Onboard macOS devices into Microsoft 365 overview

MacOS devices can be onboarded into Microsoft Purview solutions using either Intune or JAMF Pro. The onboarding procedures differ depending on which management solution you are using. If your macOS devices have already been onboarded into Microsoft Defender for Endpoint (MDE), there are fewer steps. See Next steps for links to the appropriate procedures for you.

Applies to:

Tip

If you're not an E5 customer, you can try all the premium features in Microsoft Purview for free. Use the 90-day Purview solutions trial to explore how robust Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Before you begin

Before you get started with Endpoint DLP on macOS devices (three latest released versions), you should familiarize yourself with these articles:

If you are not familiar with DLP at all, you should familiarize yourself with these articles as well:

If you are not familiar with Insider Risk, you should familiarize yourself with these articles:

Your macOS devices must already be managed through Intune or JAMF Pro.

Supported browsers

Endpoint DLP supports these browsers on macOS (three latest released versions):

  • Microsoft Edge (latest version)
  • Safari (latest version, macOS only)
  • Chrome (latest version)
  • Firefox (latest version)

Licensing guidance

See, Microsoft 365 licensing guidance for information protection.

Activities that can be audited and restricted on macOS

Once a macOS device is onboarded into Microsoft Purview solutions, you can monitor and restrict these actions with data loss prevention (DLP) policies.

Copy to a USB removable media – when enforced, this action blocks, warns or audits the copying or moving of protected files from an endpoint device to USB removable media

Copy to network shares – when enforced, this action blocks, warns, or audits the copying or moving of protected files from an endpoint device to any network share

Print – when enforced, this action blocks, warns, or audits when protected files are printed from an endpoint device

Copy to clipboard – when enforced, this action blocks, warns, or audits data in protected file that is being copied to a clipboard on an endpoint device

Upload to cloud – this action blocks, warns, or audits when protected files are prevented from or allowed to be uploaded to cloud services based on the allow/unallowed domains list in global settings. When this action is set to warn or block, other browsers (defined on unallowed browsers list under Global settings) are blocked from accessing the file.

Accessed by unallowed apps – when enforced, this action prevents applications that are on the unallowed apps list (as defined in Global settings) from accessing protected files on an endpoint device. Sample scenarios

Onboarding devices into device management

You must enable device monitoring and onboard your endpoints before you can monitor and protect sensitive items on a device. Both of these actions are done in the Microsoft Purview compliance portal.

When you want to onboard devices that haven't been onboarded yet, you'll download the appropriate script and deploy it to those devices.

  1. Open the Microsoft Purview compliance portal Settings page and choose Enable device monitoring.

    Note

    While it usually takes about 60 seconds for device onboarding to be enabled, please allow up to 30 minutes before engaging with Microsoft support.

  2. Open the Compliance Center settings page and choose Turn on macOS device monitoring.

Next steps

Getting devices onboarding into Microsoft Purview solutions is required in order to receive DLP sensor telemetry and to enforce data loss prevention policies.

Topic Description
Intune For macOS devices that are managed through Intune
Intune for Microsoft Defender for Endpoint customers For macOS devices that are managed through Intune and that have Microsoft Defender for Endpoint (MDE) deployed to them
JAMF Pro For macOS devices that are managed through JAMF Pro
JAMF Pro for Microsoft Defender for Endpoint For macOS devices that are managed through JAMF Pro and that have Microsoft Defender for Endpoint (MDE) deployed to them