Onboard and offboard macOS devices into Microsoft Purview solutions using JAMF Pro

  • Article

You can use JAMF Pro to onboard macOS devices into Microsoft Purview solutions such as Endpoint data loss prevention (DLP).

Important

Use this procedure if you do not have Microsoft Defender for Endpoint (MDE) deployed to your macOS devices.

Applies to:

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Before you begin

  • Make sure your macOS devices are managed through JAMF pro and are associated with an identity (Microsoft Entra joined UPN) through JAMF Connect or Microsoft Intune.
  • OPTIONAL: Install the v95+ Microsoft Edge browser on your macOS devices for native Endpoint DLP support on Microsoft Edge.

Note

The three most recent major releases of macOS are supported.

Onboard devices into Microsoft Purview solutions using JAMF Pro

Onboarding a macOS device into Microsoft Purview solutions is a multi-phase process:

  1. Deploy onboarding packages
  2. Configure application preferences
  3. Upload the installation package
  4. Deploy System Configuration Profiles

Prerequisites

Download the following files.

File Description
mdatp.mobileconfig This is the bundled file.
schema.json This is the MDE preference file.

Tip

We recommend downloading the bundled mdatp.mobileconfig file, rather than the individual .mobileconfig files. The bundled file includes the following required files:

  • accessibility.mobileconfig
  • fulldisk.mobileconfig
  • netfilter.mobileconfig
  • sysext.mobileconfig

If any of these files are updated, you need to either download the updated bundle, or download each updated file individually.

Note

To download the files:

  1. Right-click the link and select Save link as....
  2. Choose a folder and save the file.

Get the device onboarding and installation packages

Screenshot of the Microsoft Intune Configuration settings tab with all fields populated.

  1. In the compliance portal, open Settings > Device Onboarding and then choose Onboarding.

  2. For the Select operating system to start onboarding process value, choose macOS.

  3. For Deployment method, choose Mobile Device Management/Microsoft Intune.

  4. Choose Download onboarding package and then extract the contents of the device onboarding package. the DeviceComplianceOnboarding.plist file is downloaded to the JAMF folder.

  5. Choose Download installation package.

Deploy onboarding packages

  1. Create a new configuration profile in JAMF Pro. Refer to the JAMF Pro documentation. Use the following values:

    • Name: MDATP onboarding for macOS
    • Description: *MDATP EDR onboarding for macOS
    • Category: none
    • Distribution method: *`install automatically
    • Level: computer level

  2. In the navigation pane, select Application and Custom Settings and then choose Upload.

  3. Choose Add. For Preference Domain, enter com.microsoft.wdav.atp

  4. Choose Upload, and select DeviceComplianceOnboarding.plist.

  5. Choose Save.

Configure application preferences

Important

You must use com.microsoft.wdav as the Preference Domain value. Microsoft Defender for Endpoint uses this name and com.microsoft.wdav.ext to load the managed settings.

  1. Sign in to JAMF Pro to create a new configuration profile in JAMF Pro. Refer to the JAMF Pro documentation for more information. Use these values:

    • Name: MDATP MDAV configuration settings
    • Description: Leave this blank
    • Category: none
    • Distribution method: install automatically
    • Level: computer level

  2. In the navigation pane, select Application and Custom Settings and then choose External Applications.

  3. Choose Add and then choose Custom Schema. For Preference domain, enter com.microsoft.wdav.

    Screenshot of the External Applications page.

  4. Choose Add Schema and then select the schema.json file you downloaded from GitHub.

  5. Choose Save.

  6. Under Preference Domain Properties manually update the settings as follows:

    • Features

      • For Data Loss Prevention, select enabled and then choose Save.

    • Antivirus engine
      If you are only deploying data loss prevention, you might need to configure the JAMF Pro antivirus engine. To do so, follow these steps:

      1. In JAMF Pro, on the Configuration Profiles page, scroll down to Antivirus engine under Preference Domain Properties.

      2. Make sure that both the Real-time protection and Passive mode options are in the list of Antivirus properties:

        Screenshot of the required antivirus engine configuration options

        If the Real-time protection or Passive mode options are not listed, take the following steps:

        1. Choose the Add/Remove Properties button.
        2. Scroll through the list of properties and select the missing property (either Real-time protection, Passive mode, or both).
        3. Choose Apply. The required properties now display in the list.

      3. Select Real-time protection and Passive mode.

      4. Save your changes.

  7. Enter a name for the configuration profile and then choose Save.

  8. On the next page, choose the Scope tab, select the appropriate targets for this configuration profile, and then choose Save.

Deploy system configuration profiles

  1. On the Configuration Profiles page of the JAMF Pro console, select Upload and then choose File.

  2. Select the mdatp.mobileconfig file, choose Open, and then choose Upload.

Upload the installation package

  1. In the JAMF Pro console, navigate to Management Settings > Packages and then choose New.

  2. Enter a display name for the package, and (optionally) select a category.

  3. Under Filename select Choose File.

  4. Select the wdav.pkg installation package file and then choose Save.

  5. Navigate to Computers > Policies and choose New.

  6. In the left navigation pane, choose Packages.

  7. From the Packages list, select the installation package from Step 4.

  8. For the Action choose Install.

  9. Choose the Scope tab and then target computers before choosing Save.

  10. On the General page, enter a name for the new policy.

Offboard macOS devices using JAMF Pro

Important

Offboarding causes the device to stop sending sensor data to the portal. However, data from the device, including references to any alerts it has had, will be retained for up to six months.

  1. If you are not using MDE, uninstall the application. See the Package Deployment section in the JAMF Pro documentation.

  2. Restart the macOS device. (Some applications may lose printing functionality until they're restarted.)