Skip to content

Commit 13c6785

Browse files
Learn Editor: Update mac-device-control-jamf.md
1 parent 6bc92a1 commit 13c6785

File tree

1 file changed

+14
-4
lines changed

1 file changed

+14
-4
lines changed

defender-endpoint/mac-device-control-jamf.md

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,29 @@ Before you get started with Removable Storage Access Control, you must confirm y
4141

4242
## Deploy policy by using JAMF
4343

44-
### Step 1: Create policy JSON
44+
### Step 1: Creating a JSON policy
4545

46-
Now, you have 'groups' and 'rules' and 'settings', combine 'settings' and 'groups' and rules into one JSON, here's the demo file: [https://github.com/microsoft/mdatp-devicecontrol/blob/main/macOS/policy/samples/deny_removable_media_except_kingston.json](https://github.com/microsoft/mdatp-devicecontrol/blob/main/macOS/policy/samples/deny_removable_media_except_kingston.json). Make sure to validate your policy with the JSON schema so your policy format is correct: [https://github.com/microsoft/mdatp-devicecontrol/blob/main/macOS/policy/device_control_policy_schema.json](https://github.com/microsoft/mdatp-devicecontrol/blob/main/macOS/policy/device_control_policy_schema.json).
46+
Device Control on MacOS is defined through a JSON policy. This policy should have the appropriate groups, rules, and settings defined to tailor specific customer conditions. For example some enterprises might need to block all removable media devices entirely while others might have specific exceptions for a vendor or serial number. Microsoft has a [local Github repository](https://github.com/microsoft/mdatp-devicecontrol/tree/main/macOS/policy/samples"https://github.com/microsoft/mdatp-devicecontrol/tree/main/macos/policy/samples") that can be utilized as building blocks to assist enterprises in building their policies.
4747

4848
See [Device Control for macOS](mac-device-control-overview.md) for information about settings, rules, and groups.
4949

50-
### Step 2: Update MDE Preferences Schema
50+
### Step 2: Validating a JSON policy
51+
52+
Enterprises need to validate their JSON policies after it has been created to ensure there are no syntax or configuration errors. The schema for device control policies that is used can be [located here](https://github.com/microsoft/mdatp-devicecontrol/blob/main/macOS/policy/device_control_policy_schema.json"https://github.com/microsoft/mdatp-devicecontrol/blob/main/macos/policy/device_control_policy_schema.json"). The Defender application has a built in functionality to compare provided JSON to the defined schema. 
53+
54+
- Save your configuration on a local device as a .json file
55+
56+
- Ensure you have access to "mdatp" commands. If your device is already onboarded then you will have this functionality.
57+
58+
- Run **mdatp device-control policy validate --path <pathtojson>**
59+
60+
### Step 3: Update MDE Preferences Schema
5161

5262
The [MDE Preferences schema](https://github.com/microsoft/mdatp-xplat/blob/master/macos/schema/schema.json) is updated to include the new `deviceControl/policy` key. The existing MDE Preferences configuration profile should be updated to use the new schema file's content.
5363

5464
:::image type="content" source="media/macos-device-control-jamf-mde-preferences-schema.png" alt-text="Shows where to edit the Microsoft Defender for Endpoint Preferences Schema to update." lightbox="media/macos-device-control-jamf-mde-preferences-schema.png":::
5565

56-
### Step 3: Add Device Control Policy to MDE Preferences
66+
### Step 4: Add Device Control Policy to MDE Preferences
5767

5868
A new 'Device Control' property is now available to add to the UX.
5969

0 commit comments

Comments
 (0)