diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 2d41324274..a35fd74410 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -219,6 +219,7 @@ ##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) ##### [Set preferences](microsoft-defender-atp/mac-preferences.md) ##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +##### [Schedule scans](microsoft-defender-atp/mac-schedule-scan-atp.md) #### [Troubleshoot]() ##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp.md b/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp.md new file mode 100644 index 0000000000..d7a913d13f --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp.md @@ -0,0 +1,78 @@ +--- +title: How to schedule scans with MDATP for macOS +description: Learn how to schedule an automatic scanning time for Microsoft Defender ATP in macOS to better protect your organization's assets. +keywords: microsoft, defender, atp, mac, scans, antivirus +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Schedule scans with Microsoft Defender ATP for Mac + +While you can start a threat scan at any time with Microsoft Defender ATP, your enterprise might benefit from scheduled or timed scans. For example, you can schedule a scan to run at the beginning of every workday or week. Create a scanning schedule using launchd on a macOS computer. + +## Schedule a scan with launchd + +1. Create a new .xml file. Use the following example to create your scanning schedule file. + + ```xml + + + + + Label + com.microsoft.wdav.schedquickscan + ProgramArguments + + sh + -c + /usr/local/bin/mdatp --scan --quick + + RunAtLoad + + StartCalendarInterval + Day + 3 + Hour + 2 + Minute + 0 + Weekday + 5 + + StartInterval + 604800 + WorkingDirectory + /usr/local/bin/ + + + ``` + +2. Save the file as a program configuration file (.plist) with the name com.microsoft.wdav.schedquickscan.plist. + + >[!NOTE] + >To change a quick scan to a full scan, use /usr/local/bin/mdatp --scan –full in the array string and update your .plist filename. + +3. Search for, and then open **Terminal**. +4. To load your file into **launchd**, enter the following commands: + + ```bash + `$ launchctl load /Library/LaunchDaemons/` + `$ launchctl start ` + ``` + +5. Your scheduled scan runs at the date, time, and frequency you defined in your .plist file. In the example, the scan runs at 2:00 AM every 7 days on a Friday, with the StartInterval using 604800 seconds for one week. + + > [!NOTE] + > Agents executed with launchd will not run at the scheduled time if the computer is asleep, but will run once the computer is awake. If the computer is off, the scan will not run until the computer is on at the next scheduled time.