Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Mac Schedule Scan

4 September 2026Doc update+15 / −15 lines

In brief

The article now links directly to parameter tables and Intune/Jamf examples, clarifies the sample configurations, and adds clearer guidance for using mdatp commands to configure and list scheduled scans.

What Defender admins need to know

Administrators can find the relevant deployment examples and command-line instructions more easily.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.

Use the plist schema shown here to configure a daily quick scan and a weekly full scan with the scheduled scan parameters described in the preceding table.scheduled scan parameter table in this article.

Open a text editor and use the Intune mobileconfigIntune mobileconfig and JamF plistJamF plist examples in this sectionthat follow as a guide for your own scheduled scan file.

For Intune

Use theThe following mobileconfig plist sample to deploy thisdefines a complete Intune configuration profile that enables scheduled scanning with a daily quick scan configuration through Intune.and a weekly full scan.

<?xml version="1.0" encoding="UTF-8"?>

#### For JamF and other third-party MDMs

Use theThe following plist sample configures the same daily quick scan and weekly full scan settings for JamF and other third-party MDM solutions. Save this content as `com.microsoft.wdav.plist`.

``` XML
<?xml version="1.0" encoding="UTF-8"?>

In this hourly, daily, and weekly scheduled scan example, an hourly quick scan runs every 6 hours, a daily quick scan is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan runs on Wednesdays at 880 minutes after midnight (2:40 p.m.).

Open a text editor and use the Intune mobileconfig[Intune mobileconfig](#for-intune-1) and JamF plist[JamF plist](#for-jamf-and-other-third-party-mdms-1) examples in this sectionthat follow as a guide for your own scheduled scan file.

#### For Intune:

Use theThe following mobileconfig plist sample packages the hourly, daily, and weekly Defender scheduled scan settings into a complete Intune configuration profile. Use this sample to deploy thisthe scheduled scan configuration through Intune.

```XML
<?xml version="1.0" encoding="UTF-8"?>

#### For JamF and other third-party MDMs

Use theThe following plist sample configures the same hourly, daily, and weekly scheduled scan settings for JamF and other third-party MDM solutions. Save this content as `com.microsoft.wdav.plist`.

```XML
    <?xml version="1.0" encoding="UTF-8"?>

### Upload the plist file to Jamf Pro

ToUse these steps to upload either of the scheduled scanJamF plist configurationexamples from [Example 1](#example-1-schedule-a-daily-quick-scan-and-weekly-full-scan-using-a-plist) or [Example 2](#example-2-schedule-an-hourly-quick-scan-a-daily-quick-scan-and-weekly-full-scan-using-a-plist) to Jamf Pro, complete the following steps:Pro:

1. Go to **Computers > Configuration Profiles.**

<a name="option-3-configure-scheduled-scans-through-cli-tool"></a>
### Configure scheduled scans using the mdatp CLI

The Microsoft Defender for Endpoint command-line tool (`mdatp`) provides commands to configure scheduled scans directly from the terminal.

To enable the scheduled scan feature:

|Version|Command|
|---|---|

:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::

For other configuration options:You can also configure definition updates and low-priority threading for scheduled scans:

- To check for definitions update before scheduled scans:


### Check that the scheduled scan ran

Use the following command:To list completed scheduled scans and their results, run `mdatp scan list`:

:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic4.png" alt-text="Screenshot of schedule ran.":::`\<snip\>`