Onboarding and Managing macOS

In this chapter, we start to focus on Apple’s desktop operating system (OS): macOS. You will learn about the following:

• How macOS devices are onboarded to MDE
• How to configure MDE for macOS settings with Intune

Microsoft only supports Microsoft Defender for Endpoint (MDE) on the most recent version of macOS and the two prior versions, excluding any beta releases of the OS. For example, if the current version is macOS 13 Ventura, only macOS 12 Monterey and macOS 11 Big Sur are also supported.

macOS is onboarded and protected by an agent that combines Endpoint Detection and Response (EDR) capabilities and anti-malware components such as cloud-delivered protection. Like Windows 10, it is capable, if required, of putting the anti-malware engine into the passive mode for alternative antivirus support.

Our journey into MDE for macOS begins as it did for Windows, with onboarding.

Onboarding macOS

There is an onboarding caveat to be aware of due to changes in Apple’s hardware and macOS built-in security features that have occurred over time.

Starting from macOS 10.15.4 Catalina, macOS moved from kernel extensions (KEXTs) APIs to system extensions. Differentiating these is where the code is executed: it moved from the kernel level to a more secure user space. Also, starting in macOS 10.15, transparency, consent, and control (TCC) protective capabilities were extended. Applications now require explicit consent to access locations that are likely to contain private files or user data. For example, cloud storage locations (third-party and iCloud), documents, desktops, downloads, and removable storage. This section of the chapter will guide you on how to take this into account for manual and Intune deployments. If using other means, such as third-party mobile device management (MDM), you will need to consider this.

Let’s get into the process for...

Managing macOS protection settings

In this section, you’ll learn how to manage the settings and preferences of MDE for macOS. Our focus will be on controlling these using Intune, as it is the most common MDM for Microsoft customers. Whichever management engine you use, you’re deploying an XML configuration profile file, also called a property list file. Even when default settings are sufficient, it’s worth applying them with a configuration profile so that end users cannot change them.

Many of the protection settings can be enabled manually. For example, with the sudo mdatp config command. This is fine for testing but does not scale well, so this section focuses on central deployment approaches.

Microsoft has also introduced a native user interface to Intune for configuring macOS MDE settings. This supersedes the configuration profile file approach, but unfortunately, at the time of writing, it is missing many of the settings that property list supports....

Summary

In this chapter, you learned how to onboard and manage your macOS devices for MDE.

You now know how to onboard manually or by using Microsoft Intune. This included several of the prerequisites unique to macOS, due to Apple’s built-in security constraints around the OS. You learned that the manual option is useful for initial testing or small-scale deployments, but Microsoft Intune provides a scalable approach with the benefits of MDM. Other MDM options are available, including Jamf, but as Intune is available with Microsoft 365 E5, we focused on that.

You also now understand how to manage endpoint MDE for macOS settings. Throughout the Managing macOS protection settings section, you learned how to build the core component of MDE for macOS management: the configuration profile file. You also learned about many good practices, such as prohibiting local policy management, minimizing exclusions, enforcing PUA protection, and keeping MDE updated.

If you thought Microsoft...

Questions

Now that you understand onboarding and managing MDE on macOS, you can test your knowledge with the following questions.

1. True or false: Intune is the only MDM that can onboard macOS devices.
   1. True
   2. False
2. Which of the following is true regarding preparing macOS Monterey for an Intune-based onboarding process? Choose all that apply.
   1. Kernel extensions should be configured with a custom configuration profile
   2. System extensions should be configured with an extensions configuration profile
   3. Full disk permissions are applied automatically by the MDE app
   4. Full disk permissions should be configured using a configuration profile
3. Which command can be used on a macOS device to confirm the onboarding state of the device?
   1. mdatp health --field tenant_id
   2. mdatp status --field org_id
   3. mdatp health --field org_id
   4. mdatp status --field tenant_id
4. In an MDE configuration profile file, which of the following most accurately describes what a dictionary key is?
   1. A variable for later reference in...

Further reading

You may find the following links and resources interesting as you pursue MDE for macOS in your environment:

• This is interesting from a historical point of view if nothing else. You can find the official announcement of Microsoft Defender ATP for macOS, as it was called at the time, here: techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-microsoft-defender-atp-for-mac/ba-p/378010.
• The anti-malware engine for Linux and macOS underwent significant improvements in 2022, branded as the enhanced engine. You can understand those improvements by reviewing the announcement here: techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-engine-capabilities-for-linux-and-macos/ba-p/3292003.
• If you are just starting your journey with macOS and Intune or want to review how you’re doing things, Oliver Kieselbach has an excellent blog about managing macOS with Intune: oliverkieselbach.com/2021/07/14/comprehensive...