Allow system extension for Web Protection on macOS devices - OneView

Web Protection for macOS requires a system extension to be allowed in order to monitor the endpoint's network activity. The end user can allow this extension locally, or an administrator can do it remotely with a mobileconfig profile using a Mobile Device Management (MDM) tool. For more information on completing this remotely, see MDM configuration files for macOS in OneView.

Allow system extension locally on device

If you don't use a MDM, then a prompt appears on the end user's device when Web Protection is enabled on the endpoint's policy.

Have the user click Allow or Open System Settings and follow the prompts to allow the MB-EngineHostsApp-NCEP system extension to filter network content. 

If the pop-up was dismissed or ignored, follow these steps instead:

1. On the affected Mac device, click on the Apple icon > System Settings.
2. Go to General > Login Items & Extensions.
3. Click the information button (i) next to Endpoint Security Extensions.
4. Toggle on Malwarebytes Engine Host (NCEP) and Malwarebytes Corporation.
   
5. Enter your Mac password and click Ok.
6. Click Done.
7. Another prompt to allow the MB-EngineHostApp-NCEP displays, click Allow. 

For admins to easily identify which endpoints haven't allowed the system extension:

1. In OneView, go to Manage > Endpoints.
2. Filter the Protection Status column for the Unprotected status.
3. Filter the OS Platform column for MacOS.

For troubleshooting Web Protection on macOS, see Troubleshooting macOS Web Protection in OneView.