Edit

Network protection for macOS

  • Applies to: Microsoft Defender for Business

Network protection in Microsoft Defender for Endpoint helps prevent applications on macOS devices from connecting to dangerous domains.

Network protection expands the scope of Microsoft Defender SmartScreen to block all outbound HTTP and HTTPS traffic that attempts to connect to low-reputation sources in all major browsers. Blocks are based on the domain or host name.

Network protection on macOS supports the following security, investigation, and application control capabilities:

  • Custom indicators of compromise for domains and IP addresses.
  • Web content filtering supports the following actions:
    • Block website categories scoped to device groups through policies created in the Microsoft Defender portal.
    • Policies are applied to browsers, including Microsoft Edge for macOS.
  • Advanced hunting shows network events in the device timeline. You can query the events to support security investigations.
  • Microsoft Defender for Cloud Apps:
    • Shadow IT discovery identifies the apps used in your organization.
    • Application blocking prevents the use of entire applications, such as Slack and Facebook.
  • Corporate virtual private network (VPN) use with network protection:
    • Currently, no VPN conflicts are identified.
    • If you experience conflicts, provide feedback through the feedback channel at the end of this article.

Network protection for macOS is available for all onboarded Defender for Endpoint devices that meet the minimum requirements. All configured network protection and web threat protection policies are enforced on macOS devices where network protection is in block mode.

To roll out network protection for macOS, we recommend the following actions:

  • Create a device group with a small set of devices to test network protection.
  • Evaluate how web threat protection, custom indicators, web content filtering, and Microsoft Defender for Cloud Apps enforcement policies affect macOS devices where network protection is in block mode.
  • Deploy an audit-mode or block-mode policy to the device group, and verify that the policy doesn't disrupt workflows.
  • Gradually deploy network protection to larger device groups.

Use this article to review requirements, deploy network protection, and explore supported web protection scenarios.

Note

  • We don't recommend controlling network protection from System Preferences. Instead, use the configuration methods described in this article.
  • To evaluate the effectiveness of web threat protection on macOS, test it in a browser other than Microsoft Edge for macOS, such as Safari. Microsoft Edge for macOS has built-in web threat protection through SmartScreen, regardless of the network protection state.
  • There's a known application incompatibility with the VMware Per-App Tunnel feature. This incompatibility might prevent network protection from blocking traffic that goes through the tunnel.
  • There's a known application incompatibility with Blue Coat Proxy. This incompatibility might cause network-layer crashes in unrelated applications when Blue Coat Proxy and network protection are enabled.

Prerequisites

  • A Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2, trial, or Microsoft Defender for Business license.
  • An onboarded device that runs macOS Big Sur (11) or later and Defender for Endpoint version 101.94.13 (January 2023) or later.
  • A supported browser:
    • A non-Microsoft browser, such as Brave, Chrome, Opera, or Safari.
    • Microsoft Edge for macOS.

Note

SmartScreen in Microsoft Edge for macOS does not currently support web content filtering, custom indicators, or other enterprise features. However, network protection provides this protection to Microsoft Edge for macOS if network protection is enabled.

Browser configuration requirements

In processes other than Microsoft Edge, network protection determines the fully qualified domain name for each HTTPS connection by examining the Transport Layer Security (TLS) handshake that occurs after a TCP/IP handshake. The HTTPS connection must use TCP/IP instead of User Datagram Protocol (UDP) or Quick UDP Internet Connections (QUIC), and the ClientHello message must not be encrypted. To disable QUIC and Encrypted Client Hello, see the following articles:

Deployment instructions

Microsoft Defender for Endpoint

Install the most recent product version through Microsoft AutoUpdate. To open Microsoft AutoUpdate, run the following command from the Terminal:

open /Library/Application\ Support/Microsoft/MAU2.0/Microsoft\ AutoUpdate.app

Configure Defender for Endpoint with your organization information.

Network protection is disabled by default. You can configure one of the following enforcement levels:

  • Audit: Evaluate how network protection affects line-of-business applications and how often blocks occur.
  • Block: Prevent connections to malicious websites.
  • Disabled: Disable all network protection components.

Deploy network protection manually, with Jamf Pro, with Microsoft Intune, or with a .mobileconfig file.

Manual deployment

To configure the enforcement level, run the following command from the Terminal:

mdatp config network-protection enforcement-level --value <disabled | audit | block>

For example, the following command configures network protection in block mode:

mdatp config network-protection enforcement-level --value block

To confirm that network protection started successfully, run the following command from Terminal and verify that it returns started:

mdatp health --field network_protection_status

Jamf Pro deployment

A Jamf Pro deployment requires a configuration profile that sets the network protection enforcement level.

After you create this configuration profile, assign it to the devices where you want to enable network protection.

Configure the enforcement level

Note

If you already configured Defender for Endpoint on Mac by using a property list (plist) file, update the deployed file with the content in this section, and then redeploy it from Jamf Pro.

  1. In Computers > Configuration Profiles, select Options > Applications & Custom Settings.

  2. Select Upload File (PLIST file).

  3. Set preference domain to com.microsoft.wdav.

  4. Upload the following plist file to configure network protection in block mode.

    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>networkProtection</key>
    <dict>
        <key>enforcementLevel</key>
        <string>block</string>
    </dict>
</dict>
</plist>

Configure network protection in Microsoft Intune

Note

If you previously configured Defender for Endpoint on Mac by using an XML file, remove the previous custom configuration policy and replace it with a settings catalog policy.

Microsoft Intune is the recommended tool for configuring and distributing Defender for Endpoint features to devices. However, Intune is a separate product that isn't part of Defender for Endpoint, and it isn't included in all subscriptions. To use Intune, you need a subscription that includes it, or you can buy it separately as a standalone subscription or add-on. If you don't have Intune, you can use any of the other methods in this article. For more information, see Microsoft Intune licensing.

To configure network protection in Microsoft Intune, create or modify a settings catalog policy. For detailed instructions, see Create a policy using settings catalog in Microsoft Intune.

When you create the policy, use these specific settings:

When you create or modify the policy, add the following setting on the Configuration settings tab:

  • Enforcement level in the Network protection subcategory of the Microsoft Defender category: Select Block.

Assign the policy to the user or device groups where you want to enable network protection.

Mobileconfig deployment

To deploy the configuration with a .mobileconfig file, use a non-Microsoft mobile device management (MDM) solution or distribute the file directly to devices:

  1. Save the following payload as com.microsoft.wdav.xml.mobileconfig.

    <?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
    <dict>
        <key>PayloadUUID</key>
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadOrganization</key>
        <string>Microsoft</string>
        <key>PayloadIdentifier</key>
        <string>com.microsoft.wdav</string>
        <key>PayloadDisplayName</key>
        <string>Microsoft Defender ATP settings</string>
        <key>PayloadDescription</key>
        <string>Microsoft Defender ATP configuration settings</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadEnabled</key>
        <true/>
        <key>PayloadRemovalDisallowed</key>
        <true/>
        <key>PayloadScope</key>
        <string>System</string>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadUUID</key>
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
                <key>PayloadType</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadOrganization</key>
                <string>Microsoft</string>
                <key>PayloadIdentifier</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadDisplayName</key>
                <string>Microsoft Defender ATP configuration settings</string>
                <key>PayloadDescription</key>
                <string/>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadEnabled</key>
                <true/>
                <key>networkProtection</key>
                <dict>
                    <key>enforcementLevel</key>
                    <string>block</string>
                </dict>
            </dict>
        </array>
    </dict>
</plist>

  2. Verify that the file was copied correctly. In Terminal, run the following command and verify that it returns OK:

    plutil -lint com.microsoft.wdav.xml

Explore network protection features

  • Use web threat protection to help protect your organization against web threats. Web threat protection is part of web protection in Defender for Endpoint and uses network protection to secure devices.

  • Create indicators for IP addresses and domains to block custom indicators.

  • Explore web content filtering.

    Note

    Removing a policy while changing device groups might delay policy deployment.

    You can deploy a policy without selecting a category for a device group. This configuration creates an audit-only policy that helps you understand user behavior before you create a block policy.

    Device group creation is supported in Defender for Endpoint Plan 1 and Plan 2.

  • Integrate Defender for Endpoint with Defender for Cloud Apps to provide endpoint policy enforcement for macOS devices that use network protection.

    Note

    Discovery and other features are currently not supported on these platforms.

Scenarios

The following scenarios are supported.

Web threat protection

Web threat protection is part of web protection in Defender for Endpoint. It uses network protection to help protect devices from web threats in Microsoft Edge for macOS and non-Microsoft browsers, such as Brave, Chrome, Firefox, Opera, and Safari. It doesn't require a web proxy and protects devices on-premises and away from the organization. For browser requirements, see Prerequisites.

Web threat protection stops access to the following types of sites:

  • Phishing sites.
  • Malware vectors.
  • Exploit sites.
  • Untrusted or low-reputation sites.
  • Sites blocked by a custom indicator.

Screenshot of web protection reports showing web threat detections.

For more information, see Protect your organization against web threats.

Custom indicators of compromise

Indicator of compromise (IoC) matching lets security operations (SecOps) teams create a list of indicators for detection or blocking.

Create indicators that define the detection, prevention, and exclusion of entities. For each indicator, define the action, how long to apply the action, and the scope of the device group.

Currently supported sources are the cloud detection engine of Defender for Endpoint, the automated investigation and remediation engine, and the endpoint prevention engine (Microsoft Defender Antivirus).

Screenshot of the settings for adding a URL or domain indicator.

For more information, see Create indicators for IP addresses, URLs, or domains.

Web content filtering

Web content filtering is part of web protection in Defender for Endpoint and Microsoft Defender for Business. It helps your organization track and control access to websites based on content categories. Even websites that aren't malicious might be problematic because of compliance requirements, bandwidth usage, or other concerns.

Configure policies for device groups to block specific categories. Blocking a category prevents users in those groups from accessing associated URLs. URLs in categories that aren't blocked are automatically audited. Users can access the URLs without disruption, and you can use the access statistics to refine your policies. Users receive a notification when a webpage element calls a blocked resource.

Web content filtering supports major web browsers, including Brave, Chrome, Firefox, Opera, and Safari. Network protection enforces the blocks.

For more information about browser support, see Prerequisites.

Screenshot of settings for adding a web content filtering policy.

For more information about reporting, see Web content filtering.

Microsoft Defender for Cloud Apps

In Microsoft Defender for Cloud Apps, use the Cloud App Catalog to identify apps that should display a warning when users access them, and mark the apps as Monitored. The domains for monitored apps are then synchronized to Defender for Endpoint.

Screenshot of Cloud App Catalog settings for marking an app as monitored.

Within 10 to 15 minutes, the domains appear on the Indicators page in the Microsoft Defender portal at https://security.microsoft.com/securitysettings/endpoints/custom_ti_indicators. On the URLs/Domains tab, the Action value is Warn. Within the enforcement service-level agreement (SLA), users receive warnings when they try to access the domains.

Screenshot of monitored domains with the Warn action in the indicators list.

When a user tries to access a monitored domain, Defender for Endpoint blocks the access attempt. The operating system displays a notification that includes the name of the blocked application. For example, the notification might identify Blogger.com.

Screenshot of a macOS notification that identifies blocked web content.

The user can bypass the warning or open an educational webpage.

User bypass

  • In the notification, select Unblock, and then reload the webpage. The user can access the cloud app for 24 hours before they need to unblock it again.

User education

  • Select the notification to open the custom redirect URL configured globally in Defender for Cloud Apps.

Note

On the Application page in Defender for Cloud Apps, you can track how many users bypassed the warning for each app.

Screenshot of a Defender for Cloud Apps overview showing warning bypasses.

Appendix

End-user education center SharePoint site template

Use the cloud controls in Defender for Cloud Apps to set limitations when needed and to educate users about:

  • The specific incident.
  • Why the incident occurred.
  • The reason for the decision.
  • How users can avoid blocked sites.

Give users enough information to understand what happened and make informed choices the next time they select a cloud app. For example, include:

  • Your organization's security and compliance policies for internet and cloud use.
  • Approved or recommended cloud apps.
  • Restricted or blocked cloud apps.

Understand deployment timing and limitations

  • It can take up to two hours, but typically takes less time, for app domains to propagate to endpoint devices after you mark an app as Monitored.

  • By default, the action applies to all apps and domains marked as Monitored in Defender for Cloud Apps for all onboarded endpoints in the organization.

  • Full URLs are currently unsupported and aren't sent from Defender for Cloud Apps to Defender for Endpoint. If monitored apps contain full URLs, users aren't warned when they try to access the sites. For example, google.com/drive isn't supported, but drive.google.com is supported.

  • When testing, disable Encrypted Client Hello and QUIC so sites are blocked correctly. For browser configuration instructions, see Browser configuration requirements.

Tip

If notifications don't appear for non-Microsoft browsers, on the Notifications page in macOS System Settings, allow notifications from Microsoft Defender.

See also

  • Last updated on