Skip to content

Commit 524d823

Browse files
denisebmsftdenisebmsft
committed
Merge branch 'main' into pr/3626
2 parents 55d6160 + 79053c1 commit 524d823

File tree

4 files changed

+115
-2
lines changed

4 files changed

+115
-2
lines changed

‎defender-endpoint/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -781,6 +781,8 @@
781781
- name: Configure Microsoft Defender Antivirus scans
782782
href: schedule-antivirus-scans.md
783783
items:
784+
- name: Schedule scans using Intune
785+
href: schedule-antivirus-scans-intune.md
784786
- name: Schedule scans using Group Policy
785787
href: schedule-antivirus-scans-group-policy.md
786788
- name: Schedule scans using PowerShell

‎defender-endpoint/schedule-antivirus-scans-intune.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
title: Schedule antivirus scans using Microsoft Intune
3+
description: Schedule antivirus scans using Intune
4+
author: emmwalshh
5+
ms.author: ewalsh
6+
ms.reviewer: yongrhee
7+
ms.service: defender-endpoint
8+
ms.topic: how-to
9+
ms.custom: nextgen
10+
ms.collection:
11+
- m365-security
12+
- tier2
13+
- mde-ngp
14+
search.appverid: met150
15+
ms.date: 04/30/2025
16+
ms.subservice: ngp
17+
ms.localizationpriority: medium
18+
---
19+
20+
# Schedule antivirus scans using Microsoft Intune
21+
22+
**Applies to:**
23+
24+
- [Microsoft Defender XDR](/defender-xdr)
25+
26+
- [Microsoft Defender for Endpoint Plan 1 and Plan 2](microsoft-defender-endpoint.md)
27+
28+
- Microsoft Defender for Business
29+
- Microsoft Defender Antivirus
30+
31+
**Platforms**
32+
33+
- Windows
34+
- Windows Server
35+
36+
This article describes how to configure scheduled scans using Microsoft Intune. To learn more about scheduling scans and about scan types, see [Configure scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md).
37+
38+
## Configure antivirus scans using Intune
39+
40+
1. In the [Intune admin center](https://intune.microsoft.com/), go to **Endpoint security** > **Antivirus** > **Create Policy**. For **Platform**, select **Windows**, and for **Profile**, select **Microsoft Defender Antivirus**. Then select **Create**.
41+
42+
2. On the **Basics** page, specify a name and description for the policy, and then choose **Next**.
43+
44+
3. On the **Configuration settings** page, expand each group of settings, and configure the settings you want to manage with this policy. For more information about these settings, see [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender).
45+
46+
When you're done configuring settings, select **Next**.
47+
48+
4. On the **Scope tags** page, you can either use the default setting, or search for scope tags to assign to the policy. For more information, see [Use role-based access control (RBAC) and scope tags for distributed IT](/intune/intune-service/fundamentals/scope-tags).
49+
50+
When you're done specifying scope tags, select **Next**.
51+
52+
5. On the **Assignments** page, select the users or groups to receive this policy. For more information, see [Assign policies in Microsoft Intune](/intune/intune-service/configuration/device-profile-assign).
53+
54+
When you're done Then select **Next**.
55+
56+
6. On the **Review + create**, review your settings. When you select **Save**, your changes are saved, and the policy is created and applied.
57+
58+
For more information: [Antivirus policy for endpoint security in Intune ](/intune/intune-service/protect/endpoint-security-antivirus-policy)
59+
60+
## Use Intune for scheduling daily quick scans
61+
62+
| Description|Setting|
63+
| -------- | -------- |
64+
|Schedule Quick Scan Time|720|
65+
66+
> [!NOTE]
67+
> In this example, a quick scan runs daily on the Windows clients at 12:00 PM. (720). In this example, we use lunch time, since many devices nowadays are turned off after-hours (e.g laptops).
68+
69+
## Use Intune for scheduling Weekly Scan (Quick or Full)
70+
71+
| Description|Setting|
72+
| -------- | -------- |
73+
|Scan Parameter |Quick scan (Default) |
74+
|Schedule Scan Day|Windows Clients: Wednesday<br>|
75+
|Schedule Scan Time|Windows Clients: 1020 <br>|
76+
77+
> [!NOTE]
78+
> In this example, a quick scan runs for Windows clients on Wednesdays at 5:00 PM. (1020).
79+
80+
> [!TIP]
81+
> Our recommendation for scheduled scans is to configure quick scan together with always-on real-time protection and [cloud protection](/defender-endpoint/cloud-protection-microsoft-defender-antivirus), as this combination provides strong coverage against malware that starts with the system and kernel-level malware. This configuration is the default configuration. In general, there's no need to schedule a full scan, and most users never need to manually run full scans (see [Comparing quick scan, full scan, and custom scan](/defender-endpoint/schedule-antivirus-scans)).
82+
83+
## General settings for Scheduled scan to consider:
84+
85+
|Description| Setting|
86+
| -------- | -------- |
87+
|Check For Signatures Before Running Scan |Disabled (Default)|
88+
|Randomize Schedule Task Times|Not configured|
89+
|Scheduler Randomization Time|Scheduled tasks aren't randomized|
90+
|Avg CPU Load Factor|Not Configured (Default, 50)|
91+
|Enable Low CPU Priority|Disabled (Default)|
92+
|Disable Catchup Full Scan|Enabled (Default)|
93+
|Disable Catchup Quick Scan|Disabled (Default)|
94+
95+
> [!NOTE]
96+
> When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and takes full advantage of the resources available to complete the scan as fast as possible.
97+
98+
### See also
99+
100+
- [Troubleshoot Microsoft Defender Antivirus scan issues](/defender-endpoint/troubleshoot-mdav-scan-issues)
101+
102+
- [Troubleshoot Microsoft Defender Antivirus settings](/defender-endpoint/troubleshoot-settings)
103+
104+
- [Troubleshoot performance issues related to real-time protection](/defender-endpoint/troubleshoot-performance-issues)
105+
106+
- [Run the client analyzer on Windows](/defender-endpoint/run-analyzer-windows)
107+
108+
- [Performance analyzer for Microsoft Defender Antivirus](/defender-endpoint/tune-performance-defender-antivirus)
109+
110+
- [Microsoft Defender Antivirus full scan considerations and best practices](/defender-endpoint/mdav-scan-best-practices)
111+

‎defender-office-365/mdo-support-teams-quick-configure.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ For complete instructions, see [Use the Microsoft Defender portal to modify cust
7777
> [!TIP]
7878
> Teams integration is on in the [Built-in protection preset security policy](preset-security-policies.md), but any other Safe Links policies [take precedence](preset-security-policies.md#order-of-precedence-for-preset-security-policies-and-other-policies) over the Built-in protection preset security policy (as shown in the order they're listed on the **Safe Links** page).
7979
80-
## Step 3: Configure Zero-hour auto purge (ZAP) for Microsoft Teams
80+
## Step 3: Verify Zero-hour auto purge (ZAP) for Microsoft Teams
8181

8282
For complete instructions, see [Configure ZAP for Teams protection in Defender for Office 365 Plan 2](mdo-support-teams-about.md#configure-zap-for-teams-protection-in-defender-for-office-365-plan-2).
8383

‎defender-office-365/recommended-settings-for-eop-and-office365.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,7 @@ In PowerShell, you use the [New-TeamsProtectionPolicy](/powershell/module/exchan
362362
363363
|Security feature name|Default|Standard|Strict|Comment|
364364
|---|:---:|:---:|:---:|---|
365-
|**Zero-hour auto purge (ZAP)** (_ZapEnabled_)|**Off** (`$false`)|**On** (`$true`)|**On** (`$true`)||
365+
|**Zero-hour auto purge (ZAP)** (_ZapEnabled_)|**On** (`$true`)|**On** (`$true`)|**On** (`$true`)||
366366
|**Quarantine policies**|||||
367367
|&nbsp;&nbsp;**Malware** (_MalwareQuarantineTag_)|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy||
368368
|&nbsp;&nbsp;**High confidence phishing** (_HighConfidencePhishQuarantineTag_)|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy|AdminOnlyAccessPolicy||

0 commit comments

Comments
 (0)