Microsoft Defender for Endpoint
TroubleshootingTroubleshoot Network Extension (NetExt) issues in Defender for Endpoint on Mac
In brief
Updated Microsoft Defender documentation in defender-endpoint/mac-troubleshoot-netext-mde.md.
What Defender admins need to know
Review the underlying documentation change to determine whether it affects tenant configuration or rollout plans.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Troubleshoot Network Extension (NetExt) issues in Defender for Endpoint on Mac
This article provides information on how to troubleshoot issues with the network extension (NetExt) that's installed as part of Microsoft Defender for Endpoint on macOS.
NetExt is used byprovides network event data that multiple Defender for Endpoint capabilities use. Network Protection is enableddepends on Mac devices.NetExt, but disabling Network Protection enforcement isn't the same as disabling NetExt.
Symptom:
You might notice issues with network related latencies when using your browser or copying files over the network or using a chat/meeting application.
Identify the affected component
Temporary solution:Before disabling NetExt, determine whether the issue occurs only when Network Protection enforcement is enabled or whenever NetExt is running.
This article describes howCheck Network Protection and system extension health totemporarily disableestablish a baseline:mdatp health --field network_protection_status mdatp health --details system_extensions mdatp health --details network_protectionTest the following states and record whether the issue reproduces:
NetExt Network Protection Interpretation Enabled Audit or block Baseline with both components active. Enabled Disabled If the issue remains, investigate NetExt which will temporarily disableor another capability that uses networkprotection,events.Disabled Disabled If the issue stops only here, NetExt is involved. Record the following information:
- Affected application and
resolveprotocol. - Browser or client.
- Destination.
- Proxy configuration.
- Virtual private network
stack-related issues by using Intune, JamF,(VPN) product and full-tunnel or split-tunnel mode. - Other installed network-filtering security products.
- Affected application and
Collect a
manualdiagnostic package while reproducing the issue:sudo mdatp diagnostic createIf Microsoft Support requests a NetExt log stream, run:
log stream --info --debug --style compact --predicate 'processon macOS.== "netext"' > netextlogstream.txtReproduce the issue, and then press Control+C to stop the trace.
Temporary solution
This article describes how to temporarily disable NetExt which will temporarily disable network protection, and resolve network stack-related issues by using Intune, JamF, or a manual process on macOS.
@@ -12,11 +12,13 @@ ms.collection: - mde-macos ms.topic: troubleshooting-general ms.subservice: macos-ms.date: 04/16/2025+ms.date: 08/11/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2 +ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1015 --- # Troubleshoot Network Extension (NetExt) issues in Defender for Endpoint on Mac @@ -28,13 +30,59 @@ appliesto: This article provides information on how to troubleshoot issues with the network extension (NetExt) that's installed as part of Microsoft Defender for Endpoint on macOS. -NetExt is used by [Network Protection](network-protection-macos.md) is enabled on Mac devices.+NetExt provides network event data that multiple Defender for Endpoint capabilities use. [Network Protection](network-protection-macos.md) depends on NetExt, but disabling Network Protection enforcement isn't the same as disabling NetExt. **Symptom**: You might notice issues with network related latencies when using your browser or copying files over the network or using a chat/meeting application. -**Temporary solution**:+## Identify the affected component++Before disabling NetExt, determine whether the issue occurs only when Network Protection enforcement is enabled or whenever NetExt is running.++1. Check Network Protection and system extension health to establish a baseline:++ ```bash+ mdatp health --field network_protection_status+ mdatp health --details system_extensions+ mdatp health --details network_protection+ ```++1. Test the following states and record whether the issue reproduces:++ |NetExt|Network Protection|Interpretation|+ |---|---|---|+ |Enabled|Audit or block|Baseline with both components active.|+ |Enabled|Disabled|If the issue remains, investigate NetExt or another capability that uses network events.|+ |Disabled|Disabled|If the issue stops only here, NetExt is involved.|++1. Record the following information:++ - Affected application and protocol.+ - Browser or client.+ - Destination.+ - Proxy configuration.+ - Virtual private network (VPN) product and full-tunnel or split-tunnel mode.+ - Other installed network-filtering security products.++1. Collect a diagnostic package while reproducing the issue:++ ```bash+ sudo mdatp diagnostic create+ ```++ If Microsoft Support requests a NetExt log stream, run:++ ```bash+ log stream --info --debug --style compact --predicate 'process == "netext"' > netextlogstream.txt+ ```++ Reproduce the issue, and then press **Control+C** to stop the trace.++> [!CAUTION]+> Disabling NetExt reduces network visibility and disables capabilities that depend on network events. Use the smallest possible pilot group, record the original assignment, and restore the configuration after testing.++## Temporary solution This article describes how to temporarily disable NetExt which will temporarily disable network protection, and resolve network stack-related issues by using Intune, JamF, or a manual process on macOS.