Skip to content

Commit d473cbf

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #1688 from MicrosoftDocs/repo_sync_working_branch
Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/defender-docs (branch public)
2 parents 15610cb + 6e4c7b5 commit d473cbf

File tree

1 file changed

+104
-99
lines changed

1 file changed

+104
-99
lines changed

‎defender-endpoint/mac-schedule-scan.md‎

Lines changed: 104 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,12 @@
22
title: How to schedule scans with Microsoft Defender for Endpoint on macOS
33
description: Learn how to schedule an automatic scanning time for Microsoft Defender for Endpoint in macOS to better protect your organization's assets.
44
ms.service: defender-endpoint
5-
author: YongRhee-MSFT
6-
ms.author: yongrhee
5+
author: denisebmsft
6+
ms.author: deniseb
77
manager: deniseb
8+
ms.reviewer: yonghree
89
ms.localizationpriority: medium
9-
ms.date: 05/06/2024
10+
ms.date: 10/23/2024
1011
audience: ITPro
1112
ms.collection:
1213
- m365-security
@@ -28,21 +29,21 @@ search.appverid: met150
2829

2930
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
3031
31-
## Schedule a scan *built-in to* Microsoft Defender for Endpoint on macOS
32+
## Schedule a scan built into Microsoft Defender for Endpoint on macOS
3233

3334
While you can start a threat scan at any time with Microsoft Defender for Endpoint, your enterprise might benefit from scheduled or timed scans. For example, you can schedule a scan to run at the beginning of every workday or week.
3435

35-
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It is possible to have all three types of scheduled scans at the same time. See the samples below.
36+
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It's possible to have all three types of scheduled scans at the same time. See the samples in this article.
3637

3738
**Prerequisites**:
3839

3940
- Platform Update version: [101.23122.0005](mac-whatsnew.md#jan-2024-build-101231220005---release-version-2012312250) or newer
4041

41-
## Schedule a scan with *Microsoft Defender for Endpoint on macOS*
42+
## Schedule a scan with Microsoft Defender for Endpoint on macOS
4243

4344
You can create a scheduled scan for your macOS, which is built in to *Microsoft Defender for Endpoint on macOS*.
4445

45-
For more information on the _.plist_ file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
46+
For more information on the `.plist` file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
4647

4748
The following sample shows the daily and/or weekly configuration for the scheduled scan on macOS.
4849

@@ -51,106 +52,107 @@ The following sample shows the daily and/or weekly configuration for the schedul
5152
5253
| Parameter | The acceptable values for this parameter are: |
5354
| --- | --- |
54-
| scheduledScan | enabled or disabled |
55-
| scanType | quick or full |
56-
| ignoreExclusions | true or false |
57-
| lowPriorityScheduledScan | true or false |
58-
| dayOfWeek | The range is between 0 and 8. <br>- 0: Everyday <br>- 1: Sunday <br>- 2: Monday <br>- 3: Tuesday <br>- 4: Wednesday <br>- 5: Thursday <br>- 6: Friday <br>- 7: Saturday <br>- 8: Never |
59-
| timeOfDay | Specifies the time of day, as the number of _minutes after midnight_, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
60-
| interval | 0 (never), every 1 (hour) to 24 (hours, 1 scan per day) |
61-
| randomizeScanStartTime | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and randomizeScanStartTime is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
55+
| `scheduledScan` | `enabled` or `disabled` |
56+
| `scanType` | `quick` or `full` |
57+
| `ignoreExclusions` | `true` or `false` |
58+
| lowPriorityScheduledScan | `true` or `false` |
59+
| `dayOfWeek` | The range is between `0` and `8`. <br>- `0`: Everyday <br>- `1`: Sunday <br>- `2`: Monday <br>- `3`: Tuesday <br>- `4`: Wednesday <br>- `5`: Thursday <br>- `6`: Friday <br>- `7`: Saturday <br>- `8`: Never |
60+
| `timeOfDay` | Specifies the time of day, as the number of `minutes after midnight`, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
61+
| `interval` | `0` (never), `every 1` (hour) to `every 24` (hours, one scan per day) |
62+
| `randomizeScanStartTime` | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and `randomizeScanStartTime` is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
6263

63-
Your scheduled scan runs at the date, time, and frequency you defined in your _plist_.
64+
Your scheduled scan runs at the date, time, and frequency you defined in your `plist`.
6465

65-
### Example 1: Schedule a daily quick scan and weekly full scan using a _plist_
66+
### Example 1: Schedule a daily quick scan and weekly full scan using a plist
6667

67-
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.).<br>
68-
The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.).
69-
And it's set to ignore exclusions and run a low priority scan.
68+
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.
7069

71-
The following code shows the schema you need to use to schedule scans according to the requirements above.
70+
The following code shows the schema you need to use to schedule scans according to the requirements mentioned earlier.
7271

7372
1. Open a text editor and use this example as a guide for your own scheduled scan file.
7473

75-
#### For Intune:
74+
#### For Intune
7675

7776
``` XML
7877
<?xml version="1.0" encoding="UTF-8"?>
7978
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
8079
<plist version="1.0">
8180
<dict>
82-
<key>PayloadUUID</key>
83-
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
84-
<key>PayloadType</key>
85-
<string>Configuration</string>
86-
<key>PayloadOrganization</key>
87-
<string>Microsoft</string>
88-
<key>PayloadIdentifier</key>
89-
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
90-
<key>PayloadDisplayName</key>
91-
<string>Microsoft Defender for Endpoint settings</string>
92-
<key>PayloadDescription</key>
93-
<string>Microsoft Defender for Endpoint configuration settings</string>
94-
<key>PayloadVersion</key>
95-
<integer>1</integer>
96-
<key>PayloadEnabled</key>
97-
<true/>
98-
<key>PayloadRemovalDisallowed</key>
99-
<true/>
100-
<key>PayloadScope</key>
101-
<string>System</string>
102-
<key>PayloadContent</key>
103-
<array>
104-
<dict>
105-
<key>PayloadUUID</key>
106-
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
107-
<key>PayloadType</key>
108-
<string>com.microsoft.wdav</string>
109-
<key>PayloadOrganization</key>
110-
<string>Microsoft</string>
111-
<key>PayloadIdentifier</key>
112-
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
113-
<key>PayloadDisplayName</key>
114-
<string>Microsoft Defender for Endpoint configuration settings</string>
115-
<key>PayloadDescription</key>
116-
<string/>
117-
<key>PayloadVersion</key>
118-
<integer>1</integer>
119-
<key>PayloadEnabled</key>
120-
<true/>
121-
<key>features</key>
122-
<dict>
123-
<key>scheduledScan</key>
124-
<string>enabled</string>
125-
</dict>
126-
<key>scheduledScan</key>
127-
<dict>
128-
<key>ignoreExclusions</key>
129-
<true/>
130-
<key>lowPriorityScheduledScan</key>
131-
<true/>
132-
<key>dailyConfiguration</key>
133-
<dict>
134-
<key>timeOfDay</key>
135-
<integer>885</integer>
136-
</dict>
137-
<key>weeklyConfiguration</key>
138-
<dict>
139-
<key>dayOfWeek</key>
140-
<integer>4</integer>
141-
<key>timeOfDay</key>
142-
<integer>880</integer>
143-
<key>scanType</key>
144-
<string>full</string>
145-
</dict>
146-
</dict>
81+
<key>PayloadUUID</key>
82+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
83+
<key>PayloadType</key>
84+
<string>Configuration</string>
85+
<key>PayloadOrganization</key>
86+
<string>Microsoft</string>
87+
<key>PayloadIdentifier</key>
88+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
89+
<key>PayloadDisplayName</key>
90+
<string>Microsoft Defender for Endpoint settings</string>
91+
<key>PayloadDescription</key>
92+
<string>Microsoft Defender for Endpoint configuration settings</string>
93+
<key>PayloadVersion</key>
94+
<integer>1</integer>
95+
<key>PayloadEnabled</key>
96+
<true/>
97+
<key>PayloadRemovalDisallowed</key>
98+
<true/>
99+
<key>PayloadScope</key>
100+
<string>System</string>
101+
<key>PayloadContent</key>
102+
<array>
103+
<dict>
104+
<key>PayloadUUID</key>
105+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
106+
<key>PayloadType</key>
107+
<string>com.microsoft.wdav</string>
108+
<key>PayloadOrganization</key>
109+
<string>Microsoft</string>
110+
<key>PayloadIdentifier</key>
111+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
112+
<key>PayloadDisplayName</key>
113+
<string>Microsoft Defender for Endpoint configuration settings</string>
114+
<key>PayloadDescription</key>
115+
<string/>
116+
<key>PayloadVersion</key>
117+
<integer>1</integer>
118+
<key>PayloadEnabled</key>
119+
<true/>
120+
<key>features</key>
121+
<dict>
122+
<key>scheduledScan</key>
123+
<string>enabled</string>
124+
</dict>
125+
<key>scheduledScan</key>
126+
<dict>
127+
<key>ignoreExclusions</key>
128+
<true/>
129+
<key>lowPriorityScheduledScan</key>
130+
<true/>
131+
<key>dailyConfiguration</key>
132+
<dict>
133+
<key>timeOfDay</key>
134+
<integer>880</integer>
135+
</dict>
136+
<key>weeklyConfiguration</key>
137+
<dict>
138+
<key>dayOfWeek</key>
139+
<integer>4</integer>
140+
<key>timeOfDay</key>
141+
<integer>885</integer>
142+
<key>scanType</key>
143+
<string>full</string>
144+
</dict>
145+
</dict>
146+
</dict>
147+
</array>
147148
</dict>
148-
</plist>
149+
</plist>
149150
```
150151

151-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
152+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
153+
154+
#### For JamF and other 3rd-party MDMs
152155

153-
#### For JamF and other 3rd-party MDMs:
154156
``` XML
155157
<?xml version="1.0" encoding="UTF-8"?>
156158
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -186,7 +188,8 @@ The following code shows the schema you need to use to schedule scans according
186188
</plist>
187189
```
188190

189-
2. Save the file as _com.microsoft.wdav.plist_.
191+
2. Save the file as `com.microsoft.wdav.plist`.
192+
190193
3. Check that the scheduled scan is configured via a "Set Preference"
191194

192195
```
@@ -195,7 +198,7 @@ The following code shows the schema you need to use to schedule scans according
195198
196199
In the results, you should be able to see [managed].
197200
198-
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a _plist_
201+
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a plist
199202
200203
In the following example, an hourly quick scan will run every 6 hours, a daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan will run on Wednesdays at 880 minutes after midnight (2:40 p.m).
201204
@@ -277,9 +280,11 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
277280
</dict>
278281
</plist>
279282
```
280-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
281283

282-
#### For JamF and other 3rd-party MDMs:
284+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
285+
286+
#### For JamF and other 3rd-party MDMs
287+
283288
1. Open a text editor and use this example.
284289

285290
```XML
@@ -319,7 +324,7 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
319324
</plist>
320325
```
321326

322-
2. Save the file as _com.microsoft.wdav.plist_.
327+
2. Save the file as `com.microsoft.wdav.plist`.
323328

324329
3. Check that the scheduled scan is configured via a "Set Preference"
325330

@@ -335,29 +340,29 @@ To enable scheduled scan feature:
335340
336341
|Version|Command|
337342
|---|---|
338-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan settings feature --value enabled` |
343+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan settings feature --value enabled` |
339344
340345
To schedule hourly quick scans:
341346
342347
|Version|Command|
343348
|---|---|
344-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
349+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
345350
346351
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic1.png" alt-text="Screenshot of schedule hourly scan.":::
347352
348353
To schedule daily quick scans:
349354
350355
|Version|Command|
351356
|---|---|
352-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
357+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
353358
354359
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic2.png" alt-text="Screenshot of schedule daily quick scan.":::
355360
356361
To schedule weekly scans:
357362
358363
|Version|Command|
359364
|---|---|
360-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
365+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
361366
362367
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::
363368

0 commit comments

Comments
 (0)