How to Onboard a Mac in Microsoft Defender for Endpoint
Question details
The user needs to onboard macOS devices into Microsoft Defender for Endpoint using Microsoft Intune.
- Product
- Microsoft Defender for Endpoint
- Device & OS
- macOS
- Scenario
- Deploying enterprise security tools and enrolling Apple devices into Microsoft Defender.
- Observed behavior
- Setting up device profiles, downloading the onboarding package, and fulfilling all MDM enrollment requirements successfully.
Ensure you have administrator access to the Microsoft 365 Defender portal, an active Microsoft Defender for Endpoint subscription, and a configured Intune tenant set as your MDM authority.
Deploy Microsoft Defender for Endpoint via Intune
The standard enterprise method to deploy the onboarding package and configure necessary permissions for managed Macs.
Onboarding macOS devices requires configuring Mobile Device Management (MDM) policies to grant necessary system permissions, such as Full Disk Access and System Extensions, without prompting the end user.
In the Microsoft Endpoint Manager admin center, ensure Apple enrollment is enabled and that you have configured a valid Apple MDM Push certificate.
Log in to the Microsoft 365 Defender portal. Navigate to Settings > Endpoints > Device Management > Onboarding. Select 'macOS' as the operating system and download the onboarding package.
In Intune, create custom device configuration profiles for macOS to approve the required System Extensions and grant Full Disk Access to the Microsoft Defender application.
Upload the downloaded macOS onboarding package into Intune as a custom configuration profile and assign it to your target macOS device groups.
Ensure your corporate firewall or proxy is configured to allow the required Microsoft Defender network URLs so the Mac can successfully report back to the Defender portal.
Discover WPS Office as Your Lightweight Productivity Solution
While managing enterprise security and device endpoints with Microsoft Defender, you might also be looking for cost-effective software solutions for your Mac users. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, offering Word, Excel, PowerPoint, and PDF tools in a single familiar interface.
Frequently Asked Questions
Do I need an MDM solution to onboard Macs to Defender for Endpoint?
While manual installation via a local script is possible for a small number of devices, using a Mobile Device Management (MDM) solution like Microsoft Intune or Jamf is highly recommended for enterprise deployments to manage system extensions and permissions automatically.
Why is my Mac failing to report to the Defender portal after onboarding?
This usually happens if the required network endpoints are blocked by a firewall or proxy, or if the macOS device has not been granted Full Disk Access permissions via MDM configuration profiles.
Where can I find the Defender onboarding script for macOS?
You can download the onboarding package directly from the Microsoft 365 Defender portal by navigating to Settings > Endpoints > Device Management > Onboarding and selecting macOS from the OS dropdown menu.
