Defender ATP for macOS Generally Available

• Defender Advanced Threat Protection now offers malicious software detection and response for macOS.
• It will particularly benefit customers with Macs who buy Microsoft 365 E5 organization-wide.

The Microsoft Defender Advanced Threat Protection (MDATP) hosted service that offers endpoint detection and response (EDR) capabilities for discovering and defending against evolving attacks against Windows now offers support for Apple’s macOS. 

While the security capabilities of MDATP on macOS are more limited than on Windows 10 Enterprise, the service offers similar malicious software detection and response capabilities. MDATP is intended to help security analysts detect and respond to threats against their endpoints, including the aggregation and analysis of diagnostic (telemetry) data from systems across the organization. In addition to the aggregation of attack data, MDATP includes alerting, reporting, and hunting capabilities.

The macOS MDATP endpoint software delivered by Microsoft includes built-in antimalware protection that supports the three most recent releases of Apple macOS. The MDATP agent—referred to as a sensor—communicates with a Microsoft-hosted service that processes events from endpoints, enabling analysis by experts within the organization. As with Windows, the macOS MDATP sensor and service depend on antimalware software included in MDATP and cannot be used with third-party antimalware software. MDATP can be deployed to macOS devices using Intune, JAMF (a popular Apple device-management system), and other third-party mobile device management (MDM) software.