Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Set preferences for Microsoft Defender for Endpoint on macOS

4 September 2026Doc update+34 / −27 lines

In brief

The article now provides clearer guidance for enterprise administrators using JAMF or Intune, including plist structure, scan-exclusion fields, threat actions, device tags, and recommended profiles. Section anchors and metadata were also updated.

What Defender admins need to know

Administrators can use the clarified field definitions when creating or reviewing macOS configuration profiles, especially for exclusions, threat actions, and device tags.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Set preferences for Microsoft Defender for Endpoint on macOS

Summary

In enterprise organizations, you can manage Microsoft Defender for Endpoint on macOS can be managed through a configuration profile. You deploy this profile that is deployed by using one of several management tools. Preferences that are managedset by your security operations team take precedence over local device preferences. To change preferences that are set locally on the device. Changing the preferences that are set through the configuration profile requires escalated privileges and isn't available forprofile, users without administrativeneed admin permissions.

This article describes the structure of the configuration profile,profile structure. It includes a recommended profile thatto help you can use to get started,started and provides instructions onexplains how to deploy the profile.

Configuration profile structure

The configuration profile is a .plist file that consistsmade up of entries identified by akey-value pairs. Each key (which denotesis the name of the preference), followed by a value, whichpreference. Each value depends on the naturetype of the preference. Values can either be simple (such as a numerical value)number) or complex, suchcomplex (such as a nested list of preferences.preferences).

|Domain|com.microsoft.wdav| |Key|exclusions| |Data type|Dictionary (nested preference)| |Comments|The dictionary contains the keys $type (exclusion type), path (file or folder path), isDirectory (path type), extension (file extension), and name (process name).|

Type of exclusion

|*|Matches any number of any characters including none (note that when this wildcard is used inside a path it substitutes only one folder)|/var/\*/\*.log|/var/log/system.log|/var/log/nested/system.log| |?|Matches any single character|file?.log|file1.log

file2.log|file123.log|

Scan exclusion path type (file or directory)

In an antivirus scan exclusion entry, use isDirectory to indicate whether the path value refers to a file or a directory.

SectionValue
Possible valuesfalse (default)

true

CommentsApplicable only if $type is excludedPath

Scan exclusion: file extension

In an antivirus scan exclusion entry, use extension to exclude files by file extension.

SectionValue
Possible valuesvalid file extensions
CommentsApplicable only if $type is excludedFileExtension

Scan exclusion: process name or path

In an antivirus scan exclusion entry, use name to exclude a process and all files opened by that process from scanning. The process can be specified either by its name (for example, cat) or full path (for example, /bin/cat).

SectionValue
Domaincom.microsoft.wdav
KeythreatTypeSettings
Data typeDictionary (nested preference)
CommentsEach entry in the array contains a key (threat type, such as potentially_unwanted_application or archive_bomb) and a value (action to take: audit, block, or off).
Threat type

|Domain|com.microsoft.wdav| |Key|tags| |Data type|Dictionary (nested preference)| |Comments|Each entry in the array contains a key (tag type, such as GROUP) and a value (the tag string assigned to the device).|

Type of tag

Recommended configuration profile

The recommended configuration profile enables all protection features in Microsoft Defender for Endpoint. Both the JAMF property list and the Intune XML profile in the following subsections apply these settings.

This configuration profile (or, for JAMF, a property list uploaded into custom settings) will:

  • Enable real-time protection (RTP)
  • Specify how the following threat types are handled:

Full configuration profile example

The following JAMF and Intune templates include all available Microsoft Defender for Endpoint on macOS settings. Use these templates for advanced scenarios where you need full control over every preference.

Property list for JAMF full configuration profile

The following complete plist shows a Defender for Endpoint configuration profile for JAMF with all available settings, including antivirus engine, cloud service, EDR, tamper protection, and user interface preferences:

<?xml version="1.0" encoding="UTF-8"?>

### Intune full profile

The following mobile configuration payload wraps all available Defender for Endpoint macOS settings into a deployable Intune profile. It includes antivirus engine, cloud service, EDR, tamper protection, and user interface preferences:

```XML
<?xml version="1.0" encoding="utf-8"?>

## Property list validation

The property list must be a valid *.plist* file. Validate the plist syntax before uploading or deploying the profile by running the following command:

```bash
plutil -lint com.microsoft.wdav.plist

If the plist is valid, you see output similar to the following:

com.microsoft.wdav.plist: OK

Configuration profile deployment

Once you've built the configuration profile for your enterprise, you can deploy it through your management console. See JAMF deployment and Intune deployment for step-by-step instructions.

JAMF deployment

From the JAMF console, open Computers > Configuration Profiles, navigate to the configuration profile you'd like to use, then select Custom Settings. Create an entry with com.microsoft.wdav as the preference domain and upload the .plist produced earlier.

Intune deployment

Use the following steps to deploy the configuration profile with Intune:

  1. Open Devices > Configuration Profiles. Select Create Profile.

  2. Select Manage > Assignments. In the Include tab, select Assign to All Users & All devices.

Related content