Effectblog963

-->

To manage devices, install optional apps, and gain access to resources protected by Conditional Access on macOS devices with user affinity, users must install and sign in to the Company Portal app. You can provide instructions to your users to install Company Portal for macOS or install it on devices already enrolled directly from Intune.

You can use any of the following options to install the Company Portal for macOS app:

Download a sample script to install Company Portal for macOS from Intune Shell Script Samples - Company Portal. Follow instructions to deploy the macOS Shell Script using macOS Shell Scripts. Set Run script as signed-in user to No (to run in the system context). Adding the Citrix Workspace app as a line-of-business app in Microsoft Intune. Once the application has been created and assigned to users, it will be available for install in the Intune Company Portal. The application can also be set to required for automatic deployment. Citrix Workspace available in the Intune Company Portal on macOS.

To help keep the apps more secure and up to date once installed, the Company Portal app comes with Microsoft AutoUpdate (MAU).

Note

The Company Portal app can only be installed automatically on devices using Intune that are already enrolled using direct enrolment or Automated Device Enrolment. For personal device or manual enrolment, the Company Portal app must be downloaded and installed to initiate enrollment. See Instruct users to download and install Company Portal.

Instruct users to download and install Company Portal

You can instruct users to download, install, and sign in to Company Portal for macOS. For instructions on downloading, installing, and signing into the Company Portal, see Enroll your macOS device using the Company Portal app.

Install Company Portal for macOS as a macOS LOB app

Company Portal for macOS can be downloaded and installed using the macOS LOB apps feature. The version downloaded is the version that will always be installed and may need to be updated periodically to ensure users get the best experience during initial enrollment.

Intune Company Portal Download Mac Installer

1. Download Company Portal for macOS from https://go.microsoft.com/fwlink/?linkid=853070.

2. Follow the instructions to create a macOS LOB app in macOS LOB apps.

Note

Once installed, the Company Portal for macOS app will automatically update using Microsoft AutoUpdate (MAU).

Install Company Portal for macOS by using a macOS Shell Script

Company Portal for macOS can be downloaded and installed using the macOS Shell Scripts feature. This option will always install the current version of Company Portal for macOS, but will not provide you with application install reporting you might be used to when deploying applications using macOS LOB apps.

1. Download a sample script to install Company Portal for macOS from Intune Shell Script Samples - Company Portal.

2. Follow instructions to deploy the macOS Shell Script using macOS Shell Scripts.

   • Set Run script as signed-in user to No (to run in the system context).
   • Set Maximum number of retries if script fails to 3.

Note

The script will require Internet access when it runs to download the current version of the Company Portal for macOS.

Next steps

• To learn more about assigning apps, see Assign apps to groups.
• To learn more about configuring Automated Device Enrollment, see Device Enrollment Program - Enroll macOS.
• To learn more about configuring Microsoft AutoUpdate settings on macOS, see Mac Updates.

Note

This documentation explains the legacy method for deploying and configuring Microsoft Defender for Endpoint on macOS devices. The native experience is now available in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and deploy the application and send it down to macOS devices.
The blog post MEM simplifies deployment of Microsoft Defender for Endpoint for macOS explains the new features. To configure the app, go to Settings for Microsoft Defender for Endpoint for Mac in Microsoft InTune. To deploy the app, go to Add Microsoft Defender for Endpoint to macOS devices using Microsoft Intune.

Intune Company Portal Download Mac Download

Applies to:

This topic describes how to deploy Microsoft Defender for Endpoint for Mac through Intune. A successful deployment requires the completion of all of the following steps:

Prerequisites and system requirements

Before you get started, see the main Microsoft Defender for Endpoint for Mac page for a description of prerequisites and system requirements for the current software version.

Overview

The following table summarizes the steps you would need to take to deploy and manage Microsoft Defender for Endpoint for Macs, via Intune. More detailed steps are available below.

Download installation and onboarding packages

Download the installation and onboarding packages from Microsoft Defender Security Center:

1. In Microsoft Defender Security Center, go to Settings > Device Management > Onboarding.

2. Set the operating system to macOS and the deployment method to Mobile Device Management / Microsoft Intune.

3. Select Download installation package. Save it as wdav.pkg to a local directory.

4. Select Download onboarding package. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.

5. Download IntuneAppUtil from https://docs.microsoft.com/intune/lob-apps-macos.

6. From a command prompt, verify that you have the three files.

7. Extract the contents of the .zip files:

8. Make IntuneAppUtil an executable:

9. Create the wdav.pkg.intunemac package from wdav.pkg:

Client device setup

You don't need any special provisioning for a Mac device beyond a standard Company Portal installation.

1. Confirm device management.

   Select Open System Preferences, locate Management Profile on the list, and select Approve.... Your Management Profile would be displayed as Verified:

2. Select Continue and complete the enrollment.

   You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.

3. In Intune, open Manage > Devices > All devices. Here you can see your device among those listed:

Approve System Extensions

To approve the system extensions:

1. In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.

2. Choose a name for the profile. Change Platform=macOS to Profile type=Extensions. Select Create.

3. In the Basics tab, give a name to this new profile.

4. In the Configuration settings tab, add the following entries in the Allowed system extensions section:

   Bundle identifier	Team identifier
   com.microsoft.wdav.epsext	UBF8T346G9
   com.microsoft.wdav.netext	UBF8T346G9

5. In the Assignments tab, assign this profile to All Users & All devices.

6. Review and create this configuration profile.

Create System Configuration profiles

1. In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.

2. Choose a name for the profile. Change Platform=macOS to Profile type=Custom. Select Configure.

3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections.

4. Select OK.

5. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

6. Repeat steps 1 through 5 for more profiles.

7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file.

8. Download fulldisk.mobileconfig from our GitHub repository and save it as tcc.xml. Create another profile, give it any name and upload this file to it.

   Caution

   macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint is not able to fully protect your device.

   This configuration profile grants Full Disk Access to Microsoft Defender for Endpoint. If you previously configured Microsoft Defender for Endpoint through Intune, we recommend you update the deployment with this configuration profile.

9. As part of the Endpoint Detection and Response capabilities, Microsoft Defender for Endpoint for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality. Download netfilter.mobileconfig from our GitHub repository, save it as netext.xml and deploy it using the same steps as in the previous sections.

10. To allow Microsoft Defender for Endpoint for Mac and Microsoft Auto Update to display notifications in UI on macOS 10.15 (Catalina), download notif.mobileconfig from our GitHub repository and import it as a custom payload.

11. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

Once the Intune changes are propagated to the enrolled devices, you can see them listed under Monitor > Device status:

Publish application

1. In Intune, open the Manage > Client apps blade. Select Apps > Add.

2. Select App type=Other/Line-of-business app.

3. Select file=wdav.pkg.intunemac. Select OK to upload.

4. Select Configure and add the required information.

5. Use macOS High Sierra 10.14 as the minimum OS.

6. Set Ignore app version to Yes. Other settings can be any arbitrary value.

   Caution

   Setting Ignore app version to No impacts the ability of the application to receive updates through Microsoft AutoUpdate. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated.

   If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Microsoft Defender for Endpoint. This could result in a non-functioning application. See Deploy updates for Microsoft Defender for Endpoint for Mac for additional information about how the product is updated. If you deployed Microsoft Defender for Endpoint with Ignore app version set to No, please change it to Yes. If Microsoft Defender for Endpoint still cannot be installed on a client device, then uninstall Microsoft Defender for Endpoint and push the updated policy.

7. Select OK and Add.

8. It may take a few moments to upload the package. After it's done, select the package from the list and go to Assignments and Add group.

9. Change Assignment type to Required.

10. Select Included Groups. Select Make this app required for all devices=Yes. Select Select group to include and add a group that contains the users you want to target. Select OK and Save.

11. After some time the application will be published to all enrolled devices. You can see it listed in Monitor > Device, under Device install status:

Verify client device state

1. After the configuration profiles are deployed to your devices, open System Preferences > Profiles on your Mac device.

   
   

2. Verify that the following configuration profiles are present and installed. The Management Profile should be the Intune system profile. Wdav-config and wdav-kext are system configuration profiles that were added in Intune:

3. You should also see the Microsoft Defender icon in the top-right corner:

Troubleshooting

Intune Company Portal Download Mac

Issue: No license found

Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml

Logging installation issues

Intune Company Portal Download Mac Os

For more information on how to find the automatically generated log that is created by the installer when an error occurs, see Logging installation issues.

Uninstallation

Intune Company Portal Download Macos

See Uninstalling for details on how to remove Microsoft Defender for Endpoint for Mac from client devices.