Microsoft Defender for Endpoint
Endpoint protectionConfigure and validate exclusions for Microsoft Defender for Endpoint on macOS
In brief
Updated Microsoft Defender documentation in defender-endpoint/mac-exclusions.md.
What Defender admins need to know
Review the underlying documentation change to determine whether it affects tenant configuration or rollout plans.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Configure and validate exclusions for Microsoft Defender for Endpoint on macOS
[!INCLUDE side-by-side-scenarios]
Choose the right mitigation
Use the narrowest mitigation that addresses the identified component.
| Finding | Next step |
|---|---|
wdavdaemon_unprivileged is affected, and real-time protection statistics identify a file, folder, or process | Consider an antivirus exclusion after reviewing the security impact. |
wdavdaemon or wdavdaemon_enterprise is affected | Collect hot event sources and Client Analyzer performance data. Antivirus exclusions might not address this event-processing load. |
| Another endpoint security product is installed | Confirm the intended active or passive mode and the coexistence settings for both products before adding workload exclusions. |
| The affected workload isn't identified | Don't add a broad exclusion. Reproduce the issue and collect performance diagnostics first. |
After applying an exclusion, repeat the same workload and compare CPU usage, memory usage, scan counts, and elapsed time. Remove the exclusion if it doesn't provide a measurable improvement.
Supported exclusion types
The following table shows the exclusion types supported by Defender for Endpoint on macOS.
mdatp threat allowed add --name "EICAR-Test-File (not a virus)"
@@ -12,13 +12,13 @@ ms.collection: - mde-macos ms.topic: how-to ms.subservice: macos-ms.date: 06/17/2026+ms.date: 08/11/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1015 --- # Configure and validate exclusions for Microsoft Defender for Endpoint on macOS @@ -34,6 +34,19 @@ To narrow down which process and/or path and/or extension you need to exclude, u [!INCLUDE [side-by-side-scenarios](includes/side-by-side-scenarios.md)] +## Choose the right mitigation++Use the narrowest mitigation that addresses the identified component.++|Finding|Next step|+|---|---|+|`wdavdaemon_unprivileged` is affected, and real-time protection statistics identify a file, folder, or process|Consider an antivirus exclusion after reviewing the security impact.|+|`wdavdaemon` or `wdavdaemon_enterprise` is affected|Collect hot event sources and Client Analyzer performance data. Antivirus exclusions might not address this event-processing load.|+|Another endpoint security product is installed|Confirm the intended active or passive mode and the coexistence settings for both products before adding workload exclusions.|+|The affected workload isn't identified|Don't add a broad exclusion. Reproduce the issue and collect performance diagnostics first.|++After applying an exclusion, repeat the same workload and compare CPU usage, memory usage, scan counts, and elapsed time. Remove the exclusion if it doesn't provide a measurable improvement.+ ## Supported exclusion types The following table shows the exclusion types supported by Defender for Endpoint on macOS.@@ -176,6 +189,3 @@ For example, to add `EICAR-Test-File (not a virus)` (the threat name associated ```bash mdatp threat allowed add --name "EICAR-Test-File (not a virus)" ```---