Skip to main content

Onboarding macOS via Intune

Microsoft documentedDefender for Endpoint · Source checked 2026-10-22 · Not yet verified in tenant · Sources: [1][2][3][4][5][6][7][8][9][10][11][12][13][14]

Source numbers such as [1] or [11] refer to the order of learn_sources in the frontmatter.

What it is​

Getting the Microsoft Defender app onto a Mac, getting macOS to trust its two system extensions and grant its permissions without asking the user, and tying the device to your tenant with an onboarding profile. Intune does it with one app object and a stack of configuration profiles.

The part that goes wrong is ordering. Profiles must land before the app. If the app arrives first, macOS prompts the user for every approval.

Not covered: AV preferences in depth, network protection, device control, Purview DLP. Diagnostics beyond the basics live in troubleshooting.

Licensing and prerequisites​

  • MDE P1, P2, Defender for Business or Defender for Individuals. One user license covers up to five client devices for that user [8].
  • Intune is a separate license. It is not in every MDE SKU [1].
  • Supported macOS: the three most recent major releases, currently 27 (Golden Gate), 26 (Tahoe) and 15 (Sequoia). Betas are not supported. New major releases are supported from Apple's GA day [8]. The Intune app page still says "macOS 13 or later" [7]; treat the MDE prerequisites page as the authority.
  • Hardware: Intel x64 or Apple silicon ARM64, 1 GB disk, SIP enabled [8].
  • Streamlined connectivity needs agent 101.23102.* (November 2023) or later. Allow *.endpoint.security.microsoft.com and the supporting dependencies. PAC, WPAD and static proxies work. Authenticated proxies and TLS inspection do not [8].
  • Intune enrollment via Automated Device Enrollment or Device enrollment, and the Policy and Profile Manager role to create the system extension policy [14].
  • Pre-deployment connectivity check [8]:
curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping'

How it works​

Every macOS deployment has the same five stages: prepare the network, approve the extensions and permissions, install the package, apply the onboarding profile, verify [2].

Two system extensions do the work. com.microsoft.wdav.epsext is the Endpoint Security extension that watches files, processes and system events. com.microsoft.wdav.netext is the network extension for network protection, web content filtering and custom indicators. Both are signed with Team ID UBF8T346G9. On macOS 11 and later an MDM profile or a local admin must approve them before they run [8].

Each Intune profile unlocks one thing. What breaks when it is missing [1][8][11]:

Profile (sample file)What it grantsMissing it
System extensions (settings catalog)Approval for epsext and netextsystemextensionsctl list shows [activated waiting for user], healthy: false, "no active event provider"
netfilter.mobileconfigContent filter for com.microsoft.wdav.netextUser gets the "filter network content" prompt; network protection and web filtering do not run
fulldisk.mobileconfigFull Disk Access for com.microsoft.wdav, com.microsoft.wdav.epsext, com.microsoft.dlp.daemon"full disk access has not been granted", real_time_protection_available: false
background_services.mobileconfigBackground execution (macOS 13 and later)User gets the "added background items" prompt and can disable them
notif.mobileconfigNotifications for com.microsoft.wdav.tray and com.microsoft.autoupdate2User is asked to allow notifications; set ShowInNotificationCenter to false to hide them
accessibility.mobileconfigAccessibility for com.microsoft.dlp.daemonOnly matters for Purview DLP
bluetooth.mobileconfigBluetooth for com.microsoft.dlp.agentOnly matters for Bluetooth device control, macOS 14 and later
com.microsoft.autoupdate2.mobileconfigMAU channel and behaviourMAU runs with defaults, Current channel
com.microsoft.wdav.xml as com.microsoft.wdavDefender preferences (or use Defender portal policies)Defaults apply; passive mode not set
WindowsDefenderATPOnboarding.xmlTenant binding, domain com.microsoft.wdav.atplicensed: false, org_id: unavailable, shield shows x badge, "no license found"

Permissions granted by MDM do not show in System Settings > Privacy & Security. Full Disk Access and Bluetooth granted by profile are invisible there [1]. Do not use /Library/Managed Preferences as your only test either; check System Settings > General > Device Management [11].

Updates come from Microsoft AutoUpdate, which ships inside the Intune app type. Each Defender build expires six months after release; expired builds still get security intelligence updates [5][7].

Configure​

Deploy in this order. Profiles first, app and onboarding last [1].

Sample profiles come from github.com/microsoft/mdatp-xplat/macos/mobileconfig/profiles. Download them rather than hand-building payloads [11]. Every custom profile below uses Devices > Configuration > Create > New policy, Platform macOS, Profile type Templates, Template Custom, Deployment channel Device channel [1].

  1. System extensions. Settings catalog, not Custom. The old macOS Extensions template was deprecated in Intune 2408 and cannot be used for new policies [14]. Search allowed system, category System Configuration > System Extensions. Allowed System Extensions: com.microsoft.wdav.epsext, com.microsoft.wdav.netext, Team Identifier UBF8T346G9. Allowed System Extension Types: Network, EndpointSecurity, same Team Identifier [1][14].
Settings catalog, Allowed System Extensions flyout with both Defender bundle IDs and Team ID UBF8T346G9. Source: Microsoft Learn, CC BY 4.0.
Settings catalog, Allowed System Extensions flyout with both Defender bundle IDs and Team ID UBF8T346G9. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
The finished Configuration settings tab with Allowed System Extensions and Allowed System Extension Types set. Source: Microsoft Learn, CC BY 4.0.
The finished Configuration settings tab with Allowed System Extensions and Allowed System Extension Types set. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

  1. Network filter. Custom profile, file netfilter.mobileconfig. macOS supports one network filter profile per device. Two filters break connectivity, and that is an Apple limit, not an MDE one [1].

  2. Full Disk Access. Custom profile, file fulldisk.mobileconfig. MDM-granted FDA cannot be revoked by the user [1].

  3. Background services. Custom profile, file background_services.mobileconfig [1].

  4. Notifications. Custom profile, file notif.mobileconfig [1].

notif.mobileconfig payload with ShowInNotificationCenter set to true; flip it to false to keep Defender quiet. Source: Microsoft Learn, CC BY 4.0.
notif.mobileconfig payload with ShowInNotificationCenter set to true; flip it to false to keep Defender quiet. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

  1. Accessibility. Custom profile, file accessibility.mobileconfig. Grants Accessibility to com.microsoft.dlp.daemon [1].

  2. Bluetooth (optional). Custom profile, file bluetooth.mobileconfig. Only if you will use Bluetooth device control [1].

  3. Microsoft AutoUpdate. Custom profile, file com.microsoft.autoupdate2.mobileconfig from mdatp-xplat/macos/settings/microsoft_auto_update. Sample is set to Current [1][5].

  4. Defender configuration. One of two routes, not both [1].

    • Defender portal: Endpoint security policies, macOS policies tab, an Antivirus policy (template Microsoft Defender Antivirus) and an EDR policy (template Endpoint detection and response). Needs the Intune to MDE connector first.
    • Intune custom profile: file com.microsoft.wdav.xml, Configuration profile name exactly com.microsoft.wdav. Any other name and Defender ignores it. Set passive mode here if another AV stays on the box.

  5. The app. Apps > All apps > Create > app type Microsoft Defender for Endpoint > macOS. No wrapping tool. Keep App information defaults, assign to the same groups as the profiles [1][7].

  6. Onboarding package. Defender portal > Settings > Endpoints > Onboarding. OS macOS, Connectivity type Streamlined, Deployment method Mobile Device Management / Microsoft Intune. Download GatewayWindowsDefenderATPOnboardingPackage.zip. The zip contains intune/kext.xml, intune/WindowsDefenderATPOnboarding.xml and jamf/WindowsDefenderATPOnboarding.plist. Use the Intune XML [1].

Defender portal Onboarding page with macOS, Streamlined connectivity and Mobile Device Management / Microsoft Intune selected. Source: Microsoft Learn, CC BY 4.0.
Defender portal Onboarding page with macOS, Streamlined connectivity and Mobile Device Management / Microsoft Intune selected. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

  1. Onboarding profile. Custom profile, Device channel, file WindowsDefenderATPOnboarding.xml. Contains the license and tenant binding [1].

  2. Check in. Devices > Configuration > policy > Device and user check-in status > View report. On the Mac, System Settings > General > Device Management should list every profile plus the Intune Management Profile, and the Defender shield should be in the menu bar [1].

The Defender shield in the macOS menu bar after a clean deployment, no badge. Source: Microsoft Learn, CC BY 4.0.
The Defender shield in the macOS menu bar after a clean deployment, no badge. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Jamf Pro instead of Intune. Same payloads, different wrapper. Jamf uses jamf/WindowsDefenderATPOnboarding.plist from the same zip with Preference Domain com.microsoft.wdav.atp. Learn's Jamf sequence: onboarding plist; Defender settings as domain com.microsoft.wdav (Custom Schema with schema.json, or legacy plist upload); Notifications payload for com.microsoft.wdav.tray and com.microsoft.autoupdate.fba; MAU plist as domain com.microsoft.autoupdate2; PPPC payload granting SystemPolicyAllFiles to com.microsoft.wdav and com.microsoft.wdav.epsext; System Extensions payload with Team ID UBF8T346G9; Content Filter payload Microsoft Defender Content Filter, identifier com.microsoft.wdav, socket filter com.microsoft.wdav.netext; then background services and a signed Bluetooth profile. Upload wdav.pkg as-is, never repackaged, and scope the install policy to a smart group whose criterion is that the profiles are installed, so the package cannot arrive first [6][9].

Verify​

On the Mac, mdatp health fields that matter [13]:

FieldGood valueMeaning
healthytrueProduct is healthy. health_issues is empty
licensedtrueOnboarded to a tenant
org_idtenant org IDunavailable means the onboarding profile never applied
edr_machine_idpopulatedDevice ID in the portal
real_time_protection_enabledtrueRTP is switched on
real_time_protection_availabletrueRTP component is healthy. false usually means FDA or extensions
definitions_statusup_to_dateElse updating or unavailable
engine_load_statusEngine load succeededAV process is up
product_expirationmonths awayBuild expires six months after release

mdatp health --details system_extensions should show network_extension_enabled: true and endpoint_security_extension_ready: true. systemextensionsctl list should show both as [activated enabled] [11]. mdatp connectivity test should pass every URL [2].

In the portal: Assets > Devices, device shows Active with OS platform macOS. Then run the AV detection test and the EDR detection test from Learn [1].

DeviceInfo
| where OSPlatform == "macOS"
| summarize arg_max(Timestamp, *) by DeviceId
| project Timestamp, DeviceName, OSVersion, OnboardingStatus, SensorHealthState, ClientVersion
| order by Timestamp desc

Troubleshoot​

Start from mdatp health and work down. The three fields that split most cases:

systemextensionsctl list with both Defender extensions stuck at activated waiting for user, the signature of a missing or late system extension policy. Source: Microsoft Learn, CC BY 4.0.
systemextensionsctl list with both Defender extensions stuck at activated waiting for user, the signature of a missing or late system extension policy. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
SymptomLikely causeFix
Shield shows x badge, "no license found"Onboarding profile not appliedConfirm WindowsDefenderATPOnboarding.xml is in Device Management; check Intune check-in report [1]
systemextensionsctl list shows [activated waiting for user]System extension policy missing or arrived after the appDeploy the settings catalog policy; run analyze_profiles.py [11][14]
health_issues has "full disk access has not been granted"fulldisk.mobileconfig missingAdd it to the deployment. It will not appear in Privacy & Security even when it works [1]
User sees "filter network content" promptnetfilter.mobileconfig missing, or a second filter profile existsDeploy it; remove any other content filter profile [1]
Background items prompt, services disabled by userbackground_services.mobileconfig missing on macOS 13 and laterDeploy it [1]
Extensions cannot be created in the old Extensions templateTemplate deprecated in Intune 2408Recreate in settings catalog [14]
Preferences profile ignoredConfiguration profile name is not com.microsoft.wdavRename the profile exactly [1]
mdatp connectivity test failsTLS inspection or authenticated proxyExempt MDE URLs, use PAC, WPAD or static proxy [8]

Install log and connectivity failures, Client Analyzer and offboarding leftovers: see troubleshooting.

Gotchas and limits​

  • Order is everything. Learn says it directly: deploy all profiles before the app and onboarding package [1]. Intune has no dependency between a configuration profile and an app assignment. Stage with groups, or accept prompts on the first ring.
  • Enrollment type. The system extension article requires Automated Device Enrollment or Device enrollment [14]. None of the sources fetched discuss User Approved MDM for manually enrolled Macs. TODO verify in lab whether a user-enrolled Mac accepts the device channel profiles.
  • Apple silicon. ARM64 is supported natively [8]. No Rosetta statement in the sources.
  • macOS version support. The prerequisites page lists 27, 26 and 15 [8]. The what's new page carries only build numbers for 2026 (latest 101.26082.0012 in October 2026) and says nothing about OS support or deprecations [4]. Check the release notes page, not what's new, for OS-specific known issues.
  • Intune cannot uninstall. Apple gives Intune no way to remove the app [7]. Uninstall is sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall' or drag to Trash. Offboard first, remove tamper protection policy, then uninstall, then remove the device from the system extension policy group [3][10]. The offboarding marker it leaves behind blocks re-onboarding; see troubleshooting.
  • MAU channel is global. ChannelName in com.microsoft.autoupdate2 moves every Microsoft app on the Mac to that channel. To move only Defender, use the Applications dictionary with App Domain com.microsoft.wdav and Application ID WDAV00. Legacy names InsiderFast, External, Production map to Beta, Preview, Current [5].
  • Builds expire. Six months after release. mdatp health --field product_expiration tells you when. A Mac with MAU blocked will quietly age out [5].
  • One content filter only. Any other product's network filter profile competes with netfilter.mobileconfig [1].
  • Security settings management does not install anything. It manages settings on onboarded devices; you still need the app and onboarding profile [8].
  • Repackaging wdav.pkg is unsupported. Triggers tamper alerts and breaks updates [6].

Further reading​

My notes​

TODO: Sohail's notes after verification.

Changelog​

DateChangeSource
2026-10-22Drafted from Learn[1]
2026-10-22Added Learn images, diagrams, further reading