Macs Are Endpoints Too: Wiring Defender for Endpoint into Your Apple Fleet
TL;DR
- Defender for Endpoint provides 24/7 active vulnerability scanning for macOS, and it is already licensed in Microsoft 365 Business Premium and E5 through Defender for Business and Plan 2.
- macOS enrollment into Defender requires a stack of Intune configuration profiles first: system extensions, network filters, full disk access, background services, and auto-update settings.
- Apple Business Manager plus Intune is the scalable path, assigning purchased Macs to MDM automatically so the Defender configurations land without hands-on setup.
- Onboarding finishes with the Defender app deployment and an onboarding package of .xml and .kext files downloaded from the Defender portal and uploaded to Intune.
- Once enrolled, each Mac surfaces real-time alerts, software inventory, and exposure scores in the Defender admin center.
Plenty of environments run Defender beautifully on every Windows machine while the MacBooks in the design and executive teams sail along unscanned. Attackers have noticed; threats targeting macOS endpoints keep climbing. The good news, as of April 2025, is that Microsoft Defender for Endpoint delivers 24/7 active vulnerability scanning on macOS, and most tenants already own the license. The catch is that enrollment takes a specific sequence of moving parts. This is the high-level rollout order, built to scale through automation rather than one-off setups.
What needs to exist before you touch a configuration profile?
Three foundations make the rest of the deployment repeatable:
- Apple Business Manager (ABM). Procure and assign macOS devices to your MDM solution automatically through ABM, so new hardware enrolls itself instead of waiting for a technician.
- Intune integration. Sync ABM with Microsoft Intune to automate enrollment and manage settings centrally. Devices have to be enrolled before you can push the configurations that activate Defender.
- Licensing. Defender for Endpoint is included with Microsoft 365 Business Premium (as Defender for Business) and with E5 (Plan 2). Check what the client already owns before quoting anything new.
For a deeper tutorial on Intune device management with macOS guidance, there is a full course on Udemy (opens in new tab) covering the whole stack.
The enrollment sequence, in order
Microsoft maintains a detailed documentation article (opens in new tab) on enrolling macOS devices into Defender. Condensed, the sequence looks like this:
- Create the required configuration profiles in Intune:
- System extensions
- Network filters (download the configuration from GitHub)
- Full disk access
- Background services
- Auto-update configuration, so Defender keeps itself current
- Notifications, Bluetooth, and accessibility permissions
- Set antivirus policies:
- Enable real-time protection
- Configure network protection and tamper protection
- Configure Endpoint Detection and Response (EDR):
- Set base-level EDR policies for macOS
- Deploy the Microsoft Defender for Endpoint app:
- Use the predefined app in Intune's app catalog
- Deploy the onboarding package:
- Download it from the Microsoft Defender portal
- Upload the required .xml and .kext files in Intune
- Validate enrollment:
- Devices begin appearing in Microsoft Defender
- Real-time alerts, software inventory, and exposure scores become available
How do you know it worked?
Once setup completes, Defender begins scanning each macOS device for vulnerabilities automatically, no further scheduling required. The security admin center becomes the single pane for the Apple fleet, where you can:
- View incidents and alerts
- Analyze exposure scores
- Track software inventory
- Deploy updates and remediations through Intune
Keeping watch across the whole fleet
Enrollment is a project; staying enrolled is a posture. Devices get reimaged, profiles get removed, and a Mac that reported in last quarter can quietly go dark. CloudCapsule tracks Defender enrollment status, policy health, and vulnerability exposure across all managed devices in one place, so deployment gaps surface without digging through multiple admin portals.
Frequently asked questions
Which Microsoft 365 licenses include Defender for Endpoint for macOS?
Defender for Endpoint is included with Microsoft 365 Business Premium, through Defender for Business, and with E5, which carries Defender for Endpoint Plan 2. If a client already runs Business Premium, the macOS coverage is paid for whether or not it is deployed.
How long until enrolled Macs show up with data?
Once the configuration profiles, Defender app, and onboarding package have applied, devices begin appearing in the Microsoft Defender portal, and real-time alerts, software inventory, and exposure scores become available from there.
Is Apple Business Manager strictly required?
Devices can be enrolled into Intune without it, but ABM is the difference between a repeatable rollout and a hand-touched one. ABM assigns procured Macs to your MDM automatically, so every new device picks up the Defender configurations on first boot.
See which Macs never made it into Defender
CloudCapsule shows Defender enrollment status, policy health, and vulnerability exposure across your whole device fleet without hopping between admin portals. 250+ controls checked in about 60 seconds per tenant.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
