Microsoft Av For Mac
- Fixes or workarounds for recent issues in Word for Mac. Word 2016 for Mac Word for Mac 2011 More. Last updated: February 2020. Users may see issues with fonts when using version 16.9 of Microsoft Word, Excel, Outlook, OneNote and Microsoft PowerPoint on macOS. In Office 2016 for Mac, click the smiley icon in the upper-right corner.
- Nov 08, 2017 Microsoft extends Windows Defender ATP across macOS, Linux, iOS, and Android. Microsoft is extending Windows Defender Advanced Threat Protection (ATP) across even more platforms. As part of a partnership with Bitdefender, Lookout, and Ziften, Windows Defender ATP will soon be able to detect threats across macOS, Linux, iOS, and Android.
Applies to:
Mar 04, 2020 Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac Collecting diagnostic information If you can reproduce a problem, please increase the logging level, run the system for some time, and restore the logging level to the default.
Collecting diagnostic information
If you can reproduce a problem, please increase the logging level, run the system for some time, and restore the logging level to the default.
Increase logging level:
Reproduce the problem
Run
sudo mdatp --diagnostic --createto backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds.Restore logging level:
Logging installation issues
If an error occurs during installation, the installer will only report a general failure.
The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If you experience issues during installation, send us this file so we can help diagnose the cause.
Uninstalling
There are several ways to uninstall Microsoft Defender ATP for Mac. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune.
Interactive uninstallation
- Open Finder > Applications. Right click on Microsoft Defender ATP > Move to Trash.
From the command line
sudo rm -rf '/Applications/Microsoft Defender ATP.app'sudo rm -rf '/Library/Application Support/Microsoft/Defender/'
Configuring from the command line
Important tasks, such as controlling product settings and triggering on-demand scans, can be done from the command line:
| Group | Scenario | Command |
|---|---|---|
| Configuration | Turn on/off real-time protection | mdatp --config realTimeProtectionEnabled [true/false] |
| Configuration | Turn on/off cloud protection | mdatp --config cloudEnabled [true/false] |
| Configuration | Turn on/off product diagnostics | mdatp --config cloudDiagnosticEnabled [true/false] |
| Configuration | Turn on/off automatic sample submission | mdatp --config cloudAutomaticSampleSubmission [true/false] |
| Configuration | Turn on PUA protection | mdatp --threat --type-handling potentially_unwanted_application block |
| Configuration | Turn off PUA protection | mdatp --threat --type-handling potentially_unwanted_application off |
| Configuration | Turn on audit mode for PUA protection | mdatp --threat --type-handling potentially_unwanted_application audit |
| Diagnostics | Change the log level | mdatp --log-level [error/warning/info/verbose] |
| Diagnostics | Generate diagnostic logs | mdatp --diagnostic --create |
| Health | Check the product's health | mdatp --health |
| Protection | Scan a path | mdatp --scan --path [path] |
| Protection | Do a quick scan | mdatp --scan --quick |
| Protection | Do a full scan | mdatp --scan --full |
| Protection | Cancel an ongoing on-demand scan | mdatp --scan --cancel |
| Protection | Request a security intelligence update | mdatp --definition-update |
| EDR | Turn on/off EDR preview for Mac | mdatp --edr --early-preview [true/false] OR mdatp --edr --earlyPreview [true/false] for versions earlier than 100.78.0 |
| EDR | Add group tag to machine. EDR tags are used for managing machine groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups | mdatp --edr --set-tag GROUP [name] |
| EDR | Remove group tag from machine | mdatp --edr --remove-tag [name] |
Client Microsoft Defender ATP quarantine directory
/Library/Application Support/Microsoft/Defender/quarantine/ contains the files quarantined by mdatp. The files are named after the threat trackingId. The current trackingIds is shown with mdatp --threat --list --pretty.
Microsoft Defender ATP portal information
This blog provides detailed guidance on what to expect in Microsoft Defender ATP Security Center.
-->Applies to:
Important
This article contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise organizations. To configure Microsoft Defender ATP for Mac using the command-line interface, see Resources.
Summary
Free Av For Mac
In enterprise organizations, Microsoft Defender ATP for Mac can be managed through a configuration profile that is deployed by using one of several management tools. Preferences that are managed by your security operations team take precedence over preferences that are set locally on the device. Users in your organization are not able to change preferences that are set through the configuration profile.
This article describes the structure of the configuration profile, includes a recommended profile that you can use to get started, and provides instructions on how to deploy the profile.
Configuration profile structure
The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences.
Caution
The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune.
The top level of the configuration profile includes product-wide preferences and entries for subareas of Microsoft Defender ATP, which are explained in more detail in the next sections.
Microsoft Applications For Mac
Antivirus engine preferences
The antivirusEngine section of the configuration profile is used to manage the preferences of the antivirus component of Microsoft Defender ATP.
| Domain | com.microsoft.wdav |
| Key | antivirusEngine |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
Enable / disable real-time protection
Specify whether to enable real-time protection, which scans files as they are accessed. Microsoft internet explorer for mac high sierra.
| Domain | com.microsoft.wdav |
| Key | enableRealTimeProtection |
| Data type | Boolean |
| Possible values | true (default) false |
Enable / disable passive mode
Specify whether the antivirus engine runs in passive mode. Passive mode has the following implications:
- Real-time protection is turned off
- On-demand scanning is turned on
- Automatic threat remediation is turned off
- Security intelligence updates are turned on
- Status menu icon is hidden
| Domain | com.microsoft.wdav |
| Key | passiveMode |
| Data type | Boolean |
| Possible values | false (default) true |
| Comments | Available in Microsoft Defender ATP version 100.67.60 or higher. |
Exclusion merge policy
Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (merge) or only administrator-defined exclusions (admin_only). This setting can be used to restrict local users from defining their own exclusions.
Microsoft Virus Mac
| Domain | com.microsoft.wdav |
| Key | exclusionsMergePolicy |
| Data type | String |
| Possible values | merge (default) admin_only |
| Comments | Available in Microsoft Defender ATP version 100.83.73 or higher. |
Scan exclusions
Specify entities excluded from being scanned. Exclusions can be specified by full paths, extensions, or file names.
| Domain | com.microsoft.wdav |
| Key | exclusions |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
Type of exclusion
Specify content excluded from being scanned by type.
| Domain | com.microsoft.wdav |
| Key | $type |
| Data type | String |
| Possible values | excludedPath excludedFileExtension excludedFileName |
Path to excluded content
Specify content excluded from being scanned by full file path.
| Domain | com.microsoft.wdav |
| Key | path |
| Data type | String |
| Possible values | valid paths |
| Comments | Applicable only if $type is excludedPath |
Path type (file / directory)
Indicate if the path property refers to a file or directory.
| Domain | com.microsoft.wdav |
| Key | isDirectory |
| Data type | Boolean |
| Possible values | false (default) true |
| Comments | Applicable only if $type is excludedPath |
File extension excluded from the scan
Specify content excluded from being scanned by file extension.
| Domain | com.microsoft.wdav |
| Key | extension |
| Data type | String |
| Possible values | valid file extensions |
| Comments | Applicable only if $type is excludedFileExtension |
Process excluded from the scan
Specify a process for which all file activity is excluded from scanning. The process can be specified either by its name (e.g. cat) or full path (e.g. /bin/cat).
| Domain | com.microsoft.wdav |
| Key | name |
| Data type | String |
| Possible values | any string |
| Comments | Applicable only if $type is excludedFileName |
Allowed threats
Specify threats by name that are not blocked by Microsoft Defender ATP for Mac. These threats will be allowed to run.
| Domain | com.microsoft.wdav |
| Key | allowedThreats |
| Data type | Array of strings |
Disallowed threat actions
Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list are not displayed in the user interface.
| Domain | com.microsoft.wdav |
| Key | disallowedThreatActions |
| Data type | Array of strings |
| Possible values | allow (restricts users from allowing threats) restore (restricts users from restoring threats from the quarantine) |
| Comments | Available in Microsoft Defender ATP version 100.83.73 or higher. |
Threat type settings
Specify how certain threat types are handled by Microsoft Defender ATP for Mac.
| Domain | com.microsoft.wdav |
| Key | threatTypeSettings |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
Threat type
Specify threat types.
| Domain | com.microsoft.wdav |
| Key | key |
| Data type | String |
| Possible values | potentially_unwanted_application archive_bomb |
Action to take
Specify what action to take when a threat of the type specified in the preceding section is detected. Choose from the following options:
- Audit: your device is not protected against this type of threat, but an entry about the threat is logged.
- Block: your device is protected against this type of threat and you are notified in the user interface and the security console.
- Off: your device is not protected against this type of threat and nothing is logged.
| Domain | com.microsoft.wdav |
| Key | value |
| Data type | String |
| Possible values | audit (default) block off |
Threat type settings merge policy
Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (merge) or only administrator-defined settings (admin_only). This setting can be used to restrict local users from defining their own settings for different threat types.
| Domain | com.microsoft.wdav |
| Key | threatTypeSettingsMergePolicy |
| Data type | String |
| Possible values | merge (default) admin_only |
| Comments | Available in Microsoft Defender ATP version 100.83.73 or higher. |
Cloud-delivered protection preferences
Configure the cloud-driven protection features of Microsoft Defender ATP for Mac.
| Domain | com.microsoft.wdav |
| Key | cloudService |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
Enable / disable cloud-delivered protection
Specify whether to enable cloud-delivered protection the device or not. To improve the security of your services, we recommend keeping this feature turned on.
| Domain | com.microsoft.wdav |
| Key | enabled |
| Data type | Boolean |
| Possible values | true (default) false |
Diagnostic collection level
Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by Microsoft Defender ATP to Microsoft.
| Domain | com.microsoft.wdav |
| Key | diagnosticLevel |
| Data type | String |
| Possible values | optional (default) required |
Enable / disable automatic sample submissions
Determines whether suspicious samples (that are likely to contain threats) are sent to Microsoft. You are prompted if the submitted file is likely to contain personal information.
| Domain | com.microsoft.wdav |
| Key | automaticSampleSubmission |
| Data type | Boolean |
| Possible values | true (default) false |
User interface preferences
Manage the preferences for the user interface of Microsoft Defender ATP for Mac.
| Domain | com.microsoft.wdav |
| Key | userInterface |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
Show / hide status menu icon
Specify whether to show or hide the status menu icon in the top-right corner of the screen.
| Domain | com.microsoft.wdav |
| Key | hideStatusMenuIcon |
| Data type | Boolean |
| Possible values | false (default) true |
Endpoint detection and response preferences
Manage the preferences of the endpoint detection and response (EDR) component of Microsoft Defender ATP for Mac.
| Domain | com.microsoft.wdav |
| Key | edr |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
Device tags
Specify a tag name and its value.
- The GROUP tag, tags the machine with the specified value. The tag is reflected in the portal under the machine page and can be used for filtering and grouping machines.
| Domain | com.microsoft.wdav |
| Key | tags |
| Data type | Dictionary (nested preference) |
| Comments | See the following sections for a description of the dictionary contents. |
Type of tag
Specifies the type of tag
| Domain | com.microsoft.wdav |
| Key | key |
| Data type | String |
| Possible values | GROUP |
Value of tag
Specifies the value of tag
| Domain | com.microsoft.wdav |
| Key | value |
| Data type | String |
| Possible values | any string |
Important
- Only one value per tag type can be set.
- Type of tags are unique, and should not be repeated in the same configuration profile.
Recommended configuration profile
To get started, we recommend the following configuration for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides.
The following configuration profile (or, in case of JAMF, a property list that could be uploaded into the custom settings configuration profile) will:
- Enable real-time protection (RTP)
- Specify how the following threat types are handled:
- Potentially unwanted applications (PUA) are blocked
- Archive bombs (file with a high compression rate) are audited to Microsoft Defender ATP logs
- Enable cloud-delivered protection
- Enable automatic sample submission
Property list for JAMF configuration profile
Intune profile
Full configuration profile example
The following templates contain entries for all settings described in this document and can be used for more advanced scenarios where you want more control over Microsoft Defender ATP for Mac.
Property list for JAMF configuration profile
Intune profile
Property list validation
The property list must be a valid .plist file. This can be checked by executing:
If the file is well-formed, the above command outputs OK and returns an exit code of 0. Otherwise, an error that describes the issue is displayed and the command returns an exit code of 1.
Configuration profile deployment
Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune.
Microsoft office 365 mac version. OneNote for Mac is available for the first time and for free. People frequently asked us for OneNote on Mac, and for more ways to capture content.Today we’re excited to complete that story with three major developments:. We’ve already made a lot of progress in that direction with our mobile, tablet and online web experiences. But there was still a gap.
JAMF deployment
From the JAMF console, open Computers > Configuration Profiles, navigate to the configuration profile you'd like to use, then select Custom Settings. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist produced earlier.
Caution
You must enter the correct preference domain (com.microsoft.wdav); otherwise, the preferences will not be recognized by Microsoft Defender ATP.
Intune deployment
Open Manage > Device configuration. Select Manage > Profiles > Create Profile.
Choose a name for the profile. Change Platform=macOS to Profile type=Custom. Select Configure.
Save the .plist produced earlier as
com.microsoft.wdav.xml.Enter
com.microsoft.wdavas the custom configuration profile name.Open the configuration profile and upload the
com.microsoft.wdav.xmlfile. (This file was created in step 3.)Select OK.
Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.
Caution
You must enter the correct custom configuration profile name; otherwise, these preferences will not be recognized by Microsoft Defender ATP.