Microsoft Defender for Endpoint Upgrade Readiness MacOS Big Sur

TanTran · ‎Dec 24 2020

Hi IT Pros,

Today we discuss about preparing our MD for Endpoint on Organization’s MacOS Systems and make them ready for “Big Sur”, the greatest and latest version of Mac operating system which is released by Apple on the 12^th of November, 2020. Big Sur enhance MDM (Mobile Device Management) protocol as key for automated device enrollment, content caching and managing apps.

Big Sur’s code running process has been moved from kernel extensions (KEXTs) to system extensions for security reason.

Microsoft Endpoint Manager now supports the following new device configurations on MacOS Big Sur :

Non-OS software updates deferral
“Enable direct download” setting for associated domains
Support for 4096-bit SCEP certificate keys
Prevent users from disabling automatic VPN
Excluded Domains for per-app VPN connections

Microsoft released an update to Microsoft Defender for Endpoint MacOS that will leverage new system extensions instead of kernel extensions with the following details:

An update to the Microsoft Defender ATP for Mac agent is required on all eligible macOS of previous versions prior to moving these devices to macOS 11.
The update is applicable to devices running macOS version 10.15.4 or later.
To ensure that the Microsoft Defender ATP for Mac update is delivered and applied seamlessly from an end-user experience perspective, a new remote configuration must be deployed to all eligible macOS devices before Microsoft publishes the new agent version.
If the configuration is not deployed prior to the Microsoft Defender ATP for Mac agent update, end-users will be presented with a series of system dialogs asking to grant the agent all necessary permissions associated with the new system extensions.

Even though Microsoft Defender ATP for Mac new implementation based on system extensions is only applicable to devices running macOS version 10.15.4 or later, deploying configuration proactively across the entire macOS fleet will have two benefits:

ensure that even down-level devices are ready for macOS 11 Big Sur upgrade
ensure that Microsoft Defender ATP for Mac continues protecting all macOS devices regardless OS version they were running prior to the Big Sur upgrade.

For Big Sur on Apple M1 Chip to be supported in the near future, Microsoft program team is working on the Defender for Endpoint for MacOS with M1 Chip and will release update for that sometime in the first half of 2021 according to the information provided by Sr. Program Manager. ( For Microsoft 365 and Office 2019, they have already been supporting for Apple Silicon, M1 Chip)

New configuration profiles for macOS Catalina and newer.

You could deploy the Configuration Profile Policies by JAMF or Microsoft Endpoint Manager as your deployment tool. There are Configuration Profiles and Preference Control Policy that need to be deployed:

System Extension configuration profile
Privacy Preferences Policy Control, granting Full Disk Access to the Microsoft Defender ATP Endpoint Security Extension
Network Extension configuration profile

Option 1: JAMF Deployment
- System Extension configuration profile

> In Computers > Configuration Profiles select Options > System Extensions.

Select Allowed System Extensions from the System Extension Types drop-down list.

Use UBF8T346G9 for Team Id.

Add the following bundle identifiers to the Allowed System Extensions list:

com.microsoft.wdav.epsext

com.microsoft.wdav.netext

Privacy Preferences Policy Control

Add the following JAMF payload to grant Full Disk Access to the Microsoft Defender ATP Endpoint Security Extension. This policy is a pre-requisite for running the extension on your device.

> Select Options > Privacy Preferences Policy Control.

Use com.microsoft.wdav.epsext as the Identifier and Bundle ID as Bundle type.

Set Code Requirement to identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9

Set App or service to SystemPolicyAllFiles and access to Allow.

Network Extension Policy

As part of the Endpoint Detection and Response capabilities, Microsoft Defender ATP for Mac inspects socket traffic and reports this information to the Microsoft Defender Security Center portal. The following policy allows the network extension to perform this functionality.

Note

JAMF doesn’t have built-in support for content filtering policies, which are a pre-requisite for enabling the network extensions that Microsoft Defender ATP for Mac installs on the device. Furthermore, JAMF sometimes changes the content of the policies being deployed. As such, the following steps provide a workaround that involve signing the configuration profile.

Save the following content to your device as com.microsoft.network-extension.mobileconfig using a text editor:XML

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>PayloadUUID</key>

<key>PayloadType</key>

<string>Configuration</string>

<key>PayloadOrganization</key>

<string>Microsoft Corporation</string>

<key>PayloadIdentifier</key>

<key>PayloadDisplayName</key>

<string>Microsoft Defender ATP Network Extension</string>

<key>PayloadDescription</key>

<key>PayloadVersion</key>

<key>PayloadEnabled</key>

<true/>

<key>PayloadRemovalDisallowed</key>

<true/>

<key>PayloadScope</key>

<string>System</string>

<key>PayloadContent</key>

<array>

<dict>

<key>PayloadUUID</key>

<key>PayloadType</key>

<string>com.apple.webcontent-filter</string>

<key>PayloadOrganization</key>

<string>Microsoft Corporation</string>

<key>PayloadIdentifier</key>

<key>PayloadDisplayName</key>

<string>Approved Network Extension</string>

<key>PayloadDescription</key>

<key>PayloadVersion</key>

<key>PayloadEnabled</key>

<true/>

<key>FilterType</key>

<string>Plugin</string>

<key>UserDefinedName</key>

<string>Microsoft Defender ATP Network Extension</string>

<key>PluginBundleID</key>

<string>com.microsoft.wdav</string>

<key>FilterSockets</key>

<true/>

<key>FilterDataProviderBundleIdentifier</key>

<string>com.microsoft.wdav.netext</string>

<key>FilterDataProviderDesignatedRequirement</key>

<string>identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9</string>

</dict>

</array>

</dict>

</plist>

Verify that the above file was copied correctly by running the plutil utility in the Terminal:

From the JAMF portal, navigate to Configuration Profiles and click the Upload button. Select com.microsoft.network-extension.signed.mobileconfig when prompted for the file.

Option 2: Endpoint Manager Deployment

System Extensions Policy

To approve the system extensions:

In Intune, open Manage > Device configuration. Select Manage > Profiles > Create Profile.

Choose a name for the profile. Change Platform=macOS to Profile type=Extensions. Select Create.

In the Basics tab, give a name to this new profile.

In the Configuration settings tab, add the following entries in the Allowed system extensions section:

Bundle identifier	Team identifier
com.microsoft.wdav.epsext	UBF8T346G9
com.microsoft.wdav.netext	UBF8T346G9

In the Assignments tab, assign this profile to All Users & All devices.

Review and create this configuration profile.

Create and deploy the Endpoint Manager Custom Configuration Profile for MacOS Network Extension, Full Disk Access Policies

The following configuration profile enables the network extension and grants Full Disk Access to the Endpoint Security system extension.

Save the following content to a file named sysext.xml:

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>PayloadUUID</key>

<key>PayloadType</key>

<string>Configuration</string>

<key>PayloadOrganization</key>

<string>Microsoft Corporation</string>

<key>PayloadIdentifier</key>

<key>PayloadDisplayName</key>

<string>Microsoft Defender ATP System Extensions</string>

<key>PayloadDescription</key>

<key>PayloadVersion</key>

<key>PayloadEnabled</key>

<true/>

<key>PayloadRemovalDisallowed</key>

<true/>

<key>PayloadScope</key>

<string>System</string>

<key>PayloadContent</key>

<array>

<dict>

<key>PayloadUUID</key>

<key>PayloadType</key>

<string>com.apple.webcontent-filter</string>

<key>PayloadOrganization</key>

<string>Microsoft Corporation</string>

<key>PayloadIdentifier</key>

<key>PayloadDisplayName</key>

<string>Approved Network Extension</string>

<key>PayloadDescription</key>

<key>PayloadVersion</key>

<key>PayloadEnabled</key>

<true/>

<key>FilterType</key>

<string>Plugin</string>

<key>UserDefinedName</key>

<string>Microsoft Defender ATP Network Extension</string>

<key>PluginBundleID</key>

<string>com.microsoft.wdav</string>

<key>FilterSockets</key>

<true/>

<key>FilterDataProviderBundleIdentifier</key>

<string>com.microsoft.wdav.netext</string>

<key>FilterDataProviderDesignatedRequirement</key>

<string>identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9</string>

</dict>

<dict>

<key>PayloadUUID</key>

<key>PayloadType</key>

<string>com.apple.TCC.configuration-profile-policy</string>

<key>PayloadOrganization</key>

<string>Microsoft Corporation</string>

<key>PayloadIdentifier</key>

<key>PayloadDisplayName</key>

<string>Privacy Preferences Policy Control</string>

<key>PayloadDescription</key>

<key>PayloadVersion</key>

<key>PayloadEnabled</key>

<true/>

<key>Services</key>

<dict>

<key>SystemPolicyAllFiles</key>

<array>

<dict>

<key>Identifier</key>

<string>com.microsoft.wdav.epsext</string>

<key>CodeRequirement</key>

<string>identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9</string>

<key>IdentifierType</key>

<string>bundleID</string>

<key>StaticCode</key>

<key>Allowed</key>

</dict>

</array>

</dict>

</array>

</dict>

</plist>

Verify that the above file was copied correctly. From the Terminal, run the following command and verify that it outputs OK:

Bash

$ plutil -lint sysext.xml

sysext.xml: OK

To deploy this custom configuration profile: > In Intune, open Manage > Device configuration. Select Manage > Profiles > Create profile.

Choose a name for the profile. Change Platform=macOS and Profile type=Custom. > Select Configure. Open the configuration profile and upload sysext.xml. This file was created in the preceding step.

Select OK.

In the Assignments tab, assign this profile to All Users & All devices.
Review and create this configuration profile.
In MEM, deploy the App named Microsoft Defender ATP for MacOS device group as shown in the following image:

After this point, your environment is ready for MacOS devices to be upgraded to Big Sur, the MacOS newest version. MD for Endpoint on MacOS Devices will continue functioning normally after a successful OS upgrade.

Reference

Products (50)

Special Topics (27)

Video Hub (462)

Most Active Hubs

Most Active Hubs

Video Hub

Microsoft Defender for Endpoint Upgrade Readiness MacOS Big Sur

New configuration profiles for macOS Catalina and newer.

Option 2: Endpoint Manager Deployment