Boot-up protections. Microsoft Windows 10: Microsoft has long led the way with pre-boot, boot,.
Applies to:
Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.
This topic describes how to install, configure, update, and use Defender for Endpoint on Mac.
Caution
Running other third-party endpoint protection products alongside Microsoft Defender for Endpoint on Mac is likely to lead to performance problems and unpredictable side effects. If non-Microsoft endpoint protection is an absolute requirement in your environment, you can still safely take advantage of Defender for Endpoint on Mac EDR functionality after configuring the antivirus functionality to run in Passive mode.
Tip
If you have any feedback that you would like to share, submit it by opening Microsoft Defender for Endpoint on Mac on your device and navigating to Help > Send feedback.
To get the latest features, including preview capabilities (such as endpoint detection and response for your Mac devices), configure your macOS device running Microsoft Defender for Endpoint to be an 'Insider' device.
There are several methods and deployment tools that you can use to install and configure Defender for Endpoint on Mac.
Third-party management tools:
Command-line tool:
The three most recent major releases of macOS are supported.
Important
On macOS 11 (Big Sur), Microsoft Defender for Endpoint requires additional configuration profiles. If you are an existing customer upgrading from earlier versions of macOS, make sure to deploy the additional configuration profiles listed on New configuration profiles for macOS Catalina and newer versions of macOS.
Important
Support for macOS 10.13 (High Sierra) has been discontinued as of February 15th, 2021.
Beta versions of macOS are not supported.
macOS devices with M1 processors are not supported.
After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints.
Microsoft Defender for Endpoint on Mac requires one of the following Microsoft Volume Licensing offers:
Note
Eligible licensed users may use Microsoft Defender for Endpoint on up to five concurrent devices.Microsoft Defender for Endpoint is also available for purchase from a Cloud Solution Provider (CSP). When purchased via a CSP, it does not require Microsoft Volume Licensing offers listed.
The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an allow rule specifically for them.
Spreadsheet of domains list | Description |
---|---|
Spreadsheet of specific DNS records for service locations, geographic locations, and OS. Download the spreadsheet here: mdatp-urls.xlsx. |
Microsoft Defender for Endpoint can discover a proxy server by using the following discovery methods:
If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs.
Warning
Authenticated proxies are not supported. Ensure that only PAC, WPAD, or a static proxy is being used.
SSL inspection and intercepting proxies are also not supported for security reasons. Configure an exception for SSL inspection and your proxy server to directly pass through data from Microsoft Defender for Endpoint on macOS to the relevant URLs without interception. Adding your interception certificate to the global store will not allow for interception.
To test that a connection is not blocked, open https://x.cp.wd.microsoft.com/api/report and https://cdn.x.cp.wd.microsoft.com/ping in a browser.
If you prefer the command line, you can also check the connection by running the following command in Terminal:
The output from this command should be similar to the following:
OK https://x.cp.wd.microsoft.com/api/report
OK https://cdn.x.cp.wd.microsoft.com/ping
Caution
We recommend that you keep System Integrity Protection (SIP) enabled on client devices. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default.
Once Microsoft Defender for Endpoint is installed, connectivity can be validated by running the following command in Terminal:
Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender for Endpoint on Mac, a program named Microsoft AutoUpdate (MAU) is used. To learn more, see Deploy updates for Microsoft Defender for Endpoint on Mac.
Guidance for how to configure the product in enterprise environments is available in Set preferences for Microsoft Defender for Endpoint on Mac.
In alignment with macOS evolution, we are preparing a Microsoft Defender for Endpoint on Mac update that leverages system extensions instead of kernel extensions. For relevant details, see What's new in Microsoft Defender for Endpoint on Mac.
For more information about logging, uninstalling, or other topics, see Resources for Microsoft Defender for Endpoint on Mac.
Privacy for Microsoft Defender for Endpoint on Mac.
During the 2000s, Apple ran a hugely successful advertising campaign for its line of Macintosh desktop computers. The ads poked fun at some of the perceived bugbears of the Windows-based PCs of the era compared to the Mac.
One recurring theme of these ads was the greater vulnerability of Microsoft’s PCs to viruses.
The perception that Macs are safer to use than PCs persists in some quarters to this day. But is it the case that Apple’s latest OS X Yosemite is more secure than the newly-released Windows 10 from Microsoft?
Whatever the technical vulnerabilities of the two systems, the historical lack of malware targeting Apple systems was at least in part due to Apple’s own lack of market share.
Definitive statistics for the market share of operating systems are hard to come by, but one useful estimate is available from the server traffic records of Wikimedia (the non-profit organisation that runs Wikipedia).
In April 2009 (the earliest date from which records are readily available) nearly 90% of traffic came from computers running Windows, compared to only 6% for Mac. By July 2015 Windows had dropped to 41.7% and Mac to 5.4%. Most of the rest now comes from smartphones and tablets running Apple’s iOS and Google’s Android.
So back in 2009, Windows represented a far larger target than Mac for profit-seeking virus and malware authors. While that is still the case today, the relative payoffs have changed substantially. Mac users tend to be wealthier than average and are likely to be more heavily concentrated in wealthier developed countries, which may attract malware authors to Macs.
Over the years both Microsoft and Apple have taken many measures to reduce the risks from malware. Both devote considerable time and resources to removing security-related faults in their own software and preventing the introduction of new ones.
Microsoft has disclosed information about its Security Development Lifecycle, both to encourage confidence and to promote the development of more secure software across the industry. Apple is much less forthcoming about the specifics of its internal security efforts.
However, security bugs are still being discovered in released versions of both OS X and Windows on a regular basis. What has changed for the better is the ease and speed with which security fixes to software are distributed and installed.
Microsoft’s policy relating to the disclosure of security flaws says it will publicly reveal a vulnerability, even without a fix, if it becomes aware the vulnerability is being exploited. Apple’s policy is to never comment on security faults until they have been fixed.
Both companies have also introduced a number of features that make it harder for bugs to be exploited to allow attackers to take control of systems.
Perhaps the biggest change to the security of the two major desktop operating systems is through the combination of app stores, signed applications and “sandboxing”. In combination, these features go a long way to make sure that the only software running on OS X or Windows is:
Aside from the security implications, app stores have commercial implications. Only applications approved by Apple or Microsoft can be sold through them, and those companies take a cut of any sales.
These walled gardens are of concern if you believe (as I do) in the “freedom to tinker”. But they do significantly reduce both the potential for malware to make its way onto systems, and the harm such malware can do if they somehow get through.
The technical details of the Windows and the OS X app stores and sandboxing models are slightly different to each other, although the end results are reasonably similar.
But there is a straightforward way to bypass these protections: many users need the ability to run their older applications, so both operating systems provide mechanisms to install and run non-sandboxed code.
Successful attacks on non-sandboxed applications leave the rest of the user’s computer vulnerable. The existence of a mechanism to install and run any program downloaded from the internet also gives malware authors a “social engineering” attack – in a nutshell, tricking users into running downloaded software that contains malware.
Windows 10 has a new sandboxing model for corporate applications called Device Guard that will make it harder for unauthorised applications to be executed.
It is currently restricted to the Enterprise version of Windows 10 because its mechanisms for approving older applications to run are too unwieldy for home users. But, over time, some version of the Device Guard system will likely filter down to the home editions of Windows, making life more difficult for malware authors.
So which is the safer operating system to use? For what it’s worth, I use both Windows and OS X (as well as Linux, Android and occasionally iOS), and I see no particular reason to choose between them on security grounds. I share the concerns of David Glance, writing on The Conversation, about Windows 10’s privacy policies, but that’s not strictly a security issue.
All operating systems are vulnerable to hackers, but the risks can be reduced if you adopt basic computer security measures. These include installing anti-malware software and installing operating system and application security updates promptly.
And there are other risks you face regardless of the operating system you choose. Web browsers and plugins, other applications and the security practices of the websites that you visit are agnostic to whether you’re on Windows or Mac.