Purview Endpoint DLP on macOS: onboarding, permissions and the errors that stop it

Endpoint DLP on a Mac isn't a separate agent: it's a component of Microsoft Defender for Endpoint. A Mac only audits or blocks anything once macOS has approved Defender's extensions and permissions, the DLP feature is switched on in Defender's preferences, and Purview can map the signed-in user. In this post I'll cover both onboarding paths (with and without Defender already deployed), what the device list statuses mean, and how to fix the problems that keep Macs out of policy.

Symptoms#

In the Microsoft Purview portal, under Settings › Device onboarding › Devices, the Mac is missing or shows one of these:

Configuration status: Not updated
Policy sync status: Not updated
Configuration status: Not available

On the Mac itself you may see:

• The Defender shield in the menu bar with an x badge, and Action needed in its menu.
• Microsoft Defender needs attention with a Fix button on the Virus & threat protection page.
• org_id: unavailable in the output of mdatp health, meaning the device isn't onboarded to any organization.

The business symptom is the same in every case: files copied to USB, printed or uploaded from a browser on the Mac are neither blocked nor audited, and Activity explorer shows nothing for the device.

Why it happens#

• Monitoring is off. Device monitoring, and macOS monitoring specifically, must be turned on in Purview before any Mac can report.
• Profiles are missing or arrived late. Defender needs system extensions, Full Disk Access, a network filter and accessibility approved by MDM. Microsoft's bundled mdatp.mobileconfig contains all four (sysext, fulldisk, netfilter, accessibility). If the app lands first, macOS falls back to asking the user, and the affected features stay off until someone approves.
• The DLP daemon has no Full Disk Access. Endpoint DLP adds its own process, com.microsoft.dlp.daemon. A Full Disk Access profile created for Defender before DLP was in scope may not include it.
• The DLP feature isn't enabled. On Macs that already run Defender, DLP stays off until the com.microsoft.wdav preferences contain the dataLossPrevention feature key.
• Conflicting preferences. With more than one com.microsoft.wdav profile, macOS merges reliably only at the top level, so one profile can silently override the other's features section.
• The user can't be mapped. Configuration status includes a UPN check that expects the Mac to be onboarded to your MDM (for Intune, enrolled through Company Portal); Microsoft refers to the Enterprise SSO plug-in for this check.
• Unsupported versions. Only the three most recent major macOS releases are supported, and the device list needs Defender 101.95.07 or later to report status.

How to fix it#

1. Turn on macOS device monitoring#

In the Purview portal, open Settings, expand Device onboarding, select Devices and choose Enable device monitoring, then Turn on macOS device monitoring. It's usually active within a minute; Microsoft asks you to allow up to 30 minutes before contacting support.

2. Use the onboarding path that matches the Mac#

For the Defender side in Intune, including the settings catalog approach (the older macOS Extensions template is deprecated for new policies), follow onboarding macOS to Defender for Endpoint with Intune. Deploy the system configuration profiles before the app so macOS can approve everything without user prompts.

3. Enable the DLP feature in the Defender preferences#

For Macs that already run Defender, add this key to the single com.microsoft.wdav profile you use:

<key>features</key>
<dict>
  <key>dataLossPrevention</key>
  <string>enabled</string>
</dict>

If you already have a features dictionary, add the key inside it rather than creating a second one, and retire any duplicate profiles for the same domain.

4. Prove the profiles reached the Mac#

On the Mac, System Settings › General › Device Management lists the installed profiles; open each one to check its contents. Then confirm the effective preferences and Defender's health:

plutil -p "/Library/Managed Preferences/com.microsoft.wdav.plist"
mdatp health --field healthy
mdatp health --field org_id
mdatp health --field app_version

Good looks like the features section showing dataLossPrevention as enabled, healthy returning true and your organization ID populated. If the user sees Microsoft Defender needs attention, a permission or extension is still missing: correct the MDM profile rather than relying on users to approve it with the Fix button.

5. Fix user mapping and scope#

Select the Mac in the Purview devices list and open the details pane. Valid user shows whether the signed-in user has a matching Entra ID account and is in scope of a DLP policy that targets Devices, and Endpoint DLP status shows whether DLP is enabled. If the UPN check fails on an Intune Mac, make sure it's enrolled through Company Portal and review your Enterprise SSO plug-in configuration; see Platform SSO for macOS with Intune.

6. Check versions, then give it time#

Scoping policies by device or device group needs Defender build 101.25072 or newer. A policy changed within the last two hours may simply not have reached the Mac yet, so wait before you dig further.

Verify the fix#

• The devices list shows Updated for both Configuration status and Policy sync status.
• With a test policy in audit mode, copy a matching file to a USB drive, print it and upload it in Edge, Safari, Chrome or Firefox. Each activity appears in Activity explorer for that device.
• Endpoint DLP device attributes can also be queried from the DeviceInfo table in advanced hunting, which is handy for checking a whole fleet at once.

Key takeaways#

• Use Microsoft's bundled mdatp.mobileconfig, and download it again when Microsoft updates any of the files in it.
• Keep exactly one com.microsoft.wdav profile per Mac.
• On the path without Defender, removing the assignment of the Defender preferences profile offboards the Mac from Purview. Treat that profile as production.
• Not every condition behaves as on Windows: Content is not labeled, for example, only works for Word, Excel, PowerPoint and PDF files on endpoints.
• For Windows devices, see endpoint DLP onboarding and device status on Windows; for the activities you can restrict, see endpoint DLP settings for USB, printers and cloud uploads.

References#

• Onboard macOS devices into Microsoft 365 overview (Microsoft Learn)
• Onboard macOS devices using Intune for Defender for Endpoint customers (Microsoft Learn)
• Troubleshooting endpoint DLP configuration and policy sync (Microsoft Learn)