Enroll Mac devices into Defender | Use these steps

If your organization manages macOS devices, enabling continuous security monitoring is critical—especially with rising threats targeting all endpoints. Microsoft Defender for Endpoint provides 24/7 active vulnerability scanning for macOS, but setup requires several key steps. Here’s a high-level overview to help IT teams get started and scale deployment through automation.

🔧 Prerequisites & Setup Strategy#

Before diving into configuration, ensure you’re set up for success:

• Apple Business Manager (ABM): Use ABM to procure and assign macOS devices to your MDM solution automatically.
• Intune Integration: Sync ABM with Microsoft Intune to automate enrollment and manage settings centrally. Get device enrolled so you can push out the necessary configurations to activate defender.
• Licensing: Defender for Endpoint is included with Microsoft 365 Business Premium (Defender for Business) and E5 (Plan 2).

If you want a full tutorial on device management for Intune with guidance on macOS, I have a whole course on udemy. Learn More (opens in new tab)

🛠️ Step-by-Step: Enroll macOS Devices into Defender#

Microsoft provides a detailed help desk article (opens in new tab) on how to enroll macOS devices, but here’s a condensed walkthrough:

1. Create Required Configuration Profiles in Intune:
   • System Extensions
   • Network Filters (download the config from GitHub)
   • Full Disk Access
   • Background Services
   • Auto-Update Configuration (to ensure Defender stays current)
   • Notifications, Bluetooth, Accessibility Permissions
2. Set Antivirus Policies:
   • Enable real-time protection
   • Configure network protection and tamper protection
3. Configure Endpoint Detection & Response (EDR):
   • Set base-level EDR policies for macOS
4. Deploy Microsoft Defender for Endpoint App:
   • Use the predefined app in Intune’s app catalog
5. Deploy Onboarding Package:
   • Download from the Microsoft Defender portal
   • Upload required .xml and .kext files in Intune
6. Validate Device Enrollment:
   • Devices will begin to appear in Microsoft Defender
   • Real-time alerts, software inventory, and exposure scores become available

✅ After Deployment#

Once setup is complete, Defender begins scanning each macOS device for vulnerabilities automatically. The security admin center provides a rich dashboard to:

• View incidents and alerts
• Analyze exposure scores
• Track software inventory
• Deploy updates and remediations via Intune

🚀 Pro Tip: Automate Visibility into MacOS devices leveraging CloudCapsule#

CloudCapsule makes it easy to gain instant visibility into your macOS fleet’s Defender enrollment status, policy health, and vulnerability exposure—without digging through multiple admin portals. Use it to track deployment progress, identify gaps, and surface security insights across all managed devices in one place.

Run a free security assessment on your tenant today to see where ou line up!

Learn More (opens in new tab)