Team: EDR
Product: Microsoft Defender for Endpoint
Environment: macOS
Summary: Learn why Microsoft Defender for Endpoint (MDE) might report a "conflicting_applications" warning on macOS and how to verify that both Huntress and MDE are working correctly.
Overview
On macOS, some security tools will warn you if another tool performs similar functions, such as an endpoint security extension or a DNS proxy. These warnings often appear as a conflicting_applications line when running a health command in Microsoft Defender for Endpoint (MDE).
Important: This message does not necessarily mean something is broken. In many cases, it is simply an informational alert stating that MDE has detected another security product, such as the Huntress Agent.
MDE "conflicting_applications" status
If a Mac has both Huntress and MDE installed, running the following command:
/usr/local/bin/mdatp health
You may see a line similar to:
conflicting_applications: [541("com.huntress.sys")]
This is expected behavior. MDE is acknowledging the presence of the Huntress endpoint security extension.
How to verify health
If both tools are healthy, you can safely ignore the message. Follow these steps to confirm both services are running as intended.
1. Check MDE health
Run mdatp health and verify the following:
- healthy: true
- health_issues: [ ] (This should be empty)
2. Check Huntress health
Confirm the status of the Huntress Agent through the portal or the endpoint:
- Huntress portal: Verify the agent is Online and the macOS status shows as Fully Configured.
- On the endpoint: You can optionally run the following command to check the extension status:
sudo /Applications/Huntress.app/Contents/MacOS/Huntress extensionctl status
Verify that Extension Status is installed and EDR status is enabled.
For example, a full mdatp health output on a healthy machine might look like:
healthy : true
- health_issues : []
- licensed : true
- engine_version : "1.1.25020.3000"
- engine_load_status : "Engine load succeeded"
- app_version : "101.25032.0006"
- org_id : "<your_org_id>"
- log_level : "info"
- machine_guid : "<redacted>
- release_ring : "Production"
- product_expiration : Oct 06, 2025 at 10:39:54 PM
- cloud_enabled : true [managed]
- cloud_automatic_sample_submission_consent : "safe" [managed]
- cloud_diagnostic_enabled : false [managed]
- cloud_pin_certificate_thumbs : false
- passive_mode_enabled : false [managed]
- real_time_protection_enabled : true [managed]
- real_time_protection_available : true
- real_time_protection_subsystem : "endpoint_security_extension"
- network_events_subsystem : "network_filter_extension"
- device_control_enforcement_level : "audit"
- tamper_protection : "audit" [managed]
- automatic_definition_update_enabled : true [managed]
- definitions_updated : May 15, 2025 at 06:07:07 AM
- definitions_updated_minutes_ago : 379
- definitions_version : "1.429.4.0"
- definitions_status : "up_to_date"
- edr_early_preview_enabled : "disabled"
- edr_device_tags : []
- edr_group_ids : ""
- edr_configuration_version : "20.199999.main.2025.05.12.08-a60b4f224606c38d72369ce162ccdbf8afe6ffa4"
- edr_machine_id : "<your_edr_machineid>"
- managed_by : "MEM"
- conflicting_applications : [621("com.huntress.sys")]
- network_protection_status : "started"
- network_protection_enforcement_level : "block" [managed]
- data_loss_prevention_status : "disabled"
- full_disk_access_enabled : true
- troubleshooting_mode : false
- ecs_configuration_ids : ""
When to contact support
You only need to perform deeper troubleshooting or contact Huntress Support if:
- MDE or Huntress actually report errors or missing components.
- The Huntress portal shows the agent as Offline or Needs Attention.
- You see problems like a missing system extension or missing Full Disk Access.