Daily Defender News
Aboutmerill.net
Microsoft Security Exposure Management
Vulnerabilities and exposure

Trigger an on-demand agentic scan (private preview)

4 September 2026Feature update+10 / −5 lines

In brief

The documentation now covers SCM connectors, including GitHub and Azure DevOps. Repositories may take up to one hour to become available after connector activation, and each scan can use the default GPT-General profile or the MAI-Augmented preview profile.

What Defender admins need to know

Administrators should allow up to one hour for onboarded repositories and can choose a scan profile for each scan.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Trigger an on-demand agentic scan (private preview)

After activating the GitHubSCM connector, the ability to trigger an on-demand agentic code scan for onboarded repositories becomes available within up to one hour.repositories.

Prerequisites

  • A GitHub connector created and activated. See Create a GitHub connector.

    Prerequisites

    Step 1: Open Manage scans

    1. In the Microsoft Defender portal,Microsoft Defender portal, go to Exposure management > Initiatives.
    2. Open the Codename MDASH - Agentic code scanner (preview) initiative, and then select Open initiative page.
    3. Select the Manage scans button (next to the Settings button).
    • Scan status — last scan
    • Tokens consumed in the last scan

    The repository size and tokens consumed signals can help your security team predict the impact of a scan before running it.rescan.

    Step 3: Select a repository and run a scan

    1. Select the repository you want to scan.
    2. Select Start scan.
    3. Confirm inIn the dialog that appears.confirmation dialog, choose the scan profile to use for this scan only — keep the default GPT-General profile, or select MAI-Augmented profile (Preview) — then select Scan repo. The selection applies to this scan only. A profile whose required models aren't deployed shows an inline error and can't be selected. For the models required by each profile, see Deploy the required models.

    If your tenant already has 10 queued scans from the portal and the CLI combined, a warning appears. You can still submit the scan. Queued scans that don't start running within 72 hours of submission are automatically cleaned up, so some queued scans might not run.