Microsoft Defender ATP json file issues

Int_IT_ADC
Contributor

Hello

I am wondering if someone else has the same issue:

I have just started a few days ago to use defender on our M1 MacBooks. I have done the all the configurations from:
Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro | Microsoft Docs

and

New configuration profiles for macOS Catalina and newer versions of macOS | Microsoft Docs

which are necessary. As configuration I use this json schema.

mdatp-xplat/schema.json at master · microsoft/mdatp-xplat · GitHub

Defender onboarding and the functionality works fine from the first time, but when checking the function for the threats

Xnip2021-10-06_16-21-44.png

Xnip2021-10-06_16-22-10.png

I am not able to save this settings. I have tested it maybe 20 times in each direction 🙂 but was never successfull. So in the end in the defender on the MacBook the buttons are visible and usable for the user.

Xnip2021-10-06_16-22-51.png

Someone an idea if something is wrong with the json schema or have an tip how to disable this funcion on the client.
The issue is, that I can change it in the GUI, but it will be never written in the configuration.

I am thankful for any help.

Regards

J

2 REPLIES 2

Maxb
New Contributor II

Did you ever determine a resolution short of modifying the p.list and adding the values your self? I'm having the same issue with the JSON config generation not saving those exact settings as well. @Int_IT_ADC 

Hello

No, I never found a resolution for this issue and for the other one with the MS Defender notifications on the M1 MacBooks. Support from jamf was fine but in the end, I need to open an issue on MS side. But didn't find time for that