Microsoft Defender ATP via Intune for MacOS

Question

I am trying to deploy Microsoft Defender Endpoint for macOS via Intune , I added as available for a group of users and they can see the app available inside the company portal.

The problem is that when they click on install , the app change status to pending and a few minutes later as installed , with the option to re-install. But Microsoft Defender is not installed and can't find the app inside application and If I go to Endpoint Manager Admin Center the application in the computer is show as installed.

I'm not sure what is causing this and trying to troubleshooting without success , any idea where should I look ? Thanks

Answer 1

I got this from the install.log in one macos computer :

preinstall com.microsoft.wdav begin [2021-03-03 11:29:22 -0600] 738
INSTALLER_SECURE_TEMP=/Library/InstallerSandboxes/.PKInstallSandboxManager/F6253205-F32C-4949-8D78-4C8E4EB3B104.activeSandbox/8E8DC93C-3719-4295-A4BD-95D11B04787B
correlation id=F6253205-F32C-4949-8D78-4C8E4EB3B104
Generation installation id
Installation id: 6840F2BC-07AE-5148-8EA8-4541F016EE25
Product version detected from build.plist
is_new_install=1, bundle_version=101.10.72, branch=release/2009-2
No proxy configured for telemetry URL
[2021-03-03 11:29:28 -0600][LogTelemetry] submitting {"client":{"appVersion": "101.10.72", "hostname": "UserApplei.local", "machineGuid": "6840F2BC-07AE-5148-8EA8-4541F016EE25","productGuid":"c65eac3e-401e-4a0c-82e3-f106f693222f", "platform": "mac"},"reports":[{"$type":"installationReport", "correlation_id": "F6253205-F32C-4949-8D78-4C8E4EB3B104", "version": "101.10.72", "severity": "I", "code":"InstallStarted", "text":"is_new_install='1', bundle_version='101.10.72', branch='release/2009-2', package='/var/folders/zz/zyxvpxvq6csfxvn_n0000044000011/C/com.apple.appstore/4EA2FB0E-66C7-48E3-8AAD-D93B05BF4E53/wdav.pkg'"}]}
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 699 100 126 100 573 117 534 0:00:01 0:00:01 --:--:-- 652
{"actions":[{"$type":"SignatureUpdateAction","versionId":"83707","updateUri":"https://eu-cdn.x.cp.wd.microsoft.com/av64bit"}]}[LogTelemetry] result=0
[2021-03-03 11:29:30 -0600][LogTelemetry] submitting {"client":{"appVersion": "101.10.72", "hostname": "UserApplei.local", "machineGuid": "6840F2BC-07AE-5148-8EA8-4541F016EE25","productGuid":"c65eac3e-401e-4a0c-82e3-f106f693222f", "platform": "mac"},"reports":[{"$type":"installationReport", "correlation_id": "F6253205-F32C-4949-8D78-4C8E4EB3B104", "version": "101.10.72", "severity": "I", "code":"InstallMDM", "text":"applemdmunknown"}]}
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 514 100 126 100 388 144 446 --:--:-- --:--:-- --:--:-- 591
{"actions":[{"$type":"SignatureUpdateAction","versionId":"83707","updateUri":"https://eu-cdn.x.cp.wd.microsoft.com/av64bit"}]}[LogTelemetry] result=0
Clean installation
Full package detected, proceed with installation
Stopping main app
No matching processes were found
Stopping tray
launchctl bootout gui/501 /Library/LaunchAgents//com.microsoft.wdav.tray.plist
Could not find service "com.microsoft.wdav.tray" in domain for user gui: 501
/Library/LaunchAgents//com.microsoft.wdav.tray.plist: No such file or directory
Boot-out failed: 2: No such file or directory
No matching processes were found
Check if daemon is already installed
Could not find service "com.microsoft.fresno" in domain for system
Check that daemon is shut down...
Running instances of wdavdaemon:
All daemon processes stopped
[2021-03-03 11:29:31 -0600][LogTelemetry] submitting {"client":{"appVersion": "101.10.72", "hostname": "UserApplei.local", "machineGuid": "6840F2BC-07AE-5148-8EA8-4541F016EE25","productGuid":"c65eac3e-401e-4a0c-82e3-f106f693222f", "platform": "mac"},"reports":[{"$type":"installationReport", "correlation_id": "F6253205-F32C-4949-8D78-4C8E4EB3B104", "version": "101.10.72", "severity": "I", "code":"StopDaemon", "text":"Result=0"}]}
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:05 --:--:-- 0

Answer 2

anonymous user Thanks for posting in our Q&A.

For this issue, it is needed to do more detailed logs analysis to confirm what is causing this. With Q&A limitation, Q&A is not the best channel for such log analysis case. So we suggest to open a case to check on this. It is free. The following link describes how to open a case, we can refer to it:
https://learn.microsoft.com/en-us/mem/intune/fundamentals/get-support

Thanks for understanding and have a nice day.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.