Microsoft Defender for Endpoint
Endpoint protectionConfigure and validate exclusions for Microsoft Defender for Endpoint on macOS
In brief
The page updates metadata and wording, removes the mitigation decision table and post-exclusion performance comparison guidance, and clarifies EICAR testing and threat allow-list commands.
What Defender admins need to know
Administrators will see streamlined exclusion-testing instructions, but the previous troubleshooting and validation guidance is no longer on this page.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Configure and validate exclusions for Microsoft Defender for Endpoint on macOS
You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on macOS scans. Exclusions can help avoid incorrect detections on files and software that are unique to your organization. Exclusions can also be useful for mitigating performance issues caused by Defender for Endpoint on macOS.
To narrow down which process and/or path and/or extension you need to exclude, use real-time protection statistics.
[!INCLUDE side-by-side-scenarios]
Choose the right mitigation
Use the narrowest mitigation that addresses the identified component.
| |
| |
After applying an exclusion, repeat the same workload and compare CPU usage, memory usage, scan counts, and elapsed time. Remove the exclusion if it doesn't provide a measurable improvement.
Supported exclusion types
The following table shows the exclusion types supported by Defender for Endpoint on macOS.
In the following Bash snippet, replace test.txt with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace test.txt with test.testing. If you're testing a path, ensure that you run the command within that path.
To download the standard EICAR test file and verify whether Defender detects it, run the following command:
curl -o test.txt https://secure.eicar.org/eicar.com.txt
If Defender for Endpoint on macOS reports malware, then the exclusion rule you are testing isn't working. If there's no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the EICAR test file website.
If you don't have Internet access, you can create your ownthe EICAR test file. Writefile locally instead. Use the following Bash command to write the standard EICAR test string to a new text file with the following Bash command:file:
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > test.txt
### Allow a threat by name
To allow a specific detected threat by name so that Defender for Endpoint no longer blocks it, add athe threat name to the allowed list, executelist by running the following command:
```bash
mdatp threat allowed add --name [threat-name]
To obtainfind the exact threat name associated with a detectionyou need to allow, list all current detections on your device, run mdatp threat list:device by running the following command:
mdatp threat list
For example, to allow the EICAR test detection so that Defender for Endpoint no longer blocks it, add EICAR-Test-File (not a virus) (the threat name associated with the EICAR detection) to the allowed list, executelist by running the following command:
mdatp threat allowed add --name "EICAR-Test-File (not a virus)"
@@ -12,13 +12,13 @@ ms.collection: - mde-macos ms.topic: how-to ms.subservice: macos-ms.date: 08/11/2026+ms.date: 07/02/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1015+ms.custom: msecd-doc-authoring-1016 --- # Configure and validate exclusions for Microsoft Defender for Endpoint on macOS @@ -27,26 +27,13 @@ This article provides information on how to define exclusions that apply to on-d You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on macOS scans. Exclusions can help avoid incorrect detections on files and software that are unique to your organization. Exclusions can also be useful for mitigating performance issues caused by Defender for Endpoint on macOS. -To narrow down which process and/or path and/or extension you need to exclude, use [real-time-protection-statistics](mac-support-perf.md).+To narrow down which process and/or path and/or extension you need to exclude, use [real-time protection statistics](mac-support-perf.md). > [!WARNING] > Defining exclusions lowers the protection offered by Defender for Endpoint on macOS. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you're confident aren't malicious. [!INCLUDE [side-by-side-scenarios](includes/side-by-side-scenarios.md)] -## Choose the right mitigation--Use the narrowest mitigation that addresses the identified component.--|Finding|Next step|-|---|---|-|`wdavdaemon_unprivileged` is affected, and real-time protection statistics identify a file, folder, or process|Consider an antivirus exclusion after reviewing the security impact.|-|`wdavdaemon` or `wdavdaemon_enterprise` is affected|Collect hot event sources and Client Analyzer performance data. Antivirus exclusions might not address this event-processing load.|-|Another endpoint security product is installed|Confirm the intended active or passive mode and the coexistence settings for both products before adding workload exclusions.|-|The affected workload isn't identified|Don't add a broad exclusion. Reproduce the issue and collect performance diagnostics first.|--After applying an exclusion, repeat the same workload and compare CPU usage, memory usage, scan counts, and elapsed time. Remove the exclusion if it doesn't provide a measurable improvement.- ## Supported exclusion types The following table shows the exclusion types supported by Defender for Endpoint on macOS.@@ -151,13 +138,15 @@ You can validate that your exclusion lists are working by using `curl` to downlo In the following Bash snippet, replace `test.txt` with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you're testing a path, ensure that you run the command within that path. +To download the standard EICAR test file and verify whether Defender detects it, run the following command:+ ```bash curl -o test.txt https://secure.eicar.org/eicar.com.txt ``` -If Defender for Endpoint on macOS reports malware, then the rule isn't working. If there's no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/).+If Defender for Endpoint on macOS reports malware, then the exclusion rule you are testing isn't working. If there's no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/). -If you don't have Internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command:+If you don't have Internet access, you can create the EICAR test file locally instead. Use the following Bash command to write the standard EICAR test string to a new text file: ```bash echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > test.txt@@ -172,20 +161,23 @@ In addition to excluding certain content from being scanned, you can also config ### Allow a threat by name -To add a threat name to the allowed list, execute the following command:+To allow a specific detected threat by name so that Defender for Endpoint no longer blocks it, add the threat name to the allowed list by running the following command: ```bash mdatp threat allowed add --name [threat-name] ``` -To obtain the threat name associated with a detection on your device, run `mdatp threat list`:+To find the exact threat name you need to allow, list all current detections on your device by running the following command: ```bash mdatp threat list ``` -For example, to add `EICAR-Test-File (not a virus)` (the threat name associated with the EICAR detection) to the allowed list, execute the following command:+For example, to allow the EICAR test detection so that Defender for Endpoint no longer blocks it, add `EICAR-Test-File (not a virus)` to the allowed list by running the following command: ```bash mdatp threat allowed add --name "EICAR-Test-File (not a virus)" ```+++