Installing MDE on MacOS, problem with System Extensions

Question

Hi,

When installing Microsoft Defender to MacOS Monterey 12.2.1 with local script, during the installer there is no popup for installing System Extensions.

After few hours when checking device again, HDD has used all the space. When checking used space /Library/SystemExtensions/.staging uses over 200Gb of space.
In this folder, there is lots of subfolders with different ID´s, all including same SystemExtensions that are located in Applications/Microsoft Defender/Contents/Library/SystemExtensions.

Any idea, what causes this?
Feels like OS is trying install SystemExtensions again and again, and is stuck some kind of loop, copying them in .staging folder all the time.

System is managed thru Workspace One, and I did installation thru remote program (TeamViewer) with local script.

Thanks!
Aazu

Answer 1

If I get you right, this is a manual installation, not deployed with MDM? If so, take a look here.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide

Open System Preferences > Security & Privacy and navigate to the Privacy tab. Grant Full Disk Access permission to Microsoft Defender and Microsoft Defenders Endpoint Security Extension.

Have you done this? And you need to reboot, at least I had to.

Answer 2

This makes sense. I have installed MDE on Mac manually and with Intune several times, and have never run into your issue.

Answer 3

Hi @Aaazuuu

The staging folder size is related with the maximum staging size configured for Microsoft Defender. The cleanup process is only called when 90% of the maximum staging configuration is reached.

You can find more details, and help to configure the folder size in the next community article:

https://techcommunity.microsoft.com/t5/storage-at-microsoft/why-is-my-staging-folder-so-big/ba-p/423665

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--