Skip to content

Est. 2011·Microsoft Partner 7033487·Delivery under 3 min·Support 7 days a week

Your vault is empty.

Review

Best Antivirus for Macs in a Windows Office: One Console or Two?

12 min read Updated October 4, 2026 Antivirus Comparisons

Fix it now

One console is the right default, and every serious business suite ships a macOS agent. What decides whether that agent actually works is not the licence – it is whether you can push the configuration profiles macOS now requires, because without them the agent installs and quietly sees less than you think.

  1. Sort the profiles before the product. A modern Mac security agent needs an approved system extension, a network filter policy, Full Disk Access through TCC, and on macOS 13 and later a background services policy – Microsoft documents all four for its own agent.
  2. Take the macOS 13 one seriously. Microsoft states that from Ventura onwards applications cannot run in the background without explicit consent, and the agent’s daemon process must run in the background. Without that profile you have an installed product that is not protecting anything.
  3. Check what you already own: Microsoft states Microsoft 365 Business Premium includes device endpoint protection through Microsoft Defender for Business and Microsoft Intune Plan 1. Intune is what delivers the profiles.
  4. Buy Mac seats from the same business suite as your Windows PCs if you have no other reason to split. Bitdefender publishes GravityZone as protecting desktops and servers on Windows, Linux and macOS, sold online for 1 to 100 devices.
  5. Buy separately only when the Macs are already managed on somebody else’s tooling – a design team with its own Jamf tenancy, for instance – and only if its alerts reach the same people.
  6. Ask how seats are counted on the quote rather than assuming platform-agnostic pricing. No vendor publishes a cross-vendor rule, and servers are the exception almost everywhere.

Apple’s own baseline is real: it describes prevention through the App Store and Gatekeeper with Notarization, blocking through Gatekeeper, Notarization and XProtect, and remediation through XProtect, with macOS checking for XProtect updates daily by default.

If you have MDM and one console, the decision is made. Below is what the Mac agent is actually for, the extension approval problem in detail, and what to check before assuming parity.

Why it happens

The threat mix on macOS is different from Windows. Less commodity ransomware, far more adware arriving through fake installers and cracked applications, and a steady supply of information stealers that go after browser sessions and saved credentials. Those stealers are usually installed by the user, who was told to run a terminal command or bypass Gatekeeper to make something work. No amount of platform hardening stops a user who has been talked into disabling it.

Apple’s own defences are better than the ‘Macs do not get viruses’ argument and weaker than the ‘so you do not need anything’ conclusion. Apple describes three layers: prevention, through the App Store or Gatekeeper combined with Notarization; blocking, through Gatekeeper, Notarization and XProtect; and remediation, through XProtect, which includes an engine that remediates infections based on updates delivered automatically by Apple. macOS checks for those updates daily by default, and Notarization revocation updates arrive more frequently than that. What none of it gives you is a console, an alert, an exclusion policy or a report.

There is also the carrier problem: a Mac that never gets infected can still pass a malicious Office document to the Windows machines on the same file share. And there is the paperwork. Cyber insurance proposals and client security questionnaires ask whether all endpoints run centrally managed protection, and ten unmanaged Macs turn a one-word answer into an explanation.

The agent is installed but the console shows almost nothing

You have this one if Macs appear in the console, report as healthy, and generate none of the telemetry the Windows machines do.

  1. Check the four configuration profiles. Microsoft documents the required set for its macOS agent as system extension approval by team identifier, a network filter policy, Full Disk Access through TCC, and background services on macOS 13 and later.
  2. The background services one is the silent failure: Microsoft states that from macOS 13 applications cannot run in the background without explicit consent, and the daemon must run in the background.
  3. Full Disk Access is the other. Microsoft’s wording is that enabling TCC through an MDM solution eliminates the risk of the product losing Full Disk Access authorisation, which is what lets the scanner read protected locations.

You have no MDM at all

You have this one if Fewer than a handful of Macs, bought individually, never enrolled in anything.

  1. Check your Microsoft subscription first. Microsoft states Microsoft 365 Business Premium includes Microsoft Intune Plan 1 alongside Defender for Business, so a lot of offices already own the tool that pushes these profiles.
  2. Without any MDM, budget the time to approve each Mac by hand through Privacy and Security settings, and to revisit them after major macOS upgrades.
  3. Jamf, Kandji and Mosyle are the Mac-specialist alternatives if Intune is not the right fit.

The design team runs its own tooling

You have this one if An existing Jamf or Kandji tenancy with an administrator who is not you.

  1. A separate Mac deployment is defensible here, as long as its alerts reach the same people who watch the Windows queue.
  2. Write down who is responsible for the Mac coverage report, because two consoles means two reports to reconcile before you can answer a questionnaire.
  3. Do not let a separate deployment become a separate security posture. One exclusion policy and one update policy is worth more than perfect platform-specific tuning.

One thing this comparison used to assert and cannot: that in the main business suites a seat is a device regardless of platform. No vendor publishes a cross-vendor rule, and vendors do treat some platforms and some device types differently. Put the question on the quote instead: does a Mac consume the same unit as a Windows PC, and how are servers counted?

Full reference

The system extension problem, which is the real work

Apple removed kernel extensions from the picture, and modern Mac security agents run as system extensions with a network content filter. Those need explicit permission, and Microsoft’s documentation for its own macOS agent is the clearest published account of what that means in practice. It lists four things a configuration profile must cover, and describes the consequence of each one being missing.

Profile What it does What happens without it
System extension approval Approves the vendor’s extensions by bundle identifier and team identifier The extensions do not load, so core protection does not run
Network filter Allows the network extension to inspect socket traffic Traffic inspection and the reporting built on it fail
Full Disk Access (TCC) Grants the scanner access to protected locations The product loses authorisation to read files properly on current macOS
Background services (macOS 13 and later) Consents to the daemon running in the background The daemon cannot run in the background, which disables protection
Notifications Allows the product to display notifications Cosmetic only; protection is unaffected

Read the fourth row again, because it is the one that produces a Mac estate that looks protected and is not. Microsoft states that macOS 13 contains privacy enhancements under which, by default, applications cannot run in the background without explicit consent, and that its agent must run its daemon process in the background. That consent comes from a profile, and a profile comes from MDM.

One console or two, on the dimensions that matter

One console for both platforms A separate product for the Macs
Where alerts appear In the same queue as Windows alerts, seen by whoever already watches it In a second console somebody must remember to open
Policy consistency One exclusion list, one update policy, one set of groups Two sets of rules that drift apart over time
Feature parity Whatever the vendor ships for macOS Sometimes better Mac-specific depth, from a Mac-focused vendor
Deployment Same profile approach for every Mac Its own packaging and its own approval profiles
Reporting for audits One report covering the whole estate Two reports to reconcile before answering a questionnaire
Licensing Usually one pool of device seats – confirm it on the quote A second contract, renewal date and support relationship

Parity: what to check before you assume the Mac is covered

Ask the vendor four specific questions about the macOS agent rather than reading the platform list. Does it support the current macOS release on Apple silicon on the day that release ships, or later? Does device control extend to Macs, if blocking USB storage is a policy you enforce? Is web filtering available on macOS, and does it work outside Safari? And if you are buying a detection and response tier, does the Mac agent generate the same telemetry as Windows, or a subset?

We are not going to tell you how each vendor answers, because none of them publishes a commitment you could hold them to. Get the answers in writing against the specific things you enforce, and re-ask them at renewal.

What you may already own

Microsoft states that Microsoft 365 Business Premium includes device endpoint protection through Microsoft Defender for Business and Microsoft Intune Plan 1, and that Defender for Business supports macOS alongside Windows, iOS/iPadOS and Android for organisations up to 300 users. For a Windows-majority office already on Business Premium, that is both the agent and the tool that delivers the configuration profiles, in a subscription you are already paying for.

That is worth checking before adding a third-party product, and it is also the answer to the no-MDM problem above. If Business Premium is not what you have, the profiles still have to come from somewhere, and Jamf, Kandji and Mosyle are the Mac-specialist route.

Licensing a mixed estate without paying twice

Bitdefender publishes GravityZone as protecting desktops and servers, physical or virtual, across Windows, Linux and macOS, sold online for 1 to 100 devices. That single pool is the practical argument for one console: you buy the number of endpoints you have and reassign a seat when a laptop is replaced. Servers are the exception almost everywhere – sometimes a different unit, sometimes a separate subscription, as with Sophos’s Workload Protection for Windows Server.

Consumer Mac antivirus licences are not a shortcut. They are licensed for personal use, have no console, and appear in no report you can hand an auditor.

Which way to go, by situation

  • A handful of Macs among mostly Windows PCs, one IT person: one console, Mac seats from the same suite. This is the common case and the right answer for it.
  • Already on Microsoft 365 Business Premium: you own Defender for Business and Intune Plan 1. Use Intune for the profiles and price a third-party product only against what is genuinely missing.
  • A design team with its own Jamf tenancy and admin: a separate Mac deployment is defensible, provided its alerts reach the same people.
  • Fewer than three Macs and no MDM: still buy managed seats, but accept that you approve the profiles by hand and recheck after every macOS upgrade.
  • You are about to move to macOS 13 or later without MDM: fix the background services consent first, because that is the one that silently disables the agent.

When a licence is the actual fix

For most Windows-majority offices, Bitdefender GravityZone Business Security is the straightforward answer: one cloud console, Windows, macOS and Linux agents from the same licence pool, and one report covering every endpoint when somebody asks. Bitdefender sells it online for 1 to 100 devices. We can supply it, ask how the seats count against your mixed estate so you are not buying a second contract for the Macs, and confirm the current macOS agent capabilities against the specific things you enforce – device control, web filtering outside Safari, and same-day support for a new macOS release. Before any of that, though, tell us whether you are on Microsoft 365 Business Premium, because that includes Defender for Business and Intune Plan 1 and may already cover this.

Questions people ask about this

Do Macs really need antivirus, or is that a sales line?

They need managing, which is a slightly different claim. Apple’s own three layers – Gatekeeper with Notarization, XProtect blocking, and XProtect remediation, with daily update checks – stop a lot. What they do not give you is a console, an alert, an exclusion policy or a report, and ‘we cannot report on those ten machines’ is the answer that costs you on a questionnaire.

Why is my Mac agent installed but not doing anything?

Almost always a missing configuration profile. Microsoft documents four required for its macOS agent: system extension approval, a network filter policy, Full Disk Access through TCC, and background services on macOS 13 and later. The last is the silent one – from Ventura, applications cannot run in the background without explicit consent, and the agent’s daemon has to.

Is Apple XProtect enough on its own?

At home, XProtect and Gatekeeper plus good habits is a reasonable position, and Apple documents XProtect as including a remediation engine with automatically delivered updates checked daily by default. In a business that has to evidence its controls, it is not enough, because none of it produces a report.

Will the Mac seats cost more than the Windows ones?

Often not, but do not assume it. No vendor publishes a general rule and we are not going to invent one. Ask on the quote whether a Mac consumes the same unit as a Windows PC, and how servers are counted, because servers are the exception almost everywhere.

Can we use a consumer Mac antivirus licence on work machines?

No. Consumer licences are for personal, non-commercial use and have no central management, so they fail both the legal test and the practical one. If cost is the constraint, check what your Microsoft 365 subscription already entitles you to first.

Was this article helpful?

Your feedback helps us improve our documentation.

Related articles

Review Webroot vs Emsisoft: The Lightweight Antivirus Question Finally Settled Review Kaspersky Endpoint Security Select vs Advanced: Where Encryption Lands Review EDR vs Traditional Antivirus: Do You Need Detection and Response Yet? Review Renew or Switch Antivirus? How to Judge Your Vendor at Renewal Time
← Back to Knowledge Base