Understanding Device Control for macOS in Defender for Endpoint
Step-by-step implementation guide Requirements for Implementing Device Control: Defender for Endpoint or Defender for Business licenses (can be a trial subscription) Minimum OS version: macOS 11 or higher Minimum product version: 101.34.20 The implications of these requirements are that first, the macOS devices need to be onboarded in Defender for Endpoint for the Device Control policies to be enforced, secondly the OS needs to be at certain level or higher and third the minimum product version required, implies that the Defender app needs to be installed on the macOS device. Another aspect to take into consideration is that Defender can be running in active or passive mode for Device Control to work. Check the feature comparison table in this article to view how the Defender for Endpoint features behave when Defender is running active or passive mode. For this guide, I would like to focus on how we implement the policies for Device Control on macOS devices using Microsoft Intune. When deploying Device Control using Microsoft Intune, you have the advantage of using a native platform that integrates with Defender XDR portal and EntraID. Integrating device control into this broader security framework is crucial for maintaining a robust defense against potential threats. Considerations for Device Control to be effective and allow a smooth onboarding of devices: Your MacOS devices must be running at least macOS 11.x or higher. You will need a Microsoft365 subscription to be able to license your devices for Defender for Endpoint. To access and use Removable Storage Access Control, you must have Microsoft 365 E3 or E5. The Defender app needs to be installed and licensed (the device went through the onboarding process) on the macOS device. The main difference between Windows OS devices and macOS devices is that in Windows OS, the Defender application is part of the core OS and in macOS it needs to be installed as a regular application you can install on the device, preferably through Microsoft Intune. After the devices are onboarded in Defender for Endpoint, the devices will appear in EntraID as a synthetic object, meaning that you will see the “join type” field as blank. This allows you to group these devices in EntraID dynamic groups to automate the app deployment process. To enable devices to get endpoint security management settings from either Microsoft Intune or Defender portal, you need to enable to configure your tenant to support Defender for Endpoint security settings management. Older versions of Mac devices’ hardware, as long as they can support macOS 11.x or higher, can run the feature. The performance of the feature will depend on how the hardware performs, due to the fact that it is an outdated device. In order to apply device control policies, the device needs to be onboarded in Defender for Endpoint. Just applying the .mobileconfig file directly to the device or the .json file if using JAMF will not cause any effect on the device. To learn more about the .mobileconfig file and .json file, please refer to these articles. .mobileconfig and .json files. One of the key differences with Device control implementation in other operating systems like macOS is that the configuration is done via Microsoft Intune device configuration profile. This experience is not yet available in Defender portal. This guide applies for macOS devices managed by Intune. To further understand the pre-requisites for Device Control for macOS on Defender for Endpoint, please refer to this article. Process of deploying Defender for Endpoint app on macOS to prepare for device control policies Now, after you get all the pre-requisites aligned and ready to go, it is time to start preparing the environment in Intune for Device Control. Configuration Steps Install Microsoft Defender for Endpoint on macOS: Ensure that Microsoft Defender for Endpoint is installed and running on your macOS devices. You can follow the installation guide available on the Microsoft Learn website. This process is described in Fig.1 2. Build the MobileConfig File: Create a mobileconfig file that includes the necessary groups, rules, and settings for device control. You can use the demo file available on GitHub as a reference:. This file serves as a useful starting point for developing how the policy should function on the device. Validate your policy with the JSON schema to ensure the format is correct: https://github.com/microsoft/mdatp-devicecontrol/device_control_policy_schema.json 3. Deploy the MobileConfig File Using Intune: Sign in to the Microsoft Intune admin center and navigate to Devices > macOS. Select 'Create profile', choose 'Templates', and then 'Custom'. Upload the mobileconfig file you created in the previous step Configure Device Control Policies: Open the Microsoft Intune admin Center and navigate to the Device configuration section. Create a new policy for macOS devices. Specify the types of devices you want to control (e.g., USB drives, external hard drives). Set the permissions for each device type. You can choose to allow, block, or restrict access based on various criteria such as device ID, vendor ID, or serial number. 5. Deploy the Policy: Once the policy is configured, deploy it to the targeted macOS devices. Ensure that the devices are connected to the internet and can receive policy updates from the Microsoft Defender portal or Microsoft Intune. 6. Monitor and Manage Devices: Use the Microsoft Defender portal to monitor the status of connected devices. You can view the Device control report in Defender portal to track device usage and identify any unauthorized access attempts. You can also perform advanced hunting in Defender portal to monitor when a policy was triggered. Below I list a couple of KQL queries that can help with this monitoring. Example 1: Discover if the removable storage policy was triggered: Note: Before running, check spaces and syntax of the query is ok after copying and pasting the query in Advanced Hunting, to prevent errors. //RemovableStoragePolicyTriggered: event triggered by Disk and file system level enforcement for both Printer and Removable storage based on your policy DeviceEvents | where ActionType == "RemovableStoragePolicyTriggered" | extend parsed=parse_json(AdditionalFields) | extend RemovableStorageAccess = tostring(parsed.RemovableStorageAccess) | extend RemovableStoragePolicyVerdict = tostring(parsed.RemovableStoragePolicyVerdict) | extend MediaBusType = tostring(parsed.BusType) | extend MediaClassGuid = tostring(parsed.ClassGuid) | extend MediaClassName = tostring(parsed.ClassName) | extend MediaDeviceId = tostring(parsed.DeviceId) | extend MediaInstanceId = tostring(parsed.DeviceInstanceId) | extend MediaName = tostring(parsed.MediaName) | extend RemovableStoragePolicy = tostring(parsed.RemovableStoragePolicy) | extend MediaProductId = tostring(parsed.ProductId) | extend MediaVendorId = tostring(parsed.VendorId) | extend MediaSerialNumber = tostring(parsed.SerialNumber) |project Timestamp, DeviceId, DeviceName, InitiatingProcessAccountName, ActionType, RemovableStorageAccess, RemovableStoragePolicyVerdict, MediaBusType, MediaClassGuid, MediaClassName, MediaDeviceId, MediaInstanceId, MediaName, RemovableStoragePolicy, MediaProductId, MediaVendorId, MediaSerialNumber, FolderPath, FileSize | order by Timestamp desc Example 2: This query interrogates the DeviceEvents table, searching for “PnP” (Plug n Play) types of action. The field Additional fields provides essential information about the device ClassGUID and what .inf files are part of the driver stack used to perform the action. DeviceEvents | where ActionType contains "PnP" | where Timestamp > ago(30d) | project ActionType, DeviceName, InitiatingProcessAccountUpn, InitiatingProcessAccountDomain, IsProcessRemoteSession, AdditionalFields // the Additional Fields field shows the DeviceGUID, ClassGUID, driver information, etc. In conclusion: In today's fast-paced and mobile-driven world, device control stands out as an essential security feature for organizations and individuals alike. By enabling device control, businesses can ensure a seamless protection experience, safeguarding sensitive data against unauthorized access or potential threats posed by removable and portable devices. Its cross-platform functionality, spanning Windows, macOS, and beyond, highlights its adaptability and relevance in a diverse technological landscape. Furthermore, device control fosters a proactive approach to cybersecurity, by enabling device control, organizations can proactively safeguard sensitive data and mitigate risks before they escalate. Enabling this feature not only strengthens your security posture but also demonstrates a commitment to protecting the integrity and privacy of your systems in an increasingly unpredictable digital ecosystem. Explore additional resources: To further enhance your understanding of the critical role Device Control plays in safeguarding your organization, explore these indispensable resources on Defender for Endpoint. Empower yourself with the knowledge to proactively secure sensitive data, mitigate risks, and stay ahead in an ever-evolving digital landscape. How to deploy Defender app to macOS endpoints using Intune. Implementing device control on macOS guidelines. Defining settings on your mobileconfig file. Best practices to deploy device control for macOS on Defender for Endpoint. FAQ about device control on macOS. How to deploy device control from Defender for Endpoint using JAMF.
