Error: "Action recommended" in Microsoft Defender for Endpoint on Mac


Symptoms

You receive the following message in Microsoft Defender for Endpoint on your Mac:

Action recommended

example screenshot

Cause

Apple requires that all new system extensions being installed from third-party developers in macOS be manually allowed.

Resolution

1) Click Action recommended.

example screenshot

2) In the bottom left-hand corner, click the lock icon.

example screenshot

3) Authenticate using Touch ID or the username and password of an administrator on your Mac.

example screenshot  example screenshot

4) In the left-hand pane, ensure that Full Disk Access is chosen. Then, check the boxes next to the following:

  • Microsoft Defender ATP.app
  • Microsoft Defender ATP Endpoint Security Extension

example screenshot

5) Close System Preferences.

Outcome

Microsoft Defender for Endpoint will function as expected on your Mac.