Help CenterMicrosoft Defender for Endpoint (EDR) has a known interference issue with the macOS ThreatLocker Agent that can cause performance issues and unexpected behavior. To fix the issue, it is crucial to add exclusions to the EDR. Please note that these exclusions are separate from Microsoft Defender Antivirus exclusions.
To start applying these exclusions, an administrator for Microsoft Defender with Global Administrator permissions needs to open a Support case with Microsoft. To start a case, navigate to your Microsoft Defender portal and select the question mark in the top right corner of the page. Selecting this button will open the Support Assistant sidebar.
Once the chat starts, explain that you will need to set up exclusions in Microsoft Defender for Endpoint (EDR). The following template message can be used, or you can create your own:
I need to set up exclusions for Microsoft Defender for Endpoint (EDR) as it is causing database errors and performance issues with ThreatLocker.
Please Note: This process may require multiple escalations before the option to add EDR Exclusions is enabled in your Microsoft Defender Portal.
When enabled, this option can be found by selecting the Setup and Configuration dropdown, then choosing Settings.
From the Settings page, select Endpoints.
Now, on the Endpoints page, navigate to the Rules section and select your newly added EDR Exclusions option from the list.
From here, select the + Create Policy option.
Selecting this button will open the New Exclusion Policy page.
From this page, enter a name for the policy, select a target operating system, and select the scope for the policy. You can optionally enter a description for the policy as well. Once all information has been entered, select the Next button.
On the Exclusion Rules page, select the + Add button to add exclusion rules. Selecting this button opens the Add rule sidebar.
Within this sidebar, please add the following exclusion rules to the Path section of the sidebar.
/Library/Application Support/ThreatLocker
AND
/Library/Logs/ThreatLocker/
AND
/Applications/ThreatLocker.app/
Please Note: Entire folders can be excluded, but wildcards cannot be used.
Select the Accept button at the bottom of the sidebar once this information has been added.
You should now see your three exclusion rules added to the Exclusion Rules page. Confirm that these have all been entered correctly, then select the Next button to finalize your exclusions.
On the Summary page, review all the information you've applied, then select the Submit button at the bottom of the page to create your Microsoft Defender for Endpoint (EDR) exclusions.
