I have a Mac. I can't download the antimalware.

Question

I have a Mac. I can't download the antimalware.

8816Sarah Cohen 0

Hi, a month or so ago, I deleted Webroot and installed Microsoft Defender. However, the system tells me to download antimalware, but I can't get beyond the first stage. I checked for remnants of Webroot and found none. I still can't download antimalware. I have two extensions toggled to on. Microsoft Defender and Microsoft Defender Endpoint Security Extension. When I try to download the antimalware, I can't get beyond Step 1. I've been trying for weeks. What do I do?

0 comments

2 answers

Your answer

Answer 1

The two enabled extensions complete only part of setup; Microsoft Defender must also have Full Disk Access, unless those are the two entries you already enabled under that specific setting.

Complete the separate permission

Open Apple menu → System Settings → Privacy & Security → Full Disk Access.
Enable:
- Microsoft Defender
- Microsoft Defender Endpoint Security Extension or Microsoft Defender Extension, if shown
Return to Privacy & Security and handle any message stating that system software requires attention:
- Select Details.
- Select both Microsoft Defender entries.
- Select OK.
Quit Microsoft Defender, restart the Mac, and reopen Defender while signed in with the personal Microsoft account associated with your Microsoft 365 Personal or Family subscription.

System-extension approval and Full Disk Access are separate parts of Microsoft’s Mac setup procedure.^1^

Since you already checked for Webroot remnants, there is no need to repeat that check.

If those two toggles were already under Full Disk Access

Check whether macOS has activated the extensions rather than merely displaying them as enabled. Open Finder → Applications → Utilities → Terminal, then run:

mdatp health
systemextensionsctl list
mdatp health --details system_extensions

Look for:

healthy : true
full_disk_access_enabled : true
real_time_protection_available : true
Both Defender extensions showing [activated enabled]

If an extension reports [activated waiting for user], macOS is still waiting for local approval. Return to System Settings → Privacy & Security, approve the pending Microsoft system software, and restart. Microsoft documents that an enabled-looking extension can still be installed but not approved or ready.^2^

After setup completes, verify protection from Microsoft Defender → Device details → Start scan, choose a scan type, and select Start scan.^3^

Check the macOS version if installation itself will not proceed

Select Apple menu → About This Mac. If the Mac is running macOS Ventura 13, current Defender installation packages may require a newer macOS release; a closely matching Ventura case reports that packages released from April 2026 require macOS 14 or later.^4^ In that condition, permission changes will not resolve the installer requirement—the Mac must be upgraded to a supported macOS version, if its hardware supports one.

References

Answer 2

Norah-L 13,570 Microsoft External Staff Moderator

Hello 8816Sarah Cohen,

Besides Microsoft Defender, do you currently have any other antivirus, antimalware, VPN or security suite, web-filtering tool, endpoint protection, or device-management security app installed on your Mac?

Even if Webroot is no longer listed, another security tool or an old management profile could prevent Defender from recognizing that its extensions are enabled and moving past Step 1. If you find another security app, temporarily disable or uninstall it, restart the Mac, and try the Defender setup again. If this is a work or school-managed Mac, please check with your IT administrator before removing anything.

If Defender is the only security app installed, open System Settings > Privacy & Security > Full Disk Access and make sure Microsoft Defender is enabled there as well. Then restart the Mac and try Step 1 again.

Please also let me know which macOS version you are using and whether this is a personal or managed Mac.

8816Sarah Cohen 0 Reputation points

2026-11-09T23:34:54.15+00:00

I'm stuck here: "[activated waiting for user], " Microsoft Defender and Microsoft Defender Endpoint" are toggled on. What does this mean? "approve the pending Microsoft system software, and restart." What pending software?
Norah-L 13,570 Reputation points Microsoft External Staff Moderator

2026-11-10T02:31:39.7366667+00:00

8816Sarah Cohen

“Pending Microsoft system software” might refer to the Microsoft Defender system extensions already installed on your Mac, not another program you need to download.

According to this official article, the [activated waiting for user] state indicates that macOS installed the extensions but is waiting for local approval. A healthy active extension reports [activated enabled].

Make sure you are signed in to an administrator account on your Mac, then open System Settings > Privacy & Security and scroll down to the Security section. Look for a message saying that system software from Microsoft was blocked or needs approval. If you see Allow, Details, or Enable System Extensions, select it, enter your administrator password when prompted, and restart the Mac.

If no approval message appears, turn both Defender extension switches off, restart the Mac, reopen Defender, and follow its Action needed or Fix prompt to trigger the approval request again. Afterward, turn the extensions on and restart once more.

Let me know how it goes!