Big Sur Antivirus

MacOS Big Sur Installer. Category: Controlled Applications: Publisher Name. Download our free Virus Removal Tool - Find and remove threats your antivirus missed. We design Mac hardware and software with advanced technologies that work together to run apps more securely, protect your data, and help keep you safe on the web. And with macOS Big Sur available as a free upgrade, it’s easy to get the most secure version of macOS for your Mac.


Applies to:

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.


On macOS 11 (Big Sur), Microsoft Defender for Endpoint requires additional configuration profiles. If you are an existing customer upgrading from earlier versions of macOS, make sure to deploy the additional configuration profiles listed on this page.

101.27.50 (20.121022.12750.0)

  • Fix to accommodate for Apple certificate expiration for macOS Catalina and earlier. This fix restores Threat & Vulnerability Management (TVM) functionality.

101.25.69 (20.121022.12569.0)

  • Microsoft Defender for Endpoint on macOS is now available in preview for US Government customers. For more information, see Microsoft Defender for Endpoint for US Government customers.
  • Performance improvements (specifically for the situation when the XCode Simulator app is used) & bug fixes.

101.23.64 (20.121021.12364.0)

  • Added a new option to the command-line tool to view information about the last on-demand scan. To view information about the last on-demand scan, run mdatp health --details antivirus
  • Performance improvements & bug fixes

101.22.79 (20.121012.12279.0)

  • Performance improvements & bug fixes

101.19.88 (20.121011.11988.0)

  • Performance improvements & bug fixes

101.19.48 (20.120121.11948.0)


The old command-line tool syntax has been deprecated with this release. For information on the new syntax, see Resources.

  • Added a new command-line switch to disable the network extension: mdatp system-extension network-filter disable. This command can be useful to troubleshoot networking issues that could be related to Microsoft Defender for Endpoint on Mac
  • Performance improvements & bug fixes

101.19.21 (20.120101.11921.0)

  • Bug fixes

101.15.26 (20.120102.11526.0)

  • Improved the reliability of the agent when running on macOS 11 Big Sur
  • Added a new command-line switch (--ignore-exclusions) to ignore AV exclusions during custom scans (mdatp scan custom)
  • Performance improvements & bug fixes

101.13.75 (20.120101.11375.0)

  • Removed conditions when Microsoft Defender for Endpoint was triggering a macOS 11 (Big Sur) bug that manifests into a kernel panic
  • Fixed a memory leak in the Endpoint Security system extension when running on mac 11 (Big Sur)
  • Bug fixes


  • Bug fixes


  • Added a new managed preference for disabling the option to send feedback
  • Status menu icon now shows a healthy state when the product settings are managed. Previously, the status menu icon was displaying a warning or error state, even though the product settings were managed by the administrator
  • Performance improvements & bug fixes


  • This product version has been validated on macOS Big Sur 11 beta 9

  • The new syntax for the mdatp command-line tool is now the default one. For more information on the new syntax, see Resources for Microsoft Defender for Endpoint on macOS


    The old command-line tool syntax will be removed from the product on January 1st, 2021.

  • Extended mdatp diagnostic create with a new parameter (--path [directory]) that allows the diagnostic logs to be saved to a different directory

  • Performance improvements & bug fixes


  • User interface improvements to differentiate exclusions that are managed by the IT administrator versus exclusions defined by the local user
  • Improved CPU utilization during on-demand scans
  • Performance improvements & bug fixes


  • Added new fields to the output of mdatp --health for checking the status of passive mode and the EDR group ID


    mdatp --health will be replaced with mdatp health in a future product update.

  • Fixed a bug where automatic sample submission was not marked as managed in the user interface

  • Added new settings for controlling the retention of items in the antivirus scan history. You can now specify the number of days to retain items in the scan history and specify the maximum number of items in the scan history

  • Bug fixes


  • Addressed a performance regression introduced in version 101.05.17. The regression was introduced with the fix to eliminate the kernel panics some customers have observed when accessing SMB shares. We have reverted this code change and are investigating alternative ways to eliminate the kernel panics.



We are working on a new and enhanced syntax for the mdatp command-line tool. The new syntax is currently the default in the Insider Fast and Insider Slow update channels. We encourage you to famliliarize yourself with this new syntax.

We will continue supporting the old syntax in parallel with the new syntax and will provide more communication around the deprecation plan for the old syntax in the upcoming months.

  • Addressed a kernel panic that occurred sometimes when accessing SMB file shares
  • Performance improvements & bug fixes


Mac Os Big Sur Antivirus

  • Improvements to quick scan logic to significantly reduce the number of scanned files
  • Added autocompletion support for the command-line tool
  • Bug fixes


  • Performance improvements & bug fixes
Big Sur Antivirus


  • Improvements around compatibility with Time Machine
  • Accessibility improvements
  • Performance improvements & bug fixes


  • Improved product onboarding experience for Intune users
  • Antivirus exclusions now support wildcards
  • Added the ability to trigger antivirus scans from the macOS contextual menu. You can now right-click a file or a folder in Finder and select Scan with Microsoft Defender for Endpoint
  • In-place product downgrades are now explicitly disallowed by the installer. If you need to downgrade, first uninstall the existing version and reconfigure your device
  • Other performance improvements & bug fixes


  • You can now set an update channel for Microsoft Defender for Endpoint on macOS that is different from the system-wide update channel
  • New product icon
  • Other user experience improvements
  • Bug fixes


Big Sur Antivirus
  • Improvements around compatibility with Time Machine
  • Addressed an issue where the product was sometimes not cleaning all files under /Library/Application Support/Microsoft/Defender during uninstallation
  • Reduced the CPU utilization of the product when Microsoft products are updated through Microsoft AutoUpdate
  • Other performance improvements & bug fixes



To ensure the most complete protection for your macOS devices and in alignment with Apple stopping delivery of macOS native security updates to OS versions older than [current – 2], MDATP for Mac deployment and updates will no longer be supported on macOS Sierra [10.12]. MDATP for Mac updates and enhancements will be delivered to devices running versions Catalina [10.15], Mojave [10.14], and High Sierra [10.13].

If you already have MDATP for Mac deployed to your Sierra [10.12] devices, please upgrade to the latest macOS version to eliminate risks of losing protection.

  • Performance improvements & bug fixes


  • Added more controls for IT administrators around management of exclusions, management of threat type settings, and disallowed threat actions
  • When Full Disk Access is not enabled on the device, a warning is now displayed in the status menu
  • Performance improvements & bug fixes


  • Addressed an issue where the product fails to start following a definition update.


  • Bug fixes


  • Fixed an issue where Microsoft Defender for Endpoint on Mac was sometimes interfering with Time Machine
  • Added a new switch to the command-line utility for testing the connectivity with the backend service
  • Added ability to view the full threat history in the user interface (can be accessed from the Protection history view)
  • Performance improvements & bug fixes


  • Bug fixes


  • Addressed an issue that impacts the ability of some users to upgrade to macOS Catalina when real-time protection is enabled. This sporadic issue was caused by Microsoft Defender for Endpoint locking files within Catalina upgrade package while scanning them for threats, which led to failures in the upgrade sequence.


  • Added the ability to configure the antivirus functionality to run in passive mode
  • Performance improvements & bug fixes


Best Macos Big Sur Antivirus

  • Added support for macOS Catalina


    macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender for Endpoint is not able to fully protect your device.

    The mechanism for granting this consent depends on how you deployed Microsoft Defender for Endpoint:

    • For manual deployments, see the updated instructions in the Manual deployment topic.
    • For managed deployments, see the updated instructions in the JAMF-based deployment and Microsoft Intune-based deployment topics.
  • Performance improvements & bug fixes