Skip to content

Commit 3cfdbc6

Browse files
committed
Update mac-schedule-scan.md
1 parent a8544be commit 3cfdbc6

File tree

1 file changed

+28
-25
lines changed

1 file changed

+28
-25
lines changed

defender-endpoint/mac-schedule-scan.md

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,12 @@
22
title: How to schedule scans with Microsoft Defender for Endpoint on macOS
33
description: Learn how to schedule an automatic scanning time for Microsoft Defender for Endpoint in macOS to better protect your organization's assets.
44
ms.service: defender-endpoint
5-
author: YongRhee-MSFT
6-
ms.author: yongrhee
7-
manager: dansimp
5+
author: denisebmsft
6+
ms.author: deniseb
7+
manager: deniseb
8+
ms.reviewer: yonghree
89
ms.localizationpriority: medium
9-
ms.date: 05/06/2024
10+
ms.date: 10/23/2024
1011
audience: ITPro
1112
ms.collection:
1213
- m365-security
@@ -28,7 +29,7 @@ search.appverid: met150
2829

2930
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
3031
31-
## Schedule a scan *built-in to* Microsoft Defender for Endpoint on macOS
32+
## Schedule a scan built into Microsoft Defender for Endpoint on macOS
3233

3334
While you can start a threat scan at any time with Microsoft Defender for Endpoint, your enterprise might benefit from scheduled or timed scans. For example, you can schedule a scan to run at the beginning of every workday or week.
3435

@@ -38,11 +39,11 @@ There are three types of scheduled scans that are configurable: hourly, daily, a
3839

3940
- Platform Update version: [101.23122.0005](mac-whatsnew.md#jan-2024-build-101231220005---release-version-2012312250) or newer
4041

41-
## Schedule a scan with *Microsoft Defender for Endpoint on macOS*
42+
## Schedule a scan with Microsoft Defender for Endpoint on macOS
4243

4344
You can create a scheduled scan for your macOS, which is built in to *Microsoft Defender for Endpoint on macOS*.
4445

45-
For more information on the _.plist_ file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
46+
For more information on the `.plist` file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
4647

4748
The following sample shows the daily and/or weekly configuration for the scheduled scan on macOS.
4849

@@ -56,23 +57,21 @@ The following sample shows the daily and/or weekly configuration for the schedul
5657
| ignoreExclusions | true or false |
5758
| lowPriorityScheduledScan | true or false |
5859
| dayOfWeek | The range is between 0 and 8. <br>- 0: Everyday <br>- 1: Sunday <br>- 2: Monday <br>- 3: Tuesday <br>- 4: Wednesday <br>- 5: Thursday <br>- 6: Friday <br>- 7: Saturday <br>- 8: Never |
59-
| timeOfDay | Specifies the time of day, as the number of _minutes after midnight_, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
60+
| timeOfDay | Specifies the time of day, as the number of `minutes after midnight`, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
6061
| interval | 0 (never), every 1 (hour) to 24 (hours, 1 scan per day) |
6162
| randomizeScanStartTime | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and randomizeScanStartTime is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
6263

63-
Your scheduled scan runs at the date, time, and frequency you defined in your _plist_.
64+
Your scheduled scan runs at the date, time, and frequency you defined in your `plist`.
6465

65-
### Example 1: Schedule a daily quick scan and weekly full scan using a _plist_
66+
### Example 1: Schedule a daily quick scan and weekly full scan using a plist
6667

67-
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.).<br>
68-
The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.).
69-
And it's set to ignore exclusions and run a low priority scan.
68+
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.
7069

7170
The following code shows the schema you need to use to schedule scans according to the requirements above.
7271

7372
1. Open a text editor and use this example as a guide for your own scheduled scan file.
7473

75-
#### For Intune:
74+
#### For Intune
7675

7776
``` XML
7877
<?xml version="1.0" encoding="UTF-8"?>
@@ -148,9 +147,10 @@ The following code shows the schema you need to use to schedule scans according
148147
</plist>
149148
```
150149

151-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
150+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
151+
152+
#### For JamF and other 3rd-party MDMs
152153

153-
#### For JamF and other 3rd-party MDMs:
154154
``` XML
155155
<?xml version="1.0" encoding="UTF-8"?>
156156
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -186,7 +186,8 @@ The following code shows the schema you need to use to schedule scans according
186186
</plist>
187187
```
188188

189-
2. Save the file as _com.microsoft.wdav.plist_.
189+
2. Save the file as `com.microsoft.wdav.plist`.
190+
190191
3. Check that the scheduled scan is configured via a "Set Preference"
191192

192193
```
@@ -195,7 +196,7 @@ The following code shows the schema you need to use to schedule scans according
195196
196197
In the results, you should be able to see [managed].
197198
198-
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a _plist_
199+
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a plist
199200
200201
In the following example, an hourly quick scan will run every 6 hours, a daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan will run on Wednesdays at 880 minutes after midnight (2:40 p.m).
201202
@@ -277,9 +278,11 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
277278
</dict>
278279
</plist>
279280
```
280-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
281281

282-
#### For JamF and other 3rd-party MDMs:
282+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
283+
284+
#### For JamF and other 3rd-party MDMs
285+
283286
1. Open a text editor and use this example.
284287

285288
```XML
@@ -319,7 +322,7 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
319322
</plist>
320323
```
321324

322-
2. Save the file as _com.microsoft.wdav.plist_.
325+
2. Save the file as `com.microsoft.wdav.plist`.
323326

324327
3. Check that the scheduled scan is configured via a "Set Preference"
325328

@@ -335,29 +338,29 @@ To enable scheduled scan feature:
335338
336339
|Version|Command|
337340
|---|---|
338-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan settings feature --value enabled` |
341+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan settings feature --value enabled` |
339342
340343
To schedule hourly quick scans:
341344
342345
|Version|Command|
343346
|---|---|
344-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
347+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
345348
346349
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic1.png" alt-text="Screenshot of schedule hourly scan.":::
347350
348351
To schedule daily quick scans:
349352
350353
|Version|Command|
351354
|---|---|
352-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
355+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
353356
354357
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic2.png" alt-text="Screenshot of schedule daily quick scan.":::
355358
356359
To schedule weekly scans:
357360
358361
|Version|Command|
359362
|---|---|
360-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
363+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
361364
362365
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::
363366

0 commit comments

Comments
 (0)