Microsoft releases macOS Tamper Protection

By default, the feature will roll out with audit mode enabled, meaning actions to uninstall the agent will be logged, as will the deletion/renaming/modification of Defender for Endpoint files and the creation of new files in installed locations.