Bundle several Defender macOS permissions in one profile, then check the remaining deployment requirements.
Deploying Defender for Endpoint on macOS doesn’t have to mean a separate profile for every permission.
Microsoft provides a combined mdatp.mobileconfig. The current file bundles system extensions, the network content filter, background services, notifications, Full Disk Access, and accessibility permissions.
In Intune, create a macOS > Templates > Custom configuration profile, select Device channel, and upload the reviewed .mobileconfig. Pilot it before assigning it more broadly, and deploy the required permissions before the Defender app and onboarding package.
But first, compare the bundle with the current Intune deployment guide. You still need the Defender app, your tenant’s onboarding package, and the security preferences your organization requires. The combined file doesn’t include Microsoft AutoUpdate preferences or Bluetooth permissions for Device Control, so check those separately if needed.
Also review existing profiles. Deploying another network-filter profile alongside one already installed can cause connectivity issues. Plan the replacement rather than layering the combined bundle over every individual profile.
Check profile installation and Defender’s health on a pilot Mac, then follow Microsoft’s antimalware and EDR verification steps. A successfully installed permission profile doesn’t establish that onboarding and protection are working.
Original post: 10 November 2024. Documentation checked 13 October 2026.