Set preferences for Microsoft Defender for Endpoint on macOS

Important

This article is for enterprise administrators who need to manage Microsoft Defender for Endpoint on macOS using a configuration profile deployed through JAMF or Intune. It covers preferences for the antivirus engine, cloud-delivered protection, endpoint detection and response (EDR), tamper protection, and the user interface. It also includes recommended and full configuration profile templates, plus deployment instructions. To configure Defender for Endpoint on macOS using the command-line interface instead, see Configure from the command line.

Summary

In enterprise organizations, you can manage Microsoft Defender for Endpoint on macOS through a configuration profile. You deploy this profile by using one of several management tools. Preferences set by your security operations team take precedence over local device preferences. To change preferences set through the configuration profile, users need admin permissions.

This article describes the configuration profile structure. It includes a recommended profile to help you get started and explains how to deploy the profile.

Configuration profile structure

The configuration profile is a .plist file made up of key-value pairs. Each key is the name of a preference. Each value depends on the type of preference. Values can be simple (such as a number) or complex (such as a nested list of preferences).

Caution

The layout of the configuration profile depends on the management console that you're using. The following sections contain examples of configuration profiles for JAMF and Intune.

The top level of the configuration profile includes product-wide preferences and entries for subareas of Microsoft Defender for Endpoint, including antivirus engine, cloud-delivered protection, user interface, endpoint detection and response (EDR), and tamper protection.

Antivirus engine preferences

The antivirusEngine section of the configuration profile is used to manage the preferences of the antivirus component of Microsoft Defender for Endpoint.

Section	Value
Domain	com.microsoft.wdav
Key	antivirusEngine
Data type	Dictionary (nested preference)
Comments	The dictionary contents include settings for enforcement level, behavior monitoring, file hash computation, scan exclusions, allowed threats, threat type settings, and scan history retention.

Enforcement level for antivirus engine

Specifies the enforcement preference of antivirus engine. There are three values for setting enforcement level:

• Real-time (real_time): Real-time protection (scan files as they're accessed) is enabled.
• On-demand (on_demand): Files are scanned only on demand. In this:
  • Real-time protection is turned off.
• Passive (passive): Runs the antivirus engine in passive mode. In this:
  • Real-time protection is turned off.
  • On-demand scanning is turned on.
  • Automatic threat remediation is turned off.
  • Security intelligence updates are turned on.
  • Status menu icon is hidden.

Section	Value
Domain	com.microsoft.wdav
Key	enforcementLevel
Data type	String
Possible values	real_time (default) on_demand passive
Comments	Available in Microsoft Defender for Endpoint version 101.10.72 or higher.

Enable/disable behavior monitoring

Determines whether behavior monitoring and blocking capability is enabled on the device or not.

Note

This feature is applicable only when Real-Time Protection feature is enabled.

Section	Value
Domain	com.microsoft.wdav
Key	behaviorMonitoring
Data type	String
Possible values	disabled enabled (default)
Comments	Available in Microsoft Defender for Endpoint version 101.24042.0002 or higher.

Configure file hash computation feature

Enables or disables file hash computation feature. When this feature is enabled, Defender for Endpoint computes hashes for files it scans to enable better matching against the indicator rules. On macOS, only the script and Mach-O (32 bit and 64 bit) files are considered for this hash computation (from engine version 1.1.20000.2 or higher). Enabling this feature might affect device performance. For more details, please refer to: Create indicators for files.

Section	Value
Domain	com.microsoft.wdav
Key	enableFileHashComputation
Data type	Boolean
Possible values	false (default) true
Comments	Available in Defender for Endpoint version 101.86.81 or higher.

Run a scan after definitions are updated

Specifies whether to start a process scan after new security intelligence updates are downloaded on the device. Enabling this setting triggers an antivirus scan on the running processes of the device.

Section	Value
Domain	com.microsoft.wdav
Key	scanAfterDefinitionUpdate
Data type	Boolean
Possible values	true (default) false
Comments	Available in Microsoft Defender for Endpoint version 101.41.10 or higher.

Scan archives (on-demand antivirus scans only)

Specifies whether to scan archives during on-demand antivirus scans.

Section	Value
Domain	com.microsoft.wdav
Key	scanArchives
Data type	Boolean
Possible values	true (default) false
Comments	Available in Microsoft Defender for Endpoint version 101.41.10 or higher.

Degree of parallelism for on-demand scans

Specifies the degree of parallelism for on-demand scans. This corresponds to the number of threads used to perform the scan and affects the CPU usage, and the duration of the on-demand scan.

Section	Value
Domain	com.microsoft.wdav
Key	maximumOnDemandScanThreads
Data type	Integer
Possible values	2 (default). Allowed values are integers between 1 and 64.
Comments	Available in Microsoft Defender for Endpoint version 101.41.10 or higher.

Exclusion merge policy

Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (merge), or only administrator-defined exclusions (admin_only). This setting can be used to restrict local users from defining their own exclusions.

Section	Value
Domain	com.microsoft.wdav
Key	exclusionsMergePolicy
Data type	String
Possible values	merge (default) admin_only
Comments	Available in Microsoft Defender for Endpoint version 100.83.73 or higher.

Scan exclusions

Specify entities excluded from being scanned. Exclusions can be specified by full paths, extensions, or file names. (Exclusions are specified as an array of items, administrator can specify as many elements as necessary, in any order.)

Section	Value
Domain	com.microsoft.wdav
Key	exclusions
Data type	Dictionary (nested preference)
Comments	The dictionary contains the keys $type (exclusion type), path (file or folder path), isDirectory (path type), extension (file extension), and name (process name).

Type of exclusion

Specify content excluded from being scanned by type.

Section	Value
Domain	com.microsoft.wdav
Key	$type
Data type	String
Possible values	excludedPath excludedFileExtension excludedFileName

Path to excluded content

Specify content excluded from being scanned by full file path.

Section	Value
Domain	com.microsoft.wdav
Key	path
Data type	String
Possible values	valid paths
Comments	Applicable only if $type is excludedPath

Supported exclusion types

The following table shows the exclusion types supported by Defender for Endpoint on macOS.

Exclusion	Definition	Examples
File extension	All files with the extension, anywhere on the device	.test
File	A specific file identified by the full path	/var/log/test.log /var/log/*.log /var/log/install.?.log
Folder	All files under the specified folder (recursively)	/var/log/ /var/*/
Process	A specific process (specified either by the full path or file name) and all files opened by it	/bin/cat cat c?t

Important

The paths above must be hard links, not symbolic links, in order to be successfully excluded. You can check if a path is a symbolic link by running file <path-name>.

File, folder, and process exclusions support the following wildcards:

Wildcard	Description	Example	Matches	Doesn't match
*	Matches any number of any characters including none (note that when this wildcard is used inside a path it substitutes only one folder)	/var/\*/\*.log	/var/log/system.log	/var/log/nested/system.log
?	Matches any single character	file?.log	file1.log file2.log	file123.log

Scan exclusion path type (file or directory)

In an antivirus scan exclusion entry, use isDirectory to indicate whether the path value refers to a file or a directory.

Section	Value
Domain	com.microsoft.wdav
Key	isDirectory
Data type	Boolean
Possible values	false (default) true
Comments	Applicable only if $type is excludedPath

Scan exclusion: file extension

In an antivirus scan exclusion entry, use extension to exclude files by file extension.

Section	Value
Domain	com.microsoft.wdav
Key	extension
Data type	String
Possible values	valid file extensions
Comments	Applicable only if $type is excludedFileExtension

Scan exclusion: process name or path

In an antivirus scan exclusion entry, use name to exclude a process and all files opened by that process from scanning. The process can be specified either by its name (for example, cat) or full path (for example, /bin/cat).

Section	Value
Domain	com.microsoft.wdav
Key	name
Data type	String
Possible values	any string
Comments	Applicable only if $type is excludedFileName

Allowed threats

Specify threats by name that aren't blocked by Defender for Endpoint on macOS. These threats are allowed to run.

Section	Value
Domain	com.microsoft.wdav
Key	allowedThreats
Data type	Array of strings

Disallowed threat actions

Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list aren't displayed in the user interface.

Section	Value
Domain	com.microsoft.wdav
Key	disallowedThreatActions
Data type	Array of strings
Possible values	allow (restricts users from allowing threats) restore (restricts users from restoring threats from the quarantine)
Comments	Available in Microsoft Defender for Endpoint version 100.83.73 or higher.

Threat type settings

Specify how certain threat types are handled by Microsoft Defender for Endpoint on macOS.

Section	Value
Domain	com.microsoft.wdav
Key	threatTypeSettings
Data type	Dictionary (nested preference)
Comments	Each entry in the array contains a key (threat type, such as potentially_unwanted_application or archive_bomb) and a value (action to take: audit, block, or off).

Threat type

Specify threat types.

Section	Value
Domain	com.microsoft.wdav
Key	key
Data type	String
Possible values	potentially_unwanted_application archive_bomb

Action to take

Specify what action to take when a threat of the type identified by the key setting is detected. Choose from the following options:

• Audit: your device isn't protected against this type of threat, but an entry about the threat is logged.
• Block: your device is protected against this type of threat and you're notified in the user interface and the Microsoft Defender portal.
• Off: your device isn't protected against this type of threat and nothing is logged.

Section	Value
Domain	com.microsoft.wdav
Key	value
Data type	String
Possible values	audit (default) block off

Threat type settings merge policy

Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (merge) or only administrator-defined settings (admin_only). This setting can be used to restrict local users from defining their own settings for different threat types.

Section	Value
Domain	com.microsoft.wdav
Key	threatTypeSettingsMergePolicy
Data type	String
Possible values	merge (default) admin_only
Comments	Available in Microsoft Defender for Endpoint version 100.83.73 or higher.

Antivirus scan history retention (in days)

Specify the number of days that results are retained in the scan history on the device. Old scan results are removed from the history. Old quarantined files that are also removed from the disk.

Section	Value
Domain	com.microsoft.wdav
Key	scanResultsRetentionDays
Data type	String
Possible values	90 (default). Allowed values are from one day to 180 days.
Comments	Available in Microsoft Defender for Endpoint version 101.07.23 or higher.

Maximum number of items in the antivirus scan history

Specify the maximum number of entries to keep in the scan history. Entries include all on-demand scans performed in the past and all antivirus detections.

Section	Value
Domain	com.microsoft.wdav
Key	scanHistoryMaximumItems
Data type	String
Possible values	10000 (default). Allowed values are from 5000 items to 15000 items.
Comments	Available in Microsoft Defender for Endpoint version 101.07.23 or higher.

Cloud-delivered protection preferences

Configure the cloud-driven protection features of Microsoft Defender for Endpoint on macOS.

Section	Value
Domain	com.microsoft.wdav
Key	cloudService
Data type	Dictionary (nested preference)
Comments	The dictionary contents include settings for cloud-delivered protection, diagnostic collection level, cloud block level, automatic sample submissions, security intelligence updates, and proxy configuration.

Enable / disable cloud-delivered protection

Specify whether to enable cloud-delivered protection the device or not. To improve the security of your services, we recommend keeping this feature turned on.

Section	Value
Domain	com.microsoft.wdav
Key	enabled
Data type	Boolean
Possible values	true (default) false

Diagnostic collection level

Diagnostic data is used to keep Microsoft Defender for Endpoint secure and up to date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by Microsoft Defender for Endpoint to Microsoft.

Section	Value
Domain	com.microsoft.wdav
Key	diagnosticLevel
Data type	String
Possible values	optional (default) required

Configure cloud block level

This setting determines how aggressive Defender for Endpoint will be in blocking and scanning suspicious files. If this setting is on, Defender for Endpoint will be more aggressive when identifying suspicious files to block and scan; otherwise, it's less aggressive and therefore block and scan with less frequency. There are five values for setting cloud block level:

• Normal (normal): The default blocking level.
• Moderate (moderate): Delivers verdict only for high confidence detections.
• High (high): Aggressively blocks unknown files while optimizing for performance (greater chance of blocking nonharmful files).
• High Plus (high_plus): Aggressively blocks unknown files and applies additional protection measures (might impact client device performance).
• Zero Tolerance (zero_tolerance): Blocks all unknown programs.

Section	Value
Domain	com.microsoft.wdav
Key	cloudBlockLevel
Data type	String
Possible values	normal (default) moderate high high_plus zero_tolerance
Comments	Available in Defender for Endpoint version 101.56.62 or higher.

Enable / disable automatic sample submissions

Determines whether suspicious samples (that are likely to contain threats) are sent to Microsoft. There are three levels for controlling sample submission:

• None: no suspicious samples are submitted to Microsoft.
• Safe: only suspicious samples that don't contain personal data (PII) are submitted automatically. This is the default value for this setting.
• All: all suspicious samples are submitted to Microsoft.

Description	Value
Key	automaticSampleSubmissionConsent
Data type	String
Possible values	none safe (default) all

Enable / disable automatic security intelligence updates

Determines whether security intelligence updates are installed automatically:

Section	Value
Key	automaticDefinitionUpdateEnabled
Data type	Boolean
Possible values	true (default) false

Duration for security intelligence updates due (in days)

Determines the number of days after which the last installed security intelligence updates are considered outdated.

Section	Value
Key	definitionUpdateDue
Data type	Integer
Possible values	7 (default). Allowed values are integers between 1 and 30

Security intelligence update interval (in seconds)

Specifies the time interval (in seconds) after which security intelligence updates will be checked.

Section	Value
Key	definitionUpdatesInterval
Data type	Integer
Possible values	28800 (default, 8 hours). Allowed values are integers between 60 (1 minute) and 86400 (24 hours)
Comments	Setting the value too low may lead to repeated or unnecessary security intelligence update checks.

Proxy for Defender for Endpoint communication

Configure proxy for all Defender for Endpoint cloud communication. If not set, the system-wide proxy is used.

Section	Value
Key	proxy
Data type	String
Comments	Format: "http://proxy.server:port" or "https://proxy.server:port".

Important

• Incorrect proxy configuration can disrupt MDE functionality.
• You can run "mdatp connectivity test" on endpoint to test mde connectivity after applying proxy settings.

User interface preferences

Manage the preferences for the user interface of Microsoft Defender for Endpoint on macOS.

Section	Value
Domain	com.microsoft.wdav
Key	userInterface
Data type	Dictionary (nested preference)
Comments	The dictionary contents include settings for the status menu icon visibility, the feedback option, and consumer version sign-in control.

Show / hide status menu icon

Specify whether to show or hide the status menu icon in the top-right corner of the screen.

Section	Value
Domain	com.microsoft.wdav
Key	hideStatusMenuIcon
Data type	Boolean
Possible values	false (default) true

Show / hide option to send feedback

Specify whether users can submit feedback to Microsoft by going to Help > Send Feedback.

Section	Value
Domain	com.microsoft.wdav
Key	userInitiatedFeedback
Data type	String
Possible values	enabled (default) disabled
Comments	Available in Microsoft Defender for Endpoint version 101.19.61 or higher.

Control sign-in to consumer version of Microsoft Defender

Specify whether users can sign into the consumer version of Microsoft Defender.

Section	Value
Domain	com.microsoft.wdav
Key	consumerExperience
Data type	String
Possible values	enabled (default) disabled
Comments	Available in Microsoft Defender for Endpoint version 101.60.18 or higher.

Endpoint detection and response preferences

Manage the preferences of the endpoint detection and response (EDR) component of Microsoft Defender for Endpoint on macOS.

Section	Value
Domain	com.microsoft.wdav
Key	edr
Data type	Dictionary (nested preference)
Comments	The dictionary contents include settings for device tags and group identifiers.

Device tags

Specify a tag name and its value.

• The GROUP tag marks the device with the specified value. The tag is reflected in the portal under the device page and can be used for filtering and grouping devices.

Section	Value
Domain	com.microsoft.wdav
Key	tags
Data type	Dictionary (nested preference)
Comments	Each entry in the array contains a key (tag type, such as GROUP) and a value (the tag string assigned to the device).

Type of tag

Specifies the type of tag

Section	Value
Domain	com.microsoft.wdav
Key	key
Data type	String
Possible values	GROUP

Value of tag

Specifies the value of tag

Section	Value
Domain	com.microsoft.wdav
Key	value
Data type	String
Possible values	any string

Important

• Only one value per tag type can be set.
• Type of tags are unique, and shouldn't be repeated in the same configuration profile.

Group identifier

EDR Group identifiers

Section	Value
Domain	com.microsoft.wdav
Key	groupIds
Data type	String
Comments	Group identifier

Tamper protection

Manage the preferences of the tamper protection component of Microsoft Defender for Endpoint on macOS.

Section	Value
Domain	com.microsoft.wdav
Key	tamperProtection
Data type	Dictionary (nested preference)
Comments	The dictionary contents include settings for enforcement level and exclusions.

Enforcement level

If Tamper Protection is enabled and if it is in the strict mode

Section	Value
Domain	com.microsoft.wdav
Key	enforcementLevel
Data type	String
Comments	One of 'disabled', 'audit', or 'block'

Possible values:

• disabled - Tamper Protection is turned off, no prevention of attacks or reporting to the Cloud
• audit - Tamper Protection reports tampering attempts to the Cloud only, but doesn't block them
• block - Tamper Protection both blocks and reports attacks to the Cloud

Exclusions

Defines processes that are allowed altering Microsoft Defender's asset, without being considering tampering. Either path, or teamId, or signingId, or their combination must be provided. Args can be provided additionally, to specify allowed process more precisely.

Section	Value
Domain	com.microsoft.wdav
Key	exclusions
Data type	Dictionary (nested preference)
Comments	The dictionary contents include settings for path, team ID, signing ID, and process arguments.

Path

Exact path of the process executable.

Section	Value
Domain	com.microsoft.wdav
Key	path
Data type	String
Comments	If a shell script it's the exact path to the interpreter binary, for example, /bin/zsh. No wildcards allowed.

Team ID

Apple's "Team ID" of the vendor.

Section	Value
Domain	com.microsoft.wdav
Key	teamId
Data type	String
Comments	For example, UBF8T346G9 for Microsoft

Signing ID

Apple's "Signing ID" of the package.

Section	Value
Domain	com.microsoft.wdav
Key	signingId
Data type	String
Comments	For example, com.apple.ruby for Ruby interpreter

Process arguments

Used in combination with other parameters to identify the process.

Section	Value
Domain	com.microsoft.wdav
Key	signingId
Data type	Array of strings
Comments	If specified, process argument must match those arguments exactly, case-sensitive

Recommended configuration profile

The recommended configuration profile enables all protection features in Microsoft Defender for Endpoint. Both the JAMF property list and the Intune XML profile in the following subsections apply these settings.

This configuration profile (or, for JAMF, a property list uploaded into custom settings) will:

• Enable real-time protection (RTP)
• Specify how the following threat types are handled:
  • Potentially unwanted applications (PUA) are blocked
  • Archive bombs (file with a high compression rate) are audited to Microsoft Defender for Endpoint logs
• Enable automatic security intelligence updates
• Enable cloud-delivered protection
• Enable automatic sample submission

Property list for JAMF recommended configuration profile

Use the following property list in JAMF for the recommended configuration profile:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>antivirusEngine</key>
    <dict>
        <key>enforcementLevel</key>
        <string>real_time</string>
        <key>threatTypeSettings</key>
        <array>
            <dict>
                <key>key</key>
                <string>potentially_unwanted_application</string>
                <key>value</key>
                <string>block</string>
            </dict>
            <dict>
                <key>key</key>
                <string>archive_bomb</string>
                <key>value</key>
                <string>audit</string>
            </dict>
        </array>
    </dict>
    <key>cloudService</key>
    <dict>
        <key>enabled</key>
        <true/>
        <key>automaticSampleSubmission</key>
        <true/>
        <key>automaticDefinitionUpdateEnabled</key>
        <true/>
    </dict>
    <key>tamperProtection</key>
    <dict>
        <key>enforcementLevel</key>
        <string>block</string>
    </dict>
</dict>
</plist>

Intune recommended profile

Use the following XML for the recommended Intune profile:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
    <dict>
        <key>PayloadUUID</key>
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadOrganization</key>
        <string>Microsoft</string>
        <key>PayloadIdentifier</key>
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
        <key>PayloadDisplayName</key>
        <string>Microsoft Defender for Endpoint settings</string>
        <key>PayloadDescription</key>
        <string>Microsoft Defender for Endpoint configuration settings</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadEnabled</key>
        <true/>
        <key>PayloadRemovalDisallowed</key>
        <true/>
        <key>PayloadScope</key>
        <string>System</string>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadUUID</key>
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
                <key>PayloadType</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadOrganization</key>
                <string>Microsoft</string>
                <key>PayloadIdentifier</key>
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
                <key>PayloadDisplayName</key>
                <string>Microsoft Defender for Endpoint configuration settings</string>
                <key>PayloadDescription</key>
                <string/>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadEnabled</key>
                <true/>
                <key>antivirusEngine</key>
                <dict>
                    <key>enforcementLevel</key>
                    <string>real_time</string>
                    <key>threatTypeSettings</key>
                    <array>
                        <dict>
                            <key>key</key>
                            <string>potentially_unwanted_application</string>
                            <key>value</key>
                            <string>block</string>
                        </dict>
                        <dict>
                            <key>key</key>
                            <string>archive_bomb</string>
                            <key>value</key>
                            <string>audit</string>
                        </dict>
                    </array>
                </dict>
                <key>cloudService</key>
                <dict>
                    <key>enabled</key>
                    <true/>
                    <key>automaticSampleSubmission</key>
                    <true/>
                    <key>automaticDefinitionUpdateEnabled</key>
                    <true/>
                    <key>definitionUpdateDue</key>
                    <integer>7</integer>
                </dict>
                <key>tamperProtection</key>
                <dict>
                    <key>enforcementLevel</key>
                    <string>block</string>
                </dict>
            </dict>
        </array>
    </dict>
</plist>

Full configuration profile example

The following JAMF and Intune templates include all available Microsoft Defender for Endpoint on macOS settings. Use these templates for advanced scenarios where you need full control over every preference.

Property list for JAMF full configuration profile

The following complete plist shows a Defender for Endpoint configuration profile for JAMF with all available settings, including antivirus engine, cloud service, EDR, tamper protection, and user interface preferences:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>antivirusEngine</key>
    <dict>
        <key>enforcementLevel</key>
        <string>real_time</string>
        <key>scanAfterDefinitionUpdate</key>
        <true/>
        <key>scanArchives</key>
        <true/>
        <key>maximumOnDemandScanThreads</key>
        <integer>2</integer>
        <key>exclusions</key>
        <array>
            <dict>
                <key>$type</key>
                <string>excludedPath</string>
                <key>isDirectory</key>
                <false/>
                <key>path</key>
                <string>/var/log/system.log</string>
            </dict>
            <dict>
                <key>$type</key>
                <string>excludedPath</string>
                <key>isDirectory</key>
                <true/>
                <key>path</key>
                <string>/home</string>
            </dict>
            <dict>
                <key>$type</key>
                <string>excludedPath</string>
                <key>isDirectory</key>
                <true/>
                <key>path</key>
                <string>/Users/*/git</string>
            </dict>
            <dict>
                <key>$type</key>
                <string>excludedFileExtension</string>
                <key>extension</key>
                <string>pdf</string>
            </dict>
            <dict>
                <key>$type</key>
                <string>excludedFileName</string>
                <key>name</key>
                <string>cat</string>
            </dict>
        </array>
        <key>exclusionsMergePolicy</key>
        <string>merge</string>
        <key>allowedThreats</key>
        <array>
            <string>EICAR-Test-File (not a virus)</string>
        </array>
        <key>disallowedThreatActions</key>
        <array>
            <string>allow</string>
            <string>restore</string>
        </array>
        <key>threatTypeSettings</key>
        <array>
            <dict>
                <key>key</key>
                <string>potentially_unwanted_application</string>
                <key>value</key>
                <string>block</string>
            </dict>
            <dict>
                <key>key</key>
                <string>archive_bomb</string>
                <key>value</key>
                <string>audit</string>
            </dict>
        </array>
        <key>threatTypeSettingsMergePolicy</key>
        <string>merge</string>
    </dict>
    <key>cloudService</key>
    <dict>
        <key>enabled</key>
        <true/>
        <key>diagnosticLevel</key>
        <string>optional</string>
        <key>automaticSampleSubmission</key>
        <true/>
        <key>automaticDefinitionUpdateEnabled</key>
        <true/>
        <key>cloudBlockLevel</key>
        <string>normal</string>
        <key>definitionUpdateDue</key>
        <integer>7</integer>
    </dict>
    <key>edr</key>
    <dict>
        <key>tags</key>
        <array>
            <dict>
                <key>key</key>
                <string>GROUP</string>
                <key>value</key>
                <string>ExampleTag</string>
            </dict>
        </array>
    </dict>
    <key>tamperProtection</key>
    <dict>
        <key>enforcementLevel</key>
        <string>block</string>
        <key>exclusions</key>
        <array>
        <dict>
            <key>path</key>
            <string>/bin/zsh</string>
            <key>teamId</key>
            <string/>
            <key>signingId</key>
            <string>com.apple.zsh</string>
            <key>args</key>
            <array>
            <string>/usr/local/bin/test.sh</string>
            </array>
        </dict>
        <dict>
            <key>path</key>
            <string>/usr/local/jamf/bin/jamf</string>
            <key>teamId</key>
            <string>483DWKW443</string>
            <key>signingId</key>
            <string>com.jamfsoftware.jamf</string>
        </dict>
        </array>            
    </dict>
    <key>userInterface</key>
    <dict>
        <key>hideStatusMenuIcon</key>
        <false/>
        <key>userInitiatedFeedback</key>
        <string>enabled</string>
    </dict>
</dict>
</plist>

Intune full profile

The following mobile configuration payload wraps all available Defender for Endpoint macOS settings into a deployable Intune profile. It includes antivirus engine, cloud service, EDR, tamper protection, and user interface preferences:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
    <dict>
        <key>PayloadUUID</key>
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadOrganization</key>
        <string>Microsoft</string>
        <key>PayloadIdentifier</key>
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
        <key>PayloadDisplayName</key>
        <string>Microsoft Defender for Endpoint settings</string>
        <key>PayloadDescription</key>
        <string>Microsoft Defender for Endpoint configuration settings</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadEnabled</key>
        <true/>
        <key>PayloadRemovalDisallowed</key>
        <true/>
        <key>PayloadScope</key>
        <string>System</string>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadUUID</key>
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
                <key>PayloadType</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadOrganization</key>
                <string>Microsoft</string>
                <key>PayloadIdentifier</key>
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
                <key>PayloadDisplayName</key>
                <string>Microsoft Defender for Endpoint configuration settings</string>
                <key>PayloadDescription</key>
                <string/>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadEnabled</key>
                <true/>
                <key>antivirusEngine</key>
                <dict>
                    <key>enforcementLevel</key>
                    <string>real_time</string>
                    <key>behaviorMonitoring</key>
                    <string>enabled</string>
                    <key>scanAfterDefinitionUpdate</key>
                    <true/>
                    <key>scanArchives</key>
                    <true/>
                    <key>maximumOnDemandScanThreads</key>
                    <integer>1</integer>
                    <key>exclusions</key>
                    <array>
                        <dict>
                            <key>$type</key>
                            <string>excludedPath</string>
                            <key>isDirectory</key>
                            <false/>
                            <key>path</key>
                            <string>/var/log/system.log</string>
                        </dict>
                        <dict>
                            <key>$type</key>
                            <string>excludedPath</string>
                            <key>isDirectory</key>
                            <true/>
                            <key>path</key>
                            <string>/home</string>
                        </dict>
                        <dict>
                            <key>$type</key>
                            <string>excludedPath</string>
                            <key>isDirectory</key>
                            <true/>
                            <key>path</key>
                            <string>/Users/*/git</string>
                        </dict>
                        <dict>
                            <key>$type</key>
                            <string>excludedFileExtension</string>
                            <key>extension</key>
                            <string>pdf</string>
                        </dict>
                        <dict>
                            <key>$type</key>
                            <string>excludedFileName</string>
                            <key>name</key>
                            <string>cat</string>
                        </dict>
                    </array>
                    <key>exclusionsMergePolicy</key>
                    <string>merge</string>
                    <key>allowedThreats</key>
                    <array>
                        <string>EICAR-Test-File (not a virus)</string>
                    </array>
                    <key>disallowedThreatActions</key>
                    <array>
                        <string>allow</string>
                        <string>restore</string>
                    </array>
                    <key>threatTypeSettings</key>
                    <array>
                        <dict>
                            <key>key</key>
                            <string>potentially_unwanted_application</string>
                            <key>value</key>
                            <string>block</string>
                        </dict>
                        <dict>
                            <key>key</key>
                            <string>archive_bomb</string>
                            <key>value</key>
                            <string>audit</string>
                        </dict>
                    </array>
                    <key>threatTypeSettingsMergePolicy</key>
                    <string>merge</string>
                </dict>
                <key>cloudService</key>
                <dict>
                    <key>enabled</key>
                    <true/>
                    <key>diagnosticLevel</key>
                    <string>optional</string>
                    <key>automaticSampleSubmission</key>
                    <true/>
                    <key>automaticDefinitionUpdateEnabled</key>
                    <true/>
                    <key>cloudBlockLevel</key>
                    <string>normal</string>
                    <key>definitionUpdateDue</key>
                    <integer>7</integer>
                </dict>
                <key>edr</key>
                <dict>
                    <key>tags</key>
                    <array>
                        <dict>
                            <key>key</key>
                            <string>GROUP</string>
                            <key>value</key>
                            <string>ExampleTag</string>
                        </dict>
                    </array>
                </dict>
                <key>tamperProtection</key>
                <dict>
                    <key>enforcementLevel</key>
                    <string>block</string>
                    <key>exclusions</key>
                    <array>
                    <dict>
                        <key>path</key>
                        <string>/bin/zsh</string>
                        <key>teamId</key>
                        <string/>
                        <key>signingId</key>
                        <string>com.apple.zsh</string>
                        <key>args</key>
                        <array>
                        <string>/usr/local/bin/test.sh</string>
                        </array>
                    </dict>
                    <dict>
                        <key>path</key>
                        <string>/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon</string>
                        <key>teamId</key>
                        <string>UBF8T346G9</string>
                        <key>signingId</key>
                        <string>IntuneMdmDaemon</string>
                    </dict>
                    </array>            
                </dict>
                <key>userInterface</key>
                <dict>
                    <key>hideStatusMenuIcon</key>
                    <false/>
                    <key>userInitiatedFeedback</key>
                    <string>enabled</string>
                </dict>
            </dict>
        </array>
    </dict>
</plist>

Property list validation

The property list must be a valid .plist file. Validate the plist syntax before uploading or deploying the profile by running the following command:

plutil -lint com.microsoft.wdav.plist

If the plist is valid, you see output similar to the following:

com.microsoft.wdav.plist: OK

If the file is well-formed, the above command outputs OK and returns an exit code of 0. Otherwise, an error that describes the issue is displayed and the command returns an exit code of 1.

Configuration profile deployment

Once you've built the configuration profile for your enterprise, you can deploy it through your management console. See JAMF deployment and Intune deployment for step-by-step instructions.

JAMF deployment

Caution

You must use com.microsoft.wdav as the preference domain. If the domain is incorrect, Microsoft Defender for Endpoint won't recognize the preferences.

From the JAMF console, open Computers > Configuration Profiles, navigate to the configuration profile you'd like to use, then select Custom Settings. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist produced earlier.

Intune deployment

Caution

You must use com.microsoft.wdav as the custom configuration profile name. If the name is incorrect, Microsoft Defender for Endpoint won't recognize the preferences.

Use the following steps to deploy the configuration profile with Intune:

1. Open Devices > Configuration Profiles. Select Create Profile.

2. Choose a name for the profile. Change Platform=macOS to Profile type=Templates and choose Custom in the template name section. Select Configure.

3. Save the .plist produced earlier as com.microsoft.wdav.xml.

4. Enter com.microsoft.wdav as the custom configuration profile name.

5. Open the configuration profile and upload the com.microsoft.wdav.xml file. (This file was created in step 3.)

6. Select OK.

7. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

Related content

The following resource provides additional guidance on macOS configuration profiles:

• Configuration Profile Reference (Apple developer documentation)