You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/mac-schedule-scan.md
+28-25Lines changed: 28 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,11 +2,12 @@
2
2
title: How to schedule scans with Microsoft Defender for Endpoint on macOS
3
3
description: Learn how to schedule an automatic scanning time for Microsoft Defender for Endpoint in macOS to better protect your organization's assets.
4
4
ms.service: defender-endpoint
5
-
author: YongRhee-MSFT
6
-
ms.author: yongrhee
7
-
manager: dansimp
5
+
author: denisebmsft
6
+
ms.author: deniseb
7
+
manager: deniseb
8
+
ms.reviewer: yonghree
8
9
ms.localizationpriority: medium
9
-
ms.date: 05/06/2024
10
+
ms.date: 10/23/2024
10
11
audience: ITPro
11
12
ms.collection:
12
13
- m365-security
@@ -28,7 +29,7 @@ search.appverid: met150
28
29
29
30
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
30
31
31
-
## Schedule a scan *built-in to* Microsoft Defender for Endpoint on macOS
32
+
## Schedule a scan built into Microsoft Defender for Endpoint on macOS
32
33
33
34
While you can start a threat scan at any time with Microsoft Defender for Endpoint, your enterprise might benefit from scheduled or timed scans. For example, you can schedule a scan to run at the beginning of every workday or week.
34
35
@@ -38,11 +39,11 @@ There are three types of scheduled scans that are configurable: hourly, daily, a
38
39
39
40
- Platform Update version: [101.23122.0005](mac-whatsnew.md#jan-2024-build-101231220005---release-version-2012312250) or newer
40
41
41
-
## Schedule a scan with *Microsoft Defender for Endpoint on macOS*
42
+
## Schedule a scan with Microsoft Defender for Endpoint on macOS
42
43
43
44
You can create a scheduled scan for your macOS, which is built in to *Microsoft Defender for Endpoint on macOS*.
44
45
45
-
For more information on the _.plist_ file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
46
+
For more information on the `.plist` file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
46
47
47
48
The following sample shows the daily and/or weekly configuration for the scheduled scan on macOS.
48
49
@@ -56,23 +57,21 @@ The following sample shows the daily and/or weekly configuration for the schedul
56
57
| ignoreExclusions | true or false |
57
58
| lowPriorityScheduledScan | true or false |
58
59
| dayOfWeek | The range is between 0 and 8. <br>- 0: Everyday <br>- 1: Sunday <br>- 2: Monday <br>- 3: Tuesday <br>- 4: Wednesday <br>- 5: Thursday <br>- 6: Friday <br>- 7: Saturday <br>- 8: Never |
59
-
| timeOfDay | Specifies the time of day, as the number of _minutes after midnight_, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
60
+
| timeOfDay | Specifies the time of day, as the number of `minutes after midnight`, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
60
61
| interval | 0 (never), every 1 (hour) to 24 (hours, 1 scan per day) |
61
62
| randomizeScanStartTime | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and randomizeScanStartTime is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
62
63
63
-
Your scheduled scan runs at the date, time, and frequency you defined in your _plist_.
64
+
Your scheduled scan runs at the date, time, and frequency you defined in your `plist`.
64
65
65
-
### Example 1: Schedule a daily quick scan and weekly full scan using a _plist_
66
+
### Example 1: Schedule a daily quick scan and weekly full scan using a plist
66
67
67
-
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.).<br>
68
-
The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.).
69
-
And it's set to ignore exclusions and run a low priority scan.
68
+
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.
70
69
71
70
The following code shows the schema you need to use to schedule scans according to the requirements above.
72
71
73
72
1. Open a text editor and use this example as a guide for your own scheduled scan file.
74
73
75
-
#### For Intune:
74
+
#### For Intune
76
75
77
76
```XML
78
77
<?xml version="1.0" encoding="UTF-8"?>
@@ -148,9 +147,10 @@ The following code shows the schema you need to use to schedule scans according
148
147
</plist>
149
148
```
150
149
151
-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
150
+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
151
+
152
+
#### For JamF and other 3rd-party MDMs
152
153
153
-
#### For JamF and other 3rd-party MDMs:
154
154
```XML
155
155
<?xml version="1.0" encoding="UTF-8"?>
156
156
<!DOCTYPEplist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -186,7 +186,8 @@ The following code shows the schema you need to use to schedule scans according
186
186
</plist>
187
187
```
188
188
189
-
2. Save the file as _com.microsoft.wdav.plist_.
189
+
2. Save the file as `com.microsoft.wdav.plist`.
190
+
190
191
3. Check that the scheduled scan is configured via a "Set Preference"
191
192
192
193
```
@@ -195,7 +196,7 @@ The following code shows the schema you need to use to schedule scans according
195
196
196
197
In the results, you should be able to see [managed].
197
198
198
-
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a _plist_
199
+
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a plist
199
200
200
201
In the following example, an hourly quick scan will run every 6 hours, a daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan will run on Wednesdays at 880 minutes after midnight (2:40 p.m).
201
202
@@ -277,9 +278,11 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
277
278
</dict>
278
279
</plist>
279
280
```
280
-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
281
281
282
-
#### For JamF and other 3rd-party MDMs:
282
+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
283
+
284
+
#### For JamF and other 3rd-party MDMs
285
+
283
286
1. Open a text editor and use this example.
284
287
285
288
```XML
@@ -319,7 +322,7 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
319
322
</plist>
320
323
```
321
324
322
-
2. Save the file as _com.microsoft.wdav.plist_.
325
+
2. Save the file as `com.microsoft.wdav.plist`.
323
326
324
327
3. Check that the scheduled scan is configured via a "Set Preference"
325
328
@@ -335,29 +338,29 @@ To enable scheduled scan feature:
335
338
336
339
|Version|Command|
337
340
|---|---|
338
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan settings feature --value enabled` |
341
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan settings feature --value enabled` |
339
342
340
343
To schedule hourly quick scans:
341
344
342
345
|Version|Command|
343
346
|---|---|
344
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
347
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
345
348
346
349
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic1.png" alt-text="Screenshot of schedule hourly scan.":::
347
350
348
351
To schedule daily quick scans:
349
352
350
353
|Version|Command|
351
354
|---|---|
352
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
355
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
353
356
354
357
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic2.png" alt-text="Screenshot of schedule daily quick scan.":::
355
358
356
359
To schedule weekly scans:
357
360
358
361
|Version|Command|
359
362
|---|---|
360
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
363
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
361
364
362
365
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::
0 commit comments