What is wdavdaemon? Microsoft Defender using CPU on Mac

What wdavdaemon is

If you see wdavdaemon in Activity Monitor, Microsoft Defender is installed on your Mac. It isn't part of macOS. Most often it's Microsoft Defender for Endpoint, which companies and schools install on the Macs they manage. Microsoft also offers a Microsoft Defender app with Microsoft 365 Personal and Family subscriptions (Microsoft, Installing Microsoft Defender); Microsoft documents the process names below for Defender for Endpoint, so that's what this page describes.

Microsoft lists three processes, and which one is busy tells you where the load comes from (Microsoft Learn, troubleshooting performance on macOS):

To see which one it is, open Activity Monitor (press Command-Space and type "Activity Monitor"), click CPU and type wdav in the search field. Defender also installs system extensions: an Endpoint Security extension that, in Microsoft's words, "monitors files, processes, and system events for real-time protection", and a network extension (Microsoft Learn, prerequisites). They're listed in System Settings › General › Login Items & Extensions, under Endpoint Security Extensions and Network Extensions (Apple).

Why it uses so much CPU

Real-time protection, Microsoft says, "consists of file and process monitoring and other heuristics". The more files something touches, the more work Defender does. Microsoft puts it plainly: apps or system processes "that access many resources over a short timespan can lead to performance issues", and it names software updaters and compilers as typical examples (Microsoft Learn, Troubleshoot performance issues). Xcode's build tools appear near the top of Microsoft's own sample output on that page.

In practice, look at what you were doing when it climbed:

• building code, or installing packages (npm, Homebrew, pip) that unpack thousands of small files;
• an app updater or a big macOS update unpacking;
• cloud sync, a backup or a large copy moving many files at once;
• a second antivirus or security product. Microsoft warns that "multiple security products can conflict and affect the host performance".

Is it a work Mac? That decides what you can change

On a Mac your organization manages, Defender's settings come from your IT team, and Microsoft's tamper protection is designed to stop it being removed (Microsoft Learn, tamper protection on macOS). Microsoft lists what it guards, including the app, its launch daemon com.microsoft.fresno, its menu bar agent com.microsoft.wdav.tray and the mdatp command. To check, open System Settings › General › Device Management: profiles from your employer or school there mean the Mac is managed (Apple).

On a managed Mac: don't try to switch Defender off or remove it. Tell IT which process was busy, when, and what you were doing (building a project, syncing a folder). They can add exclusions centrally. Microsoft only lets you add your own exclusions "if your administrator allows user-defined exclusions" (Microsoft Learn, exclusions).

On your own Mac: find what it's scanning

Microsoft's troubleshooting steps use its mdatp command, which Defender installs. Our test Mac doesn't have Defender, so we haven't run these ourselves; they're written exactly as Microsoft documents them. First check the overall state; this only reads:

mdatp health

Look for healthy, real_time_protection_enabled and tamper_protection in the output (Microsoft Learn, agent health). Then, as Microsoft describes for wdavdaemon_unprivileged, turn on scan statistics and save them to a file while the slowdown is happening:

mdatp config real-time-protection-statistics --value enabled
mdatp diagnostic real-time-protection-statistics --output json > real_time_protection.json

The file lists processes and how many files each one caused Defender to scan. Microsoft's page links a small parser script that sorts it by impact; the process at the top is the one to deal with. Microsoft notes the statistics only count activity since real-time protection was last turned on. The first command changes a Defender setting; set it back with --value disabled when you're done.

Microsoft's first diagnostic step is to turn real-time protection off briefly and see whether the Mac speeds up: on a Mac that isn't managed, that's Manage settings in the Defender app, or mdatp config real-time-protection --value disabled. Turn it back on straight afterwards with --value enabled. If the Mac is still slow with real-time protection off, Microsoft says the cause may be the EDR component and to contact its support.

Exclude what you trust, carefully

If one folder causes most of the scans, such as a code project's build folder, you can exclude it (Microsoft Learn):

mdatp exclusion folder add --path "/Users/you/Projects/app/build/"
mdatp exclusion list

Replace the path with your own. Microsoft's warning applies: "Defining exclusions lowers the protection offered by Defender for Endpoint on macOS." Exclude folders you create and control, never your Downloads folder or a whole drive, and remove an exclusion you no longer need (mdatp exclusion folder remove --path …). Updating Defender is also worth doing: Microsoft recommends the latest version before investigating further.

How to remove Microsoft Defender from a Mac

Only do this on a Mac you own, with no employer or school profile. macOS has its own malware protection, XProtect, which runs whether or not Defender is installed; What is XProtect? explains when a separate tool still makes sense.

1. If the Mac was ever managed, Microsoft says to offboard it and remove the policies that manage it first, which is your IT team's job (Microsoft Learn, Resources).
2. In Finder, open Applications, Control-click Microsoft Defender and choose Move to Trash. Enter your password if asked.
3. If that doesn't work, Microsoft's command-line uninstaller is sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall'. It needs your administrator password and removes Defender; it can't be undone except by reinstalling.

Afterwards, check Login Items & Extensions: Defender's extensions should be gone. Use Microsoft's steps rather than a generic uninstaller, because security software installs system extensions; for other apps, see how to uninstall apps on a Mac.

What not to do

• Don't force quit wdavdaemon to make it stop. It's a background service, not an app you're using. On a managed Mac, tamper protection is designed to block attempts to stop Defender's processes, and IT is relying on them.
• Don't delete Defender's files from /Library by hand. Use Microsoft's uninstaller, which also deals with the system extension.
• Don't switch off its parts in a startup-items tool to silence it. That leaves Defender half-working, and on a work Mac it breaks your company's protection.
• Don't turn off System Integrity Protection. Microsoft's own requirements say to keep it on.

How Tend helps

Tend may not be able to show wdavdaemon itself: like any app without administrator rights, it only sees processes running in your account, and Microsoft describes Defender's core process as privileged. What Tend does show, free, is your Mac's whole power draw and, on Energy & Apps in Advanced view, how much of it your own apps account for. The rest is macOS, the display and the processes Tend can't see, Defender's among them, so a big gap while your apps are quiet is a clue rather than a measurement. Its free Startup Items view lists the launch daemon and agent Defender installs, with the app or vendor each belongs to; leave them switched on, for the reasons above.

Questions

Related guides

Sources

• Microsoft Learn, Overview for how to troubleshoot performance issues for Microsoft Defender for Endpoint on macOS
• Microsoft Learn, Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS
• Microsoft Learn, Configure and validate exclusions for Microsoft Defender for Endpoint on macOS
• Microsoft Learn, Troubleshoot agent health issues with Defender for Endpoint on macOS
• Microsoft Learn, Resources for Microsoft Defender for Endpoint on macOS (uninstalling)
• Microsoft Learn, Microsoft Defender for Endpoint on macOS prerequisites
• Microsoft Learn, Configure tamper protection for Microsoft Defender for Endpoint on macOS
• Microsoft Support, Installing Microsoft Defender
• Apple, Change Login Items & Extensions settings on Mac and Device Management settings
• Checked 20 October 2026 against Microsoft's documentation. Tend isn't affiliated with Microsoft. Microsoft and Microsoft Defender are trademarks of the Microsoft group of companies.

Spotted something out of date? Tell us and we'll fix it.