Skip to content

Commit 7183ea6

Browse files
Ruchika-mittal01Ruchika-mittal01
authored
Merge pull request #2613 from dkouzmanovMSFT/docs-editor/mac-device-control-overview-1738340821
Fix broken link to point to sample policies correctly
2 parents 85571c9 + ab72481 commit 7183ea6

File tree

1 file changed

+87
-87
lines changed

1 file changed

+87
-87
lines changed

‎defender-endpoint/mac-device-control-overview.md‎

Lines changed: 87 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.collection:
1515
ms.topic: conceptual
1616
ms.subservice: macos
1717
search.appverid: met150
18-
ms.date: 06/12/2024
18+
ms.date: 01/31/2025
1919
---
2020

2121
# Device Control for macOS
@@ -33,33 +33,30 @@ ms.date: 06/12/2024
3333
3434
## Requirements
3535

36-
Device Control for macOS has the following prerequisites:
36+
Device control for Mac has the following prerequisites:
3737

38-
> [!div class="checklist"]
39-
>
40-
> - Microsoft Defender for Endpoint entitlement (can be trial)
41-
> - Minimum OS version: macOS 11 or higher
42-
> - Minimum product version: 101.34.20
38+
- Defender for Endpoint or Defender for Business licenses (can be a trial subscription)
39+
- Minimum OS version: macOS 11 or higher
40+
- Minimum product version: `101.34.20`
4341

4442
## Overview
4543

46-
Microsoft Defender for Endpoint Device Control feature enables you to:
44+
Device control in Defender for Endpoint on macOS enables you to:
4745

4846
- Audit, allow, or prevent the read, write, or execute access to removable storage; and
4947
- Manage iOS and Portable devices, and Apple APFS encrypted devices and Bluetooth media, with or without exclusions.
5048

5149
## Prepare your endpoints
5250

53-
- Microsoft Defender for Endpoint entitlement (can be trial)
54-
- Minimum OS version: macOS 11 or higher
5551
- Deploy Full Disk Access: you might have created and deployed this [https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/fulldisk.mobileconfig](https://github.com/microsoft/mdatp-xplat/blob/master/macos/mobileconfig/profiles/fulldisk.mobileconfig) for other MDE features. You need to grant Full Disk Access permission for a new application: `com.microsoft.dlp.daemon`.
56-
- Enable Device Control on the MDE Preference setting:
5752

58-
- Data Loss Prevention (DLP)/Features/
53+
- Enable Device Control on your Defender for Endpoint preferences:
54+
55+
- Data Loss Prevention (DLP)/Features
5956

60-
- For **Feature Name**, enter "DC_in_dlp"
57+
- For **Feature Name**, type `DC_in_dlp`
6158

62-
- For **State**, enter "enabled"
59+
- For **State**, specify `enabled`
6360

6461
Example 1: JAMF using [schema.json](https://github.com/microsoft/mdatp-xplat/tree/master/macos/schema).
6562

@@ -72,36 +69,37 @@ Example 2: [demo.mobileconfig](https://github.com/microsoft/mdatp-devicecontrol/
7269
<dict>
7370
<key>features</key>
7471
<array>
75-
<dict>
76-
<key>name</key>
77-
<string>DC_in_dlp</string>
78-
<key>state</key>
79-
<string>enabled</string>
80-
</dict>
72+
<dict>
73+
<key>name</key>
74+
<string>DC_in_dlp</string>
75+
<key>state</key>
76+
<string>enabled</string>
77+
</dict>
8178
</array>
8279
</dict>
8380
```
8481

8582

8683
- Minimum product version: 101.91.92 or higher
87-
- Run _mdatp version_ through Terminal to see the product version on your client machine:
84+
85+
- Run `mdatp version` through Terminal to see the product version on your client machine:
8886

8987
:::image type="content" source="media/macos-device-control-mdatp-version-terminal.png " alt-text="Screenshot that shows the results when you run mdatp version in Terminal to see the product version on a client machine." lightbox="media/macos-device-control-mdatp-version-terminal.png ":::
9088

9189
## Understanding policies
9290

9391
Policies determine the behavior of device control for macOS. The policy is targeted via Intune or JAMF to a collection of machines or users.
9492

95-
The Device Control for macOS policy includes settings, groups, and rules:
93+
The device control for macOS policy includes settings, groups, and rules:
9694

9795
- Global setting called 'settings' allows you to define the global environment.
98-
- Group called 'groups' allows you to create media groups. For example, authorized USB group or encrypted USB group.
96+
- Group called `groups` allows you to create media groups. For example, authorized USB group or encrypted USB group.
9997
- Access policy rule called 'rules' allows you to create policy to restrict each group. For example, only allow authorized user to Write access-authorized USB group.
10098

10199

102100

103101
> [!NOTE]
104-
> We recommend you use the examples on the GitHub to understand the properties: [mdatp-devicecontrol/Removable Storage Access Control Samples/macOS/policy at main - microsoft/mdatp-devicecontrol (github.com)](https://github.com/microsoft/mdatp-devicecontrol/tree/main/Removable%20Storage%20Access%20Control%20Samples/macOS/policy).
102+
> We recommend you use the examples on the GitHub to understand the properties: [mdatp-devicecontrol/Removable Storage Access Control Samples/macOS/policy at main - microsoft/mdatp-devicecontrol (github.com)](https://github.com/microsoft/mdatp-devicecontrol/tree/main/macOS/policy/samples).
105103
>
106104
> You can also use the scripts at [mdatp-devicecontrol/tree/main/python#readme at main - microsoft/mdatp-devicecontrol (github.com)](https://github.com/microsoft/mdatp-devicecontrol/tree/main/python#readme) to translate Windows Device Control policy to macOS Device Control policy or translate macOS Device Control V1 policy to this V2 policy.
107105
@@ -112,9 +110,10 @@ The Device Control for macOS policy includes settings, groups, and rules:
112110

113111
Device control for macOS has similar capabilities to Device control for Windows, but macOS and Windows provide different underlying capabilities to manage devices, so there are some important differences:
114112

115-
- macOS doesn't have a centralized Device Manager or view of devices. Access is granted/denied to applications that interact with devices. This is why on macOS there are a richer set of [access types](#access-types). For example of a ```portableDevice``` device control for macOS can deny or allow ```download_photos_from_device```.
116-
- To stay consistent with Windows, there are ```generic_read```,```generic_write``` ,and ```generic_execute``` access types. Policies with generic access types don't need to be changed if/when more specific access types are added in the future. The best practice is to use generic access types unless there's a specific need to deny/allow a more specific operation.
117-
- Creating a ```deny``` policy using generic access types is the best way to attempt to completely block all operations for that type of device (for example, Android phones), but there might still be gaps if the operation is performed using an application that isn't supported by macOS device control.
113+
- macOS doesn't have a centralized Device Manager or view of devices. Access is granted/denied to applications that interact with devices. This is why on macOS there are a richer set of [access types](#access-types). For example, a `portableDevice` policy can deny or allow `download_photos_from_device`.
114+
115+
- To stay consistent with Windows, there are `generic_read`,`generic_write` , and `generic_execute` access types. Policies with generic access types don't need to be changed if/when more specific access types are added in the future. The best practice is to use generic access types unless there's a specific need to deny/allow a more specific operation.
116+
- Creating a `deny` policy using generic access types is the best way to attempt to completely block all operations for that type of device (for example, Android phones), but there might still be gaps if the operation is performed using an application that isn't supported by macOS device control.
118117

119118

120119
### Settings
@@ -123,7 +122,7 @@ Here are the properties you can use when you create the groups, rules, and setti
123122

124123
| Property name | Description | Options |
125124
|:---|:---|:---|
126-
| features | Feature specific configurations | You can set `disable` to false or true for following features: <br/>- `removableMedia`<br/>- `appleDevice`<br/>- `portableDevice`, including camera or PTP media<br/>- `bluetoothDevice`<br/><br/>The default is `true`, so if you don't configure this value, it won't apply even if you create a custom policy for `removableMedia`, because it's disabled by default. |
125+
| features | Feature specific configurations | You can set `disable` to false or true for following features: <br/>- `removableMedia`<br/>- `appleDevice`<br/>- `portableDevice`, including camera or PTP media<br/>- `bluetoothDevice`<br/><br/>The default is `true`, so if you don't configure this value, it doesn't apply, even if you create a custom policy for `removableMedia`, because it's disabled by default. |
127126
| global | Set default enforcement | You can set `defaultEnforcement` to<br/>- `allow` (_default_)<br/>- `deny` |
128127
| ux | You can set a hyperlink on notification. | `navigationTarget: string`. Example: `"http://www.microsoft.com"` |
129128

@@ -132,9 +131,9 @@ Here are the properties you can use when you create the groups, rules, and setti
132131
| Property name | Description | Options |
133132
|:---|:---|:---|
134133
| `$type` | The kind of group | "device" |
135-
| `id` | GUID, a unique ID, represents the group and will be used in the policy. | You can generate the ID through [New-Guid (Microsoft.PowerShell.Utility) - PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.2&preserve-view=true) or the uuidgen command on macOS |
134+
| `id` | GUID, a unique ID, represents the group and is used in the policy. | You can generate the ID through [New-Guid (Microsoft.PowerShell.Utility) - PowerShell](/powershell/module/microsoft.powershell.utility/new-guid?view=powershell-7.2&preserve-view=true) or the uuidgen command on macOS |
136135
| `name` | Friendly name for the group. | string |
137-
| `query` | The media coverage under this group | See the **query** properties tables below for details. |
136+
| `query` | The media coverage under this group | See the **query** property tables for details. |
138137

139138
### Query
140139

@@ -145,7 +144,7 @@ Query type 1 is as follows:
145144
| Property name | Description | Options |
146145
|:---|:---|:---|
147146
| `$type` | Identify the logical operation to perform on the clauses | **all**: Any attributes under the **clauses** are an _And_ relationship. For example, if the administrator puts `vendorId` and `serialNumber`, for every connected USB, the system checks to see whether the USB meets both values.<br> **and**: is equivalent to _all_ <br> **any:** The attributes under the **clauses** are _Or_ relationship. For example, if administrator puts `vendorId` and `serialNumber`, for every connected USB, system does the enforcement as long as the USB has either an identical `vendorId` or `serialNumber` value. <br> **or**: is equivalent to _any_ |
148-
| `clauses` | Use media device property to set group condition. | An array of clause objects that are evaluated to determine group membership. See the [Clause](#clause) section below. |
147+
| `clauses` | Use media device property to set group condition. | An array of clause objects that are evaluated to determine group membership. See the [Clause](#clause) section. |
149148

150149
Query type 2 is as follows:
151150

@@ -172,15 +171,15 @@ Query type 2 is as follows:
172171
| `productId` | Four digit hexadecimal string | Matches a device's product ID |
173172
| `serialNumber` | string | Matches a device's serial number. Doesn't match if the device doesn't have a serial number. |
174173
| `encryption` | apfs | Match if a device is apfs-encrypted. |
175-
| `groupId` | UUID string | Match if a device is a member of another group. The value represents the UUID of the group to match against. <br> The group must be defined within the policy prior to the clause. |
174+
| `groupId` | UUID string | Match if a device is a member of another group. The value represents the UUID of the group to match against. <br> The group must be defined within the policy before the clause. |
176175

177176
### Access policy rule
178177

179178
| Property name | Description | Options |
180179
|:---|:---|:---|
181-
| `id` | GUID, a unique ID, represents the rule and will be used in the policy. | New-Guid (Microsoft.PowerShell.Utility) - PowerShell <br> uuidgen |
182-
| `name` | String, the name of the policy and will display on the toast based on the policy setting. | |
183-
| `includeGroups` | The groups that the policy will be applied to. If multiple groups are specified, the policy applies to any media in all those groups. If not specified, the rule applies to all devices. | The **id** value inside the group must be used in this instance. If multiple groups are in the `includeGroups`, it's _AND_. <br/> `"includeGroups": ["3f082cd3-f701-4c21-9a6a-ed115c28e217"]` |
180+
| `id` | GUID, a unique ID, represents the rule and is used in the policy. | New-Guid (Microsoft.PowerShell.Utility) - PowerShell <br> uuidgen |
181+
| `name` | String, the name of the policy. Displays in the toast notification based on the policy setting. | |
182+
| `includeGroups` | The groups that the policy is applied to. If multiple groups are specified, the policy applies to any media in all those groups. If not specified, the rule applies to all devices. | The **id** value inside the group must be used in this instance. If multiple groups are in the `includeGroups`, it's _AND_. <br/> `"includeGroups": ["3f082cd3-f701-4c21-9a6a-ed115c28e217"]` |
184183
| `excludeGroups` | The groups that the policy doesn't apply to. | The **id** value inside the group must be used in this instance. If multiple groups are in the excludeGroups, it's _OR_. |
185184
| `entries` | One rule can have multiple entries; each entry with a unique GUID tells Device Control one restriction.| See entry properties table later in this article to get the details. |
186185

@@ -259,7 +258,7 @@ v2_full_disk_access : "approved"
259258
- `active` - feature version, you should see ["v2"]. (Device Control is enabled, but not configured.)
260259
- [] - Device Control isn't configured on this machine.
261260
- ["v1"] - You are on a preview version of Device Control. Migrate to version 2 using this guide. v1 is considered obsolete and not described in this documentation.
262-
- ["v1,""v2"] - You have both v1 and v2 enabled. Offboard from v1.
261+
- ["v1", "v2"] - You have both v1 and v2 enabled. Offboard from v1.
263262
- `v1_configured` - v1 configuration is applied
264263
- `v1_enforcement_level` - when v1 is enabled
265264
- `v2_configured` - v2 configuration is applied
@@ -284,27 +283,27 @@ In this scenario, you need to create two groups: one group for any removable med
284283
```json
285284
"settings": {
286285

287-
"features": {
286+
"features": {
288287

289-
"removableMedia": {
288+
"removableMedia": {
290289

291-
"disable": false
290+
"disable": false
292291

293-
}
292+
}
294293

295-
},
294+
},
296295

297-
"global": {
296+
"global": {
298297

299-
"defaultEnforcement": "allow"
298+
"defaultEnforcement": "allow"
300299

301-
},
300+
},
302301

303-
"ux": {
302+
"ux": {
304303

305-
"navigationTarget": "http://www.deskhelp.com"
304+
"navigationTarget": "http://www.deskhelp.com"
306305

307-
}
306+
}
308307

309308
}
310309
```
@@ -384,85 +383,85 @@ Create access policy rule and put into `rules`:
384383
```json
385384
"rules": [
386385

387-
{
386+
{
388387

389-
"id": "772cef80-229f-48b4-bd17-a69130092981",
388+
"id": "772cef80-229f-48b4-bd17-a69130092981",
390389

391-
"name": "Deny RWX to all Removable Media Devices except Kingston",
390+
"name": "Deny RWX to all Removable Media Devices except Kingston",
392391

393-
"includeGroups": [
392+
"includeGroups": [
394393

395-
"3f082cd3-f701-4c21-9a6a-ed115c28e211"
394+
"3f082cd3-f701-4c21-9a6a-ed115c28e211"
396395

397-
],
396+
],
398397

399-
"excludeGroups": [
398+
"excludeGroups": [
400399

401-
"3f082cd3-f701-4c21-9a6a-ed115c28e212"
400+
"3f082cd3-f701-4c21-9a6a-ed115c28e212"
402401

403-
],
402+
],
404403

405-
"entries": [
404+
"entries": [
406405

407-
{
406+
{
408407

409-
"$type": "removableMedia",
408+
"$type": "removableMedia",
410409

411-
"id": "A7CEE2F8-CE34-4B34-9CFE-4133F0361035",
410+
"id": "A7CEE2F8-CE34-4B34-9CFE-4133F0361035",
412411

413-
"enforcement": {
412+
"enforcement": {
414413

415-
"$type": "deny"
414+
"$type": "deny"
416415

417-
},
416+
},
418417

419-
"access": [
418+
"access": [
420419

421-
"read",
420+
"read",
422421

423-
"write",
422+
"write",
424423

425-
"execute"
424+
"execute"
426425

427-
]
426+
]
428427

429-
},
428+
},
430429

431-
{
430+
{
432431

433-
"$type": "removableMedia",
432+
"$type": "removableMedia",
434433

435-
"id": "18BA3DD5-4C9A-458B-A756-F1499FE94FB4",
434+
"id": "18BA3DD5-4C9A-458B-A756-F1499FE94FB4",
436435

437-
"enforcement": {
436+
"enforcement": {
438437

439-
"$type": "auditDeny",
438+
"$type": "auditDeny",
440439

441-
"options": [
440+
"options": [
442441

443-
"send_event",
442+
"send_event",
444443

445-
"show_notification"
444+
"show_notification"
446445

447-
]
446+
]
448447

449-
},
448+
},
450449

451-
"access": [
450+
"access": [
452451

453-
"read",
452+
"read",
454453

455-
"write",
454+
"write",
456455

457-
"execute"
456+
"execute"
458457

459-
]
458+
]
460459

461-
}
460+
}
462461

463-
]
462+
]
464463

465-
}
464+
}
466465

467466
]
468467
```
@@ -486,4 +485,5 @@ In this case, only have one access rule policy, but if you have multiple, make s
486485
- [Deploy Device Control by using JAMF](mac-device-control-jamf.md)
487486
- [Deploy Device Control manually](mac-device-control-manual.md)
488487
- [macOS Device Control frequently asked questions (FAQ)](mac-device-control-faq.md)
488+
489489
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

0 commit comments

Comments
 (0)