Forum Discussion
Defender on macOS - conflicting applications
Hello,
I successfully deployed and configured Microsoft Defender on macOS using Mosyle MDM.
However, I see here one conflicting app:
MosyleMonitor app is deployed to all machines by default.
I didn't notice any problems in the work of the Defender, nor on the MDM side.
What does this mean? Maybe there was some permission overlap?
Thanks
This is definitely issue with Full Disk Access permissions. If I turn off full disk access for MosyleMonitor there is no conflict.
Mosyle support:
"The Mosyle Agent is critical to fully enforce profiles and configurations that are deployed. To ensure the agent is always functioning as expected, it contains a built-in service (known as MosyleMonitor) to prevent any other application or process from pausing or blocking the agent process."
I will contact Microsoft support to check if they have any solution for this.
I have also been wondering about this. Perhaps there is an exclusion path Microsoft recommends. Please let us know what Microsoft support says.
Finally got an answer from Microsoft support. In general, they do not support other 3rd party MDM systems, only Intune and Jamf.
However, they also suggested to create AV exclusion."The conflicting_applications field in MDE health report contains a list of applications which are running as Endpoint Security client - (https://developer.apple.com/documentation/endpointsecurity ).
These clients can intercept lots of events from macOS kernel and has ability to allow or deny them."I already created AV exclusion for whole Mosyle folder but there is no change.
- Same issue here, but I have two conflicting apps.
conflicting_applications : [474("MosyleAOD"), 477("MosyleMonitor")]
Exclusion did not work either...- I didn't notice anything wrong with the current functioning either in Mosyle or on the Defender side, it works for now 🙂
