MS Defender installed, now trying to add DLP

[VintageMacGuy]

We got Defender working on our Macs about a year ago - deployed via JAMF Pro and with configuration profiles. We are not bound to the domain and do not use JAMF Connect.

I am trying to follow along with Microsofts documentation (Onboard and offboard macOS devices into Microsoft Purview solutions using JAMF Pro | Microsoft Learn) which seems to be written for setting this up from scratch rather than adding it in to an existing setup. It seems to be doing something as we are getting better feedback under Device Onboarding, but still not making much progress. 

Here is an example of the details in Device Onboarding  in Microsoft Purview with the error messages before and the more informative messages after I have created the configuration profiles in JAMF from the above guide:

View under Device Onboarding:

Before the configuration profiles were updated:

After the configuration profile was updated:

In the documentation that I linked to near the top, there is a "Before You Begin section which mentions this (formatting mine for clarity):

• Make sure your macOS devices are managed through JAMF pro and
  are associated with an identity (Microsoft Entra joined UPN) through JAMF Connect or
  Microsoft Intune.

We are managed through JAMF Pro, but we don't use JAMF Connect and they don't seem to have a UPN as shown in the screen shots above. I suspect this is a big part of the problem - but not sure how to fix it. Or am I incorrect and this is a red herring to some other problem in the Configuration Policy/settings/PPPC in JAMF Pro? Maybe both?

[Jvnguyen]

@VintageMacGuy Hello there,

I'm having the same problem getting DLP to work as well. Were you ever able to figure this out?

We do use Jamf Connect but with Okta being the IDP. Our policies and settings are cut directly from Microsoft. 

[VintageMacGuy]

The short answer is 'no'. 

We invested a bunch of time into trying to get it working. Sorted through the Microsoft documentation as best we could understand it (some terms were not well defined and could be interpreted different ways) We got close and were able to get it working in a dev environment, but when we replicated it in production, it was not working reliably. We did notice that there was something 'toggling' it on and off at each restart. It would work as expected, then when you restart the Mac, it stopped working. Then you restart the Mac again and it worked again. So somewhere there was a conflicting policy set that was overwriting at each restart, but we could never find it.

I did find some commands to run on the Mac that helped to troubleshoot. I don't have them handy, but if I recall, they confirmed if the policy was active or what state it was in, and if the machine was checking into Defender? I just took a look on my machine and don't see a copy of them, unfortunately.

in the end, we went another direction.