Enroll Mac devices into Defender | Use these steps
Nick Ross · · Video and write-up
If your organization manages macOS devices, enabling continuous security monitoring is critical—especially with rising threats targeting all endpoints. Microsoft Defender for Endpoint provides 24/7 active vulnerability scanning for macOS, but setup requires several key steps. Here’s a high-level overview to help IT teams get started and scale deployment through automation.
🔧 Prerequisites & Setup Strategy
Before diving into configuration, ensure you’re set up for success:
- Apple Business Manager (ABM): Use ABM to procure and assign macOS devices to your MDM solution automatically.
- Intune Integration: Sync ABM with Microsoft Intune to automate enrollment and manage settings centrally. Get device enrolled so you can push out the necessary configurations to activate defender.
- Licensing: Defender for Endpoint is included with Microsoft 365 Business Premium (Defender for Business) and E5 (Plan 2).
If you want a full tutorial on device management for Intune with guidance on macOS, I have a whole course on udemy. Learn More (opens in new tab)
🛠️ Step-by-Step: Enroll macOS Devices into Defender
Microsoft provides a detailed help desk article (opens in new tab) on how to enroll macOS devices, but here’s a condensed walkthrough:
- Create Required Configuration Profiles in Intune:
- System Extensions
- Network Filters (download the config from GitHub)
- Full Disk Access
- Background Services
- Auto-Update Configuration (to ensure Defender stays current)
- Notifications, Bluetooth, Accessibility Permissions
- Set Antivirus Policies:
- Enable real-time protection
- Configure network protection and tamper protection
- Configure Endpoint Detection & Response (EDR):
- Set base-level EDR policies for macOS
- Deploy Microsoft Defender for Endpoint App:
- Use the predefined app in Intune’s app catalog
- Deploy Onboarding Package:
- Download from the Microsoft Defender portal
- Upload required
.xmland.kextfiles in Intune
- Validate Device Enrollment:
- Devices will begin to appear in Microsoft Defender
- Real-time alerts, software inventory, and exposure scores become available
✅ After Deployment
Once setup is complete, Defender begins scanning each macOS device for vulnerabilities automatically. The security admin center provides a rich dashboard to:
- View incidents and alerts
- Analyze exposure scores
- Track software inventory
- Deploy updates and remediations via Intune
🚀 Pro Tip: Automate Visibility into MacOS devices leveraging CloudCapsule
CloudCapsule makes it easy to gain instant visibility into your macOS fleet’s Defender enrollment status, policy health, and vulnerability exposure—without digging through multiple admin portals. Use it to track deployment progress, identify gaps, and surface security insights across all managed devices in one place.
Run a free security assessment on your tenant today to see where ou line up!
Harden it once, then know it stays that way.
CloudCapsule scans 300+ Microsoft 365 security controls in about a minute, shows what to fix first, fixes findings at scale, and flags drift the day a setting changes.
No credit card required. Results in < 2 minutes.
Keep reading
How to Set Up Claude SSO with Microsoft Entra ID (10-Minute Guide)
TLDR: You can set up Claude single sign-on (SSO) with Microsoft Entra ID in about 10 minutes on a paid Claude Team or Enterprise plan. The process has three parts: verify your company domain in Claude, connect Claude to Entra through Claude’s guided setup, and control access by assigning users or groups in Entra. Once […]
How to secure Claude AI for your Business
An employee opens Claude on their laptop. It is free, it is fast, and within ten minutes they have pasted in a contract, a financial summary, and a list of customer records, all because they are trying to get their job done. No audit trail. No admin visibility. And depending on their account settings, that […]
How Attackers wiped 80,000 Devices in Microsoft 365
On March 11th, 2026, employees at Stryker began their day to blank screens. Within three hours, roughly 80,000 devices had been wiped across the company’s 61-country footprint. Not encrypted. Not ransomed. Erased. No malware was involved. An Iran-linked hacktivist group compromised an admin account and used Microsoft’s own Intune remote wipe capability to erase the […]