Onboard and offboard macOS devices into Purview solutions using Intune for Microsoft Defender for Endpoint customers

You can use Microsoft Intune to onboard macOS devices into Microsoft Purview solutions.

Applies to:

• Customers who have MDE deployed to their macOS devices.
• Endpoint data loss prevention (DLP)
• Insider risk management

Before you begin

• Make sure your macOS devices are onboarded to Intune and enrolled in the Company Portal app.
• Make sure you have access to the Microsoft Intune admin center.
• OPTIONAL: Install the v95+ Microsoft Edge browser on your macOS devices.

Onboard macOS devices into Microsoft Purview solutions using Microsoft Intune

Given that Microsoft Defender for Endpoints (MDE) has already been deployed to your macOS devices, you can still onboard the devices into Purview solutions by competing the following steps:

1. Validate existing FDA system configuration profile
2. Update MDE Preferences

Validate existing system configuration profile

1. A full disk access (FDA) configuration profile should have been created and deployed previously for MDE. (For details, see Intune-based deployment for Microsoft Defender for Endpoint on Mac).

2. Endpoint data loss prevention (DLP) requires additional FDA permission for the new application (com.microsoft.dlp.daemon). Validate that the com.microsoft.dlp.daemon is in the fulldisk.mobileconfig file

Update MDE Preferences

1. Find the existing MDE Preferences configuration profile. See Intune-based deployment for Microsoft Defender for Endpoint on Mac for details.

2. Add the following key to the com.microsoft.wdav configuration profile file, then save the file.

   <key>features</key> 
   <dict> 
     <key>dataLossPrevention</key> 
     <string>enabled</string> 
   </dict> 
   

Offboard macOS devices using Microsoft Intune

1. In the Microsoft Intune admin center, open Devices > Configuration. The policies you created display.

2. Choose the MDE Preferences policy.

3. Under Properties > Configuration Settings, choose Edit

4. Remove these settings:

    <key>features</key>
    <dict>
        <key>dataLossPrevention</key>
        <string>enabled</string>
    </dict>
   

5. Choose **Review+**Save. This will offboard the macOS devices from Purview solutions while not changing the macOS device enrollment in MDE.