• Download a sample script to install Company Portal for macOS from Intune Shell Script Samples - Company Portal. Follow instructions to deploy the macOS Shell Script using macOS Shell Scripts. Set Run script as signed-in user to No (to run in the system context).
• Finally, assign it to whatever device groups you need. Devices in those groups will automatically download and install AutoCAD 2019. Alternatively, you can assign it to user groups and those users can install AutoCAD from the Company Portal app. That’s it; good luck!-Adam.

Adding the Citrix Workspace app as a line-of-business app in Microsoft Intune. Once the application has been created and assigned to users, it will be available for install in the Intune Company Portal. The application can also be set to required for automatic deployment. Citrix Workspace available in the Intune Company Portal on macOS.

Note

This documentation explains the legacy method for deploying and configuring Microsoft Defender for Endpoint on macOS devices. The native experience is now available in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and deploy the application and send it down to macOS devices.
The blog post MEM simplifies deployment of Microsoft Defender for Endpoint for macOS explains the new features. To configure the app, go to Settings for Microsoft Defender for Endpoint for Mac in Microsoft InTune. To deploy the app, go to Add Microsoft Defender for Endpoint to macOS devices using Microsoft Intune.

Applies to:

This topic describes how to deploy Microsoft Defender for Endpoint for Mac through Intune. A successful deployment requires the completion of all of the following steps:

Prerequisites and system requirements

Before you get started, see the main Microsoft Defender for Endpoint for Mac page for a description of prerequisites and system requirements for the current software version.

Overview

The following table summarizes the steps you would need to take to deploy and manage Microsoft Defender for Endpoint for Macs, via Intune. More detailed steps are available below.

Download installation and onboarding packages

Download the installation and onboarding packages from Microsoft Defender Security Center:

1. In Microsoft Defender Security Center, go to Settings > Device Management > Onboarding.

2. Set the operating system to macOS and the deployment method to Mobile Device Management / Microsoft Intune.

3. Select Download installation package. Save it as wdav.pkg to a local directory.

4. Select Download onboarding package. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.

5. Download IntuneAppUtil from https://docs.microsoft.com/intune/lob-apps-macos.

6. From a command prompt, verify that you have the three files.

7. Extract the contents of the .zip files:

8. Make IntuneAppUtil an executable:

9. Create the wdav.pkg.intunemac package from wdav.pkg:

Client device setup

You don't need any special provisioning for a Mac device beyond a standard Company Portal installation.

1. Confirm device management.

   Select Open System Preferences, locate Management Profile on the list, and select Approve.... Your Management Profile would be displayed as Verified:

2. Select Continue and complete the enrollment.

   You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.

3. In Intune, open Manage > Devices > All devices. Here you can see your device among those listed:

Approve System Extensions

To approve the system extensions:

1. In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.

2. Choose a name for the profile. Change Platform=macOS to Profile type=Extensions. Select Create.

3. In the Basics tab, give a name to this new profile.

4. In the Configuration settings tab, add the following entries in the Allowed system extensions section:

   Bundle identifier	Team identifier
   com.microsoft.wdav.epsext	UBF8T346G9
   com.microsoft.wdav.netext	UBF8T346G9

5. In the Assignments tab, assign this profile to All Users & All devices.

6. Review and create this configuration profile.

Create System Configuration profiles

1. In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.

2. Choose a name for the profile. Change Platform=macOS to Profile type=Custom. Select Configure.

3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.

4. Select OK.

5. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

6. Repeat steps 1 through 5 for more profiles.

7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file.

8. Download fulldisk.mobileconfig from our GitHub repository and save it as tcc.xml. Create another profile, give it any name and upload this file to it.

   Caution

   macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint is not able to fully protect your device.

   This configuration profile grants Full Disk Access to Microsoft Defender for Endpoint. If you previously configured Microsoft Defender for Endpoint through Intune, we recommend you update the deployment with this configuration profile.

9. As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality. Download netfilter.mobileconfig from our GitHub repository, save it as netext.xml and deploy it using the same steps as in the previous sections.

10. To allow Microsoft Defender for Endpoint for Mac and Microsoft Auto Update to display notifications in UI on macOS 10.15 (Catalina), download notif.mobileconfig from our GitHub repository and import it as a custom payload.

11. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

Once the Intune changes are propagated to the enrolled devices, you can see them listed under Monitor > Device status:

Publish application

1. In Intune, open the Manage > Client apps blade. Select Apps > Add.

2. Select App type=Other/Line-of-business app.

3. Select file=wdav.pkg.intunemac. Select OK to upload.

4. Select Configure and add the required information.

5. Use macOS High Sierra 10.14 as the minimum OS.

6. Set Ignore app version to Yes. Other settings can be any arbitrary value.

   Caution

   Setting Ignore app version to No impacts the ability of the application to receive updates through Microsoft AutoUpdate. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated.

   If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Microsoft Defender for Endpoint. This could result in a non-functioning application. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated. If you deployed Microsoft Defender for Endpoint with Ignore app version set to No, please change it to Yes. If Microsoft Defender for Endpoint still cannot be installed on a client device, then uninstall Microsoft Defender for Endpoint and push the updated policy.

7. Select OK and Add.

8. It may take a few moments to upload the package. After it's done, select the package from the list and go to Assignments and Add group.

9. Change Assignment type to Required.

10. Select Included Groups. Select Make this app required for all devices=Yes. Select Select group to include and add a group that contains the users you want to target. Select OK and Save.

11. After some time the application will be published to all enrolled devices. You can see it listed in Monitor > Device, under Device install status:

Verify client device state

1. After the configuration profiles are deployed to your devices, open System Preferences > Profiles on your Mac device.

   
   

2. Verify that the following configuration profiles are present and installed. The Management Profile should be the Intune system profile. Wdav-config and wdav-kext are system configuration profiles that were added in Intune:

3. You should also see the Microsoft Defender icon in the top-right corner:

Troubleshooting

Issue: No license found

Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml

Logging installation issues

For more information on how to find the automatically generated log that is created by the installer when an error occurs, see Logging installation issues.

Uninstallation

Intune Company Portal Download Mac Installer

Intune Company Portal Download Mac Mojave

See Uninstalling for details on how to remove Microsoft Defender for Endpoint for Mac from client devices.