|
| 1 | +--- |
| 2 | +title: Troubleshoot configuration issues for Microsoft Defender for Endpoint on Mac |
| 3 | +description: Troubleshoot configuration issues in Microsoft Defender for Endpoint on Mac. |
| 4 | +ms.service: defender-endpoint |
| 5 | +author: emmwalshh |
| 6 | +ms.author: ewalsh |
| 7 | +ms.reviewer: joshbregman |
| 8 | +manager: deniseb |
| 9 | +ms.localizationpriority: medium |
| 10 | +audience: ITPro |
| 11 | +ms.collection: |
| 12 | +- m365-security |
| 13 | +- tier3 |
| 14 | +- mde-macos |
| 15 | +ms.topic: conceptual |
| 16 | +ms.subservice: macos |
| 17 | +search.appverid: met150 |
| 18 | +ms.date: 04/30/2024 |
| 19 | +--- |
| 20 | + |
| 21 | +# Troubleshoot configuration issues for Microsoft Defender for Endpoint on macOS |
| 22 | + |
| 23 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] |
| 24 | + |
| 25 | + |
| 26 | +**Applies to:** |
| 27 | + |
| 28 | +- [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md) |
| 29 | +- [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md) |
| 30 | +- [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md) |
| 31 | +- [Microsoft Defender XDR](/defender-xdr) |
| 32 | + |
| 33 | +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630) |
| 34 | +
|
| 35 | +## Configuration isn't applied as expected |
| 36 | + |
| 37 | +You configured Microsoft Defender with settings that you need, and you don't see some (or all) of them applied. |
| 38 | +How to troubleshoot it? |
| 39 | + |
| 40 | +### Sources of configuration |
| 41 | + |
| 42 | +Microsoft Defender collects configuration from multiple sources. |
| 43 | + |
| 44 | +In almost all cases you can change configuration dynamically, and it will be applied immediately, with no restart required. |
| 45 | + |
| 46 | +Different sources have different priorities. |
| 47 | +When the same setting comes from more than one source, Microsoft Defender will merge values from different sources. |
| 48 | +In most cases it means that the value with the higher priority prevails, and sources from lower priorities are ignored. In some cases (for example, [Antivirus Exclusions](mac-preferences.md#exclusion-merge-policy)). Refer to configuration documentation for details. |
| 49 | + |
| 50 | +Configuration sources in the order of priority ("1" is the highest priority): |
| 51 | + |
| 52 | +1) MDE Attach, Defender configured in Intune portal |
| 53 | +2) [MDM configuration profile](mac-jamfpro-policies.md), configured using your MDM software |
| 54 | +3) [Local configuration](mac-resources.md#supported-output-types), that you made using `mdatp config ...` command as local administrator, or through Microsoft Defender's application |
| 55 | +4) Default setting that is used when you provided no explicit setting |
| 56 | + |
| 57 | +### MDE Attach and MDM Configuration profile |
| 58 | + |
| 59 | +> [!CAUTION] |
| 60 | +> MDE Attach and MDM Configuration Profile are mutually excluded. If you provide *some* configuration for both, then only MDE Attach settings are used, and *all* MDM settings are ignored! Don't use them together. |
| 61 | +
|
| 62 | +Use `mdatp health --field managed_by` to find out if you use MDE Attach. |
| 63 | + |
| 64 | +1) "MDE" indicates MDE Attach. Any configuration specified with an MDM configuration profile is ignored. |
| 65 | +2) "MEM" indicates MDM Configuration Profile, or only local configuration |
| 66 | + |
| 67 | +You can run `mdatp health` to get the configuration that Microsoft Defender is currently used. If you see "[managed]" next to a value, then it's currently configured through an MDM Configuration Profile. If there's no "[managed]", then it's configured locally or via MDE Attach. |
| 68 | + |
| 69 | +### MDE Attach and MDM configurations troubleshooting |
| 70 | + |
| 71 | +Check the following files: |
| 72 | + |
| 73 | +1) `/Library/Preferences/com.microsoft.mdeattach.plist` - Microsoft Defender reads this file for settings delivered by MDE Attach. If you expect some setting and you don't see it configured, then check that it's there |
| 74 | +2) `/Library/Managed Preferences/com.microsoft.wdav.plist` and `/Library/Managed Preferences/com.microsoft.wdav.ext.plist` - Microsoft Defender reads these files for settings delivered by MDM. |
| 75 | + |
| 76 | +The file paths and names must be exactly like described! If you see a similar but a bit different file path, then it means that Microsoft Defender ignores it. |
| 77 | + |
| 78 | +If you expect some MDM settings and don't see those files, it means that MDM has not delivered configuration profiles to your machine at all. |
| 79 | +To troubleshoot profiles delivery, consult your MDM software (JAMF, Intune, etc.) resources. |
| 80 | + |
| 81 | +If you expect some settings and you see those files, then check their content: |
| 82 | + |
| 83 | +``` |
| 84 | +> plutil -p '/Library/Managed Preferences/com.microsoft.wdav.plist |
| 85 | +{ |
| 86 | + "antivirusEngine" => { |
| 87 | + "enforcementLevel" => "real_time" |
| 88 | + } |
| 89 | +} |
| 90 | +``` |
| 91 | + |
| 92 | +Those settings must match those settings that you configured. |
| 93 | +Their names, level of indirection, type must be exactly as [documented](mac-preferences.md). |
| 94 | + |
| 95 | +For example, if `plist` tells you that "antivirusEngine" is inside a different group, then you can be confident that Microsoft Defender *ignores* "enforcementLevel" setting altogether: |
| 96 | +``` |
| 97 | +# Bad configuration! |
| 98 | +> plutil -p '/Library/Managed Preferences/com.microsoft.wdav.plist |
| 99 | +{ |
| 100 | + "Forced" => { |
| 101 | + "mcx_preference_settings" => { |
| 102 | + "antivirusEngine" => { |
| 103 | + "enforcementLevel" => "real_time" |
| 104 | + } |
| 105 | + } |
| 106 | + } |
| 107 | +} |
| 108 | +``` |
| 109 | + |
| 110 | +### MDM Configuration - where does it come from? |
| 111 | + |
| 112 | +macOS updates /Library/Managed Preferences/ files based on Profiles deployed over MDM. |
| 113 | + |
| 114 | +If you don't see an expected managed preferences file, or its content is different from what you expect, then open => System Settings => Profiles. |
| 115 | + |
| 116 | +You can see all profiles deployed over MDM under "Device (Managed)." Find a profile that you configured in MDM for Microsoft Defender configuration. |
| 117 | +You can open it and inspect its content. It must match what is in /Library/Managed Preferences/com.microsoft.wdav.plist and what you configured in MDM. |
| 118 | + |
| 119 | +If you don't see any managed profile for com.microsoft.wdav, then MDM didn't deliver it. Consult your MDM software documentation for troubleshooting, there can be multiple reasons why it happened, troubleshooting of MDM is out of scope for Microsoft Defender documentation. |
| 120 | + |
| 121 | +If you see *more than one* configuration profile for the same com.microsoft.wdav, then it can be the reason of not expected configuration of Microsoft Defender. |
| 122 | +macOS performs some merging of those profiles into a single .plist, but it can properly merge only the top level of configuration. |
| 123 | +I.e., you can't spread different "antivirusEngine" settings across two com.microsoft.wdav configuration profiles, MDM uses only one of them randomly, and ignore the rest. You can use extra com.microsoft.wdav.ext profile if you need to put settings to two profiles (again, there must be at most one configuration profile with com.microsoft.wdav.ext as well). |
| 124 | + |
| 125 | +In other words, avoid having more than one configuration profile for the same identifier. |
| 126 | + |
| 127 | +### MDE Attach Configuration - where does it come from? |
| 128 | + |
| 129 | +It isn't delivered over MDM. Consult MDE Attach documentation for how to troubleshoot it. |
0 commit comments