Microsoft Intune App Wrapping Tool for macOS. Manage macOS line-of-business apps with Intune. See release notes for more information. Use the Microsoft Intune App Wrapping Tool for macOS to pre-process macOS line-of-business apps. The wrapping tool converts application installation files into the.intunemac format. Intune and Mac Device Management. Intune natively support Mac Device management. But, the Intune Mac device support is very generic. Jamf is the one third party solution which Microsoft advised all the organizations to look into if they are looking for more deep level management of Mac Devices with Intune. More details available https://nohuman. Hello everyone, today we have a fantastic article from Intune Sr. Support Engineer and resident Jamf expert Shonda Hodge.Shonda walks through the entire process of configuring integration of Microsoft Intune and Jamf Pro, creating and deploying policies and profiles, as well as enrolling and registering your Mac computers. Enroll your macOS device with the Intune Company Portal app to gain secure access to your work or school email, files, and apps. Organizations typically require you to enroll your device before you can access proprietary data. After your device is enrolled, it becomes managed. Your organization can assign policies and apps to the device through.

Note

This documentation explains the legacy method for deploying and configuring Microsoft Defender for Endpoint on macOS devices. The native experience is now available in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and deploy the application and send it down to macOS devices.
The blog post MEM simplifies deployment of Microsoft Defender for Endpoint for macOS explains the new features. To configure the app, go to Settings for Microsoft Defender for Endpoint for Mac in Microsoft InTune. To deploy the app, go to Add Microsoft Defender for Endpoint to macOS devices using Microsoft Intune.

Applies to:

This topic describes how to deploy Microsoft Defender for Endpoint for Mac through Intune. A successful deployment requires the completion of all of the following steps:

Prerequisites and system requirements

Before you get started, see the main Microsoft Defender for Endpoint for Mac page for a description of prerequisites and system requirements for the current software version.

Overview

The following table summarizes the steps you would need to take to deploy and manage Microsoft Defender for Endpoint for Macs, via Intune. More detailed steps are available below.

Download installation and onboarding packages

Download the installation and onboarding packages from Microsoft Defender Security Center:

1. In Microsoft Defender Security Center, go to Settings > Device Management > Onboarding.

2. Set the operating system to macOS and the deployment method to Mobile Device Management / Microsoft Intune.

3. Select Download installation package. Save it as wdav.pkg to a local directory.

4. Select Download onboarding package. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.

5. Download IntuneAppUtil from https://docs.microsoft.com/intune/lob-apps-macos.

6. From a command prompt, verify that you have the three files.

7. Extract the contents of the .zip files:

8. Make IntuneAppUtil an executable:

9. Create the wdav.pkg.intunemac package from wdav.pkg:

Client device setup

You don't need any special provisioning for a Mac device beyond a standard Company Portal installation.

1. Confirm device management.

   Select Open System Preferences, locate Management Profile on the list, and select Approve.... Your Management Profile would be displayed as Verified:

2. Select Continue and complete the enrollment.

   You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.

3. In Intune, open Manage > Devices > All devices. Here you can see your device among those listed:

Approve System Extensions

To approve the system extensions:

1. In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.

2. Choose a name for the profile. Change Platform=macOS to Profile type=Extensions. Select Create.

3. In the Basics tab, give a name to this new profile.

4. In the Configuration settings tab, add the following entries in the Allowed system extensions section:

   Bundle identifier	Team identifier
   com.microsoft.wdav.epsext	UBF8T346G9
   com.microsoft.wdav.netext	UBF8T346G9

5. In the Assignments tab, assign this profile to All Users & All devices.

6. Review and create this configuration profile.

Create System Configuration profiles

1. In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.

2. Choose a name for the profile. Change Platform=macOS to Profile type=Custom. Select Configure.

3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.

4. Select OK.

5. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

6. Repeat steps 1 through 5 for more profiles.

7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file.

8. Download fulldisk.mobileconfig from our GitHub repository and save it as tcc.xml. Create another profile, give it any name and upload this file to it.

   Caution

   macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint is not able to fully protect your device.

   This configuration profile grants Full Disk Access to Microsoft Defender for Endpoint. If you previously configured Microsoft Defender for Endpoint through Intune, we recommend you update the deployment with this configuration profile.

9. As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality. Download netfilter.mobileconfig from our GitHub repository, save it as netext.xml and deploy it using the same steps as in the previous sections.

10. To allow Microsoft Defender for Endpoint for Mac and Microsoft Auto Update to display notifications in UI on macOS 10.15 (Catalina), download notif.mobileconfig from our GitHub repository and import it as a custom payload.

11. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

Once the Intune changes are propagated to the enrolled devices, you can see them listed under Monitor > Device status:

Publish application

1. In Intune, open the Manage > Client apps blade. Select Apps > Add.

2. Select App type=Other/Line-of-business app.

3. Select file=wdav.pkg.intunemac. Select OK to upload.

4. Select Configure and add the required information.

5. Use macOS High Sierra 10.14 as the minimum OS.

6. Set Ignore app version to Yes. Other settings can be any arbitrary value.

   Caution

   Setting Ignore app version to No impacts the ability of the application to receive updates through Microsoft AutoUpdate. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated.

   If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Microsoft Defender for Endpoint. This could result in a non-functioning application. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated. If you deployed Microsoft Defender for Endpoint with Ignore app version set to No, please change it to Yes. If Microsoft Defender for Endpoint still cannot be installed on a client device, then uninstall Microsoft Defender for Endpoint and push the updated policy.

7. Select OK and Add.

8. It may take a few moments to upload the package. After it's done, select the package from the list and go to Assignments and Add group.

9. Change Assignment type to Required.

10. Select Included Groups. Select Make this app required for all devices=Yes. Select Select group to include and add a group that contains the users you want to target. Select OK and Save.

11. After some time the application will be published to all enrolled devices. You can see it listed in Monitor > Device, under Device install status:

Verify client device state

1. After the configuration profiles are deployed to your devices, open System Preferences > Profiles on your Mac device.

   
   

2. Verify that the following configuration profiles are present and installed. The Management Profile should be the Intune system profile. Wdav-config and wdav-kext are system configuration profiles that were added in Intune:

3. You should also see the Microsoft Defender icon in the top-right corner:

Troubleshooting

Issue: No license found

Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml

Logging installation issues

For more information on how to find the automatically generated log that is created by the installer when an error occurs, see Logging installation issues.

Uninstallation

Intune Download Mac App

See Uninstalling for details on how to remove Microsoft Defender for Endpoint for Mac from client devices.

Enroll your macOS device with the Intune Company Portal app to gain secure access to your work or school email, files, and apps.

Organizations typically require you to enroll your device before you can access proprietary data. After your device is enrolled, it becomes managed. Your organization can assign policies and apps to the device through a mobile device management (MDM) provider, such as Intune. To get continuous access to work or school information on your device, you must set up your device to match your organization's policy settings.

This article describes how to use the Company Portal app for macOS to set up and maintain your device so that you meet your organization's requirements.

What to expect from the Company Portal app

During initial setup, the Company Portal app requires you to sign in and authenticate yourself with your organization. Company Portal then informs you of any device settings you need to configure to meet your organization's requirements. For example, organizations often set minimum or maximum character password requirements that you'll be required to meet.

After you enroll your device, Company Portal will always make sure that your device is protected according to your organization's requirements. For example, if you install an app from a source that's not trusted, Company Portal will alert you and might restrict access to your organization's resources. App protection policies like this one are common. To regain access, you'll likely need to uninstall the app.

If after enrollment your organization enforces a new security requirement, such as multi-factor authentication, Company Portal will notify you. You'll have the chance to adjust your settings so that you can continue to work from your device.

To learn more about enrollment, see What happens when I install the Company Portal app and enroll my device?.

Get your macOS device managed

Use the following steps to enroll your macOS device with your organization. Your device must be running macOS 10.13 or later.

Note

Throughout this process, you might be prompted to allow Company Portal to use confidential information that's stored in your keychain. These prompts are part of Apple security. When you get the prompt, type in your login keychain password and select Always Allow. If you press Enter or Return on your keyboard, the prompt will instead select Allow, which may result in additional prompts.

Install Company Portal app

Intune Download Mac

1. Go to Enroll My Mac.
2. The Company Portal installer .pkg file will download. Open the installer and continue through the steps.
3. Agree to the software license agreement.
4. Enter your device password or registered fingerprint to install the software.
5. Open Company Portal.

Important

Microsoft AutoUpdate might open to update your Microsoft software. After all updates are installed, open the Company Portal app. For the best setup experience, install the latest versions of Microsoft AutoUpdate and Company Portal.

Intune Unternehmensportal Mac Download

Enroll your Mac

1. Sign in to Company Portal with your work or school account.

2. When the app opens, select Begin.

3. Review what your organization can and can't see on your enrolled device. Then select Continue.

4. On the Install management profile screen, select Download profile.

5. Your device's system preferences will open.
   a. Select Install and then select Install again.
   b. If you’re prompted to, enter your device password.

6. Once the profile is installed, it will appear in the profiles list under Management Profile.

7. Return to Company Portal.

8. Your organization might require you to update your device settings. When you're done updating settings, select Retry.

9. When setup is complete, select Done.

Troubleshooting and feedback

If you run into issues during enrollment, go to Help > Send Diagnostic Report to report the issue to Microsoft app developers. This information is used to help improve the app. They'll also use this information to help resolve the problem if your IT support person reaches out to them for help.

After you report the problem to Microsoft, you can send the details of your experience to your IT support person. Select Email Details. Type in what you experienced in the body of the email. To find your support person's email address, go to the Company Portal app > Contact. Or check the Company Portal website.

Additionally, the Microsoft Intune Company Portal team would love to hear your feedback. Go to Help > Send Feedback to share your thoughts and ideas.

Unverified profiles

When you view the installed mobile device management (MDM) profiles in System Preferences > Profiles, some profiles might show an unverified status. As long as the management profile shows a verified status, you don't need to be concerned.

Intune Download Mac Download

The management profile is what defines the MDM channel connection. As long as the management profile is verified, any other profiles delivered to the machine via that channel inherit the security traits of the management profile.

Updating the Company Portal app

Updating the Company Portal app is done the same way as any other Office app, through Microsoft AutoUpdate for macOS. Find out more about updating Microsoft apps for macOS.

Next Steps

Still need help? Contact your company support. For contact information, check the Company Portal website.