) 9. Enter the following details: @@ -541,7 +541,7 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 10. Select **+ Add**. - ![Image of configuration setting](images/tcc-epsext-entry.png) + ![Image of configuration setting tcc epsext entry](images/tcc-epsext-entry.png) - Under App or service: Set to **SystemPolicyAllFiles** @@ -549,19 +549,19 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 11. Select **Save** (not the one at the bottom right). - ![Image of configuration setting](images/tcc-epsext-entry2.png) + ![Image of configuration setting tcc epsext image2](images/tcc-epsext-entry2.png) 12. Select the **Scope** tab. - ![Image of configuration setting](images/2c49b16cd112729b3719724f581e6882.png) + ![Image of configuration setting scope](images/2c49b16cd112729b3719724f581e6882.png) 13. Select **+ Add**. - ![Image of configuration setting](images/57cef926d1b9260fb74a5f460cee887a.png) + ![Image of configuration setting addimage](images/57cef926d1b9260fb74a5f460cee887a.png) 14. Select **Computer Groups** > under **Group Name** > select **Contoso's MachineGroup**. - ![Image of configuration setting](images/368d35b3d6179af92ffdbfd93b226b69.png) + ![Image of configuration setting contoso machinegrp](images/368d35b3d6179af92ffdbfd93b226b69.png) 15. Select **Add**. @@ -569,9 +569,9 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 17. Select **Done**. - ![Image of configuration setting](images/809cef630281b64b8f07f20913b0039b.png) + ![Image of configuration setting donimg](images/809cef630281b64b8f07f20913b0039b.png) - ![Image of configuration setting](images/6c8b406ee224335a8c65d06953dc756e.png) + ![Image of configuration setting donimg2](images/6c8b406ee224335a8c65d06953dc756e.png) ## Step 7: Approve Kernel extension for Microsoft Defender for Endpoint @@ -590,11 +590,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. - Distribution Method: Install Automatically - Level: Computer Level - ![Image of configuration settings](images/24e290f5fc309932cf41f3a280d22c14.png) + ![Image of configuration settings mdatpmdav kernel](images/24e290f5fc309932cf41f3a280d22c14.png) 3. In **Configure Approved Kernel Extensions** select **Configure**. - ![Image of configuration settings](images/30be88b63abc5e8dde11b73f1b1ade6a.png) + ![Image of configuration settings approved kernel ext](images/30be88b63abc5e8dde11b73f1b1ade6a.png) 4. In **Approved Kernel Extensions** Enter the following details: @@ -602,11 +602,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. - Display Name: Microsoft Corp. - Team ID: UBF8T346G9 - ![Image of configuration settings](images/39cf120d3ac3652292d8d1b6d057bd60.png) + ![Image of configuration settings appr kernel extension](images/39cf120d3ac3652292d8d1b6d057bd60.png) 5. Select the **Scope** tab. - ![Image of configuration settings](images/0df36fc308ba569db204ee32db3fb40a.png) + ![Image of configuration settings scope tab img](images/0df36fc308ba569db204ee32db3fb40a.png) 6. Select **+ Add**. @@ -614,15 +614,15 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 8. Select **+ Add**. - ![Image of configuration settings](images/0dde8a4c41110dbc398c485433a81359.png) + ![Image of configuration settings add images](images/0dde8a4c41110dbc398c485433a81359.png) 9. Select **Save**. - ![Image of configuration settings](images/0add8019b85a453b47fa5c402c72761b.png) + ![Image of configuration settings saveimag](images/0add8019b85a453b47fa5c402c72761b.png) 10. Select **Done**. - ![Image of configuration settings](images/1c9bd3f68db20b80193dac18f33c22d0.png) + ![Image of configuration settings doneimag](images/1c9bd3f68db20b80193dac18f33c22d0.png) ## Step 8: Approve System extensions for Microsoft Defender for Endpoint @@ -641,11 +641,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. - Distribution Method: Install Automatically - Level: Computer Level - ![Image of configuration settings](images/sysext-new-profile.png) + ![Image of configuration settings sysext new prof](images/sysext-new-profile.png) 3. In **System Extensions** select **Configure**. - ![Image of configuration settings](images/sysext-configure.png) + ![Image of configuration settings sysext config](images/sysext-configure.png) 4. In **System Extensions** enter the following details: @@ -656,11 +656,11 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. - **com.microsoft.wdav.epsext** - **com.microsoft.wdav.netext** - ![Image of configuration settings](images/sysext-configure2.png) + ![Image of configuration settings sysextconfig2](images/sysext-configure2.png) 5. Select the **Scope** tab. - ![Image of configuration settings](images/0df36fc308ba569db204ee32db3fb40a.png) + ![Image of configuration settings scopeimage](images/0df36fc308ba569db204ee32db3fb40a.png) 6. Select **+ Add**. @@ -668,15 +668,15 @@ These steps are applicable of macOS 10.15 (Catalina) or newer. 8. Select **+ Add**. - ![Image of configuration settings](images/0dde8a4c41110dbc398c485433a81359.png) + ![Image of configuration settings addima](images/0dde8a4c41110dbc398c485433a81359.png) 9. Select **Save**. - ![Image of configuration settings](images/sysext-scope.png) + ![Image of configuration settings sysext scope](images/sysext-scope.png) 10. Select **Done**. - ![Image of configuration settings](images/sysext-final.png) + ![Image of configuration settings sysext-final](images/sysext-final.png) ## Step 9: Configure Network Extension @@ -704,19 +704,19 @@ As part of the Endpoint Detection and Response capabilities, Microsoft Defender 5. Select **Choose File** and select `microsoft.network-extension.signed.mobileconfig`. - ![Image of upload window](images/netext-choose-file.png) + ![Image of upload window netext choose file](images/netext-choose-file.png) 6. Select **Upload**. - ![Image of upload window](images/netext-upload-file2.png) + ![Image of upload window netext upload file2](images/netext-upload-file2.png) 7. After uploading the file, you are redirected to a new page to finalize the creation of this profile. - ![Image of new configuration profile](images/netext-profile-page.png) + ![Image of new configuration profile netext profile page](images/netext-profile-page.png) 8. Select the **Scope** tab. - ![Image of configuration settings](images/0df36fc308ba569db204ee32db3fb40a.png) + ![Image of configuration settings sco tab](images/0df36fc308ba569db204ee32db3fb40a.png) 9. Select **+ Add**. @@ -724,15 +724,15 @@ As part of the Endpoint Detection and Response capabilities, Microsoft Defender 11. Select **+ Add**. - ![Image of configuration settings](images/0dde8a4c41110dbc398c485433a81359.png) + ![Image of configuration settings adim](images/0dde8a4c41110dbc398c485433a81359.png) 12. Select **Save**. - ![Image of configuration settings](images/netext-scope.png) + ![Image of configuration settings savimg netextscop](images/netext-scope.png) 13. Select **Done**. - ![Image of configuration settings](images/netext-final.png) + ![Image of configuration settings netextfinal](images/netext-final.png) ## Step 10: Schedule scans with Microsoft Defender for Endpoint for Mac Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint for Mac](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp). @@ -741,22 +741,22 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint 1. Navigate to where you saved `wdav.pkg`. - ![Image of file explorer](images/8dde76b5463047423f8637c86b05c29d.png) + ![Image of file explorer wdav pkg](images/8dde76b5463047423f8637c86b05c29d.png) 2. Rename it to `wdav_MDM_Contoso_200329.pkg`. - ![Image of file explorer](images/fb2220fed3a530f4b3ef36f600da0c27.png) + ![Image of file explorer1 wdavmdmpkg](images/fb2220fed3a530f4b3ef36f600da0c27.png) 3. Open the Jamf Pro dashboard. - ![Image of configuration settings](images/990742cd9a15ca9fdd37c9f695d1b9f4.png) + ![Image of configuration settings jamfpro](images/990742cd9a15ca9fdd37c9f695d1b9f4.png) 4. Select your computer and click the gear icon at the top, then select **Computer Management**. - ![Image of configuration settings](images/b6d671b2f18b89d96c1c8e2ea1991242.png) + ![Image of configuration settings compmgmt](images/b6d671b2f18b89d96c1c8e2ea1991242.png) 5. In **Packages**, select **+ New**. - ![A picture containing bird Description automatically generated](images/57aa4d21e2ccc65466bf284701d4e961.png) + ![A picture containing bird Description automatically generated package new](images/57aa4d21e2ccc65466bf284701d4e961.png) 6. In **New Package** Enter the following details: @@ -765,7 +765,7 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint - Category: None (default) - Filename: Choose File - ![Image of configuration settings](images/21de3658bf58b1b767a17358a3f06341.png) + ![Image of configuration settings general tab](images/21de3658bf58b1b767a17358a3f06341.png) Open the file and point it to `wdav.pkg` or `wdav_MDM_Contoso_200329.pkg`. @@ -779,75 +779,75 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint **Limitations tab**
Keep default values. - ![Image of configuration settings](images/56dac54634d13b2d3948ab50e8d3ef21.png) + ![Image of configuration settings limitation tab](images/56dac54634d13b2d3948ab50e8d3ef21.png) 8. Select **Save**. The package is uploaded to Jamf Pro. - ![Image of configuration settings](images/33f1ecdc7d4872555418bbc3efe4b7a3.png) + ![Image of configuration settings pack upl jamf pro](images/33f1ecdc7d4872555418bbc3efe4b7a3.png) It can take a few minutes for the package to be available for deployment. - ![Image of configuration settings](images/1626d138e6309c6e87bfaab64f5ccf7b.png) + ![Image of configuration settings pack upl](images/1626d138e6309c6e87bfaab64f5ccf7b.png) 9. Navigate to the **Policies** page. - ![Image of configuration settings](images/f878f8efa5ebc92d069f4b8f79f62c7f.png) + ![Image of configuration settings polocies](images/f878f8efa5ebc92d069f4b8f79f62c7f.png) 10. Select **+ New** to create a new policy. - ![Image of configuration settings](images/847b70e54ed04787e415f5180414b310.png) + ![Image of configuration settings new policy](images/847b70e54ed04787e415f5180414b310.png) 11. In **General** Enter the following details: - Display name: MDATP Onboarding Contoso 200329 v100.86.92 or later - ![Image of configuration settings](images/625ba6d19e8597f05e4907298a454d28.png) + ![Image of configuration settingsmdatponboard ](images/625ba6d19e8597f05e4907298a454d28.png) 12. Select **Recurring Check-in**. - ![Image of configuration settings](images/68bdbc5754dfc80aa1a024dde0fce7b0.png) + ![Image of configuration settings recur checkin](images/68bdbc5754dfc80aa1a024dde0fce7b0.png) 13. Select **Save**. 14. Select **Packages > Configure**. - ![Image of configuration settings](images/8fb4cc03721e1efb4a15867d5241ebfb.png) + ![Image of configuration settings pack configure](images/8fb4cc03721e1efb4a15867d5241ebfb.png) 15. Select the **Add** button next to **Microsoft Defender Advanced Threat Protection and Microsoft Defender Antivirus**. - ![Image of configuration settings](images/526b83fbdbb31265b3d0c1e5fbbdc33a.png) + ![Image of configuration settings MDATP and MDA add](images/526b83fbdbb31265b3d0c1e5fbbdc33a.png) 16. Select **Save**. - ![Image of configuration settings](images/9d6e5386e652e00715ff348af72671c6.png) + ![Image of configuration settingssavimg](images/9d6e5386e652e00715ff348af72671c6.png) 17. Select the **Scope** tab. - ![Image of configuration settings](images/8d80fe378a31143db9be0bacf7ddc5a3.png) + ![Image of configuration settings scptab](images/8d80fe378a31143db9be0bacf7ddc5a3.png) 18. Select the target computers. - ![Image of configuration settings](images/6eda18a64a660fa149575454e54e7156.png) + ![Image of configuration settings tgtcomp](images/6eda18a64a660fa149575454e54e7156.png) **Scope** Select **Add**. - ![Image of configuration settings](images/1c08d097829863778d562c10c5f92b67.png) + ![Image of configuration settings ad1img](images/1c08d097829863778d562c10c5f92b67.png) - ![Image of configuration settings](images/216253cbfb6ae738b9f13496b9c799fd.png) + ![Image of configuration settings ad2img](images/216253cbfb6ae738b9f13496b9c799fd.png) **Self-Service** - ![Image of configuration settings](images/c9f85bba3e96d627fe00fc5a8363b83a.png) + ![Image of configuration settings selfservice](images/c9f85bba3e96d627fe00fc5a8363b83a.png) 19. Select **Done**. - ![Image of configuration settings](images/99679a7835b0d27d0a222bc3fdaf7f3b.png) + ![Image of configuration settings do1img](images/99679a7835b0d27d0a222bc3fdaf7f3b.png) - ![Image of configuration settings](images/632aaab79ae18d0d2b8e0c16b6ba39e2.png) + ![Image of configuration settings do2img](images/632aaab79ae18d0d2b8e0c16b6ba39e2.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md index 57c75b7e1f..2dcc5842d6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md @@ -55,7 +55,7 @@ These steps assume you already have Defender for Endpoint running on your device If your device isn't already in the Insider Fast update channel, execute the following command from the Terminal. The channel update takes effect the next time the product starts (when the next product update is installed, or when the device is rebooted). ```bash - defaults write com.microsoft.autoupdate2 ChannelName -string InsiderFast + defaults write com.microsoft.autoupdate2 ChannelName -string Beta ``` Alternatively, if you're in a managed environment (JAMF or Intune), you can configure the update channel remotely. For more information, see [Deploy updates for Microsoft Defender ATP for Mac: Set the channel name](mac-updates.md#set-the-channel-name). diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md index 518755e4a6..c0e133184e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-updates.md @@ -57,19 +57,27 @@ This section describes the most common preferences that can be used to configure ### Set the channel name -The channel determines the type and frequency of updates that are offered through MAU. Devices in `InsiderFast` (corresponding to the Insider Fast channel) can try out new features before devices in `External` (corresponding to the Insider Slow channel) and `Production`. +The channel determines the type and frequency of updates that are offered through MAU. Devices in `Beta` can try out new features before devices in `Preview` and `Current`. -The `Production` channel contains the most stable version of the product. +The `Current` channel contains the most stable version of the product. + +>[!IMPORTANT] +> Prior to Microsoft AutoUpdate version 4.29, channels had different names: +> +> - `Beta` was named `InsiderFast` (Insider Fast) +> - `Preview` was named `External` (Insider Slow) +> - `Current` was named `Production` >[!TIP] ->In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to `InsiderFast` or `External`. +>In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to `Beta` or `Preview`. ||| -|:---|:---| +|:--|:--| | **Domain** | com.microsoft.autoupdate2 | | **Key** | ChannelName | | **Data type** | String | -| **Possible values** | InsiderFast
External
Production | +| **Possible values** | Beta
Preview
Current | +||| >[!WARNING] >This setting changes the channel for all applications that are updated through Microsoft AutoUpdate. To change the channel only for Microsoft Defender for Endpoint for Mac, execute the following command after replacing `[channel-name]` with the desired channel: @@ -82,62 +90,67 @@ The `Production` channel contains the most stable version of the product. Change how often MAU searches for updates. ||| -|:---|:---| +|:--|:--| | **Domain** | com.microsoft.autoupdate2 | | **Key** | UpdateCheckFrequency | | **Data type** | Integer | | **Default value** | 720 (minutes) | | **Comment** | This value is set in minutes. | +||| ### Change how MAU interacts with updates Change how MAU searches for updates. ||| -|:---|:---| +|:--|:--| | **Domain** | com.microsoft.autoupdate2 | | **Key** | HowToCheck | | **Data type** | String | | **Possible values** | Manual
AutomaticCheck
AutomaticDownload | | **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | +||| ### Change whether the "Check for Updates" button is enabled Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. ||| -|:---|:---| +|:--|:--| | **Domain** | com.microsoft.autoupdate2 | | **Key** | EnableCheckForUpdatesButton | | **Data type** | Boolean | | **Possible values** | True (default)
False | +||| ### Disable Insider checkbox Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. ||| -|:---|:---| +|:--|:--| | **Domain** | com.microsoft.autoupdate2 | | **Key** | DisableInsiderCheckbox | | **Data type** | Boolean | | **Possible values** | False (default)
True | +||| ### Limit the telemetry that is sent from MAU Set to false to send minimal heartbeat data, no application usage, and no environment details. ||| -|:---|:---| +|:--|:--| | **Domain** | com.microsoft.autoupdate2 | | **Key** | SendAllTelemetryEnabled | | **Data type** | Boolean | | **Possible values** | True (default)
False | +||| ## Example configuration profile The following configuration profile is used to: -- Place the device in the Insider Fast channel +- Place the device in the Beta channel - Automatically download and install updates - Enable the "Check for updates" button in the user interface - Allow users on the device to enroll into the Insider channels @@ -150,7 +163,7 @@ The following configuration profile is used to: ChannelName - InsiderFast + Beta HowToCheck AutomaticDownload EnableCheckForUpdatesButton @@ -210,7 +223,7 @@ The following configuration profile is used to: PayloadEnabled ChannelName - InsiderFast + Beta HowToCheck AutomaticDownload EnableCheckForUpdatesButton