Skip to content

troubleshoot-cloud-connect-mdemac.md

Latest commit

 

History

History
83 lines (66 loc) · 3.94 KB

troubleshoot-cloud-connect-mdemac.md

File metadata and controls

83 lines (66 loc) · 3.94 KB

title: Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on macOS description: This article describes how to troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on macOS ms.service: defender-endpoint author: paulinbar ms.author: painbar ms.reviewer: joshbregman ms.localizationpriority: medium manager: bagol audience: ITPro ms.collection:

  • m365-security
  • tier3
  • mde-macos ms.topic: troubleshooting-general ms.subservice: macos search.appverid: met150 ms.date: 03/26/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2

Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on macOS

Platform macOS

This article describes how to Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on macOS.

Run the connectivity test

To test if Defender for Endpoint on macOS can communicate to the cloud with the current network settings, run a connectivity test from the command line:

mdatp connectivity test

Expected output:

Testing connection with https://cdn.x.cp.wd.microsoft.com/ping ... [OK]
Testing connection with https://eu-cdn.x.cp.wd.microsoft.com/ping ... [OK]
Testing connection with https://wu-cdn.x.cp.wd.microsoft.com/ping ... [OK]
Testing connection with https://x.cp.wd.microsoft.com/api/report ... [OK]
Testing connection with https://winatp-gw-cus.microsoft.com/test ... [OK]
Testing connection with https://winatp-gw-eus.microsoft.com/test ... [OK]
Testing connection with https://winatp-gw-weu.microsoft.com/test ... [OK]
Testing connection with https://winatp-gw-neu.microsoft.com/test ... [OK]
Testing connection with https://winatp-gw-ukw.microsoft.com/test ... [OK]
Testing connection with https://winatp-gw-uks.microsoft.com/test ... [OK]
Testing connection with https://eu-v20.events.data.microsoft.com/ping ... [OK]
Testing connection with https://us-v20.events.data.microsoft.com/ping ... [OK]
Testing connection with https://uk-v20.events.data.microsoft.com/ping ... [OK]
Testing connection with https://v20.events.data.microsoft.com/ping ... [OK]

If the connectivity test fails, check if the device has Internet access and if any of the endpoints required by the product is blocked by a proxy or firewall.

Failures with curl error 35 or 60 indicate certificate pinning rejection, which indicates a potential issue with SSL or HTTPS inspection. See instructions regarding SSL inspection configuration.

Troubleshooting steps for environments without proxy or with Proxy autoconfig (PAC) or with Web Proxy Autodiscovery Protocol (WPAD)

Use the following procedure to test that a connection isn't blocked in an environment without a proxy or with Proxy autoconfig (PAC) or with Web Proxy Autodiscovery Protocol (WPAD).

If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs.

Warning

Authenticated proxies aren't supported. Ensure that only PAC, WPAD, or a static proxy is being used. SSL inspection and intercepting proxies are also not supported for security reasons. Configure an exception for SSL inspection and your proxy server to directly pass through data from Microsoft Defender for Endpoint on macOS to the relevant URLs without interception. Adding your interception certificate to the global store won't allow for interception. To test that a connection isn't blocked: In a browser such as Microsoft Edge for macOS or Safari open https://x.cp.wd.microsoft.com/api/report and https://cdn.x.cp.wd.microsoft.com/ping.

Optionally, in Terminal, run the following command:

curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping'

The output from this command should be similar to:

OK https://x.cp.wd.microsoft.com/api/report
OK https://cdn.x.cp.wd.microsoft.com/ping