Microsoft Defender for Endpoint

com.microsoft.wdav

Microsoft Defender for Endpoint settings

macOS

Configuration Keys (10)

Showing 10 of 10 keys

Key	Type	Description	Default	Range
`antivirusEngine`dict Antivirus engine	dict	Manages the preferences of the antivirus component of Microsoft Defender for Endpoint.	Default: —	Range: —
`behaviorMonitoring`string Behavior Monitoring	string	Determines whether behavior monitoring and blocking capability is enabled on the device or not.	Default: "enabled"	Range: Disabled (disabled), Enabled (enabled)
`enforcementLevel`string Enforcement level for antivirus engine	string	Enforcement level of antivirus engine. On-demand: Files are scanned only on demand; Passive: Same as on-demand, but also security intelligence updates are enabled, and the status menu icon is hidden; Real-time: Scan files as they are accessed. Depends on: antivirusEngine.behaviorMonitoring ∈ [enabled]	Default: "real_time"	Range: Passive (passive), On-demand (on_demand), Real-time (real_time)
`enableFileHashComputation`boolean Enable file hash computation	boolean	Enables or disables file hash computation feature. When this feature is enabled Defender will compute hashes for files it scans. This will help in improving the accuracy of Custom Indicator matches. However, enabling EnableFileHashComputation may impact device performance.	Default: false	Range: —
`scanAfterDefinitionUpdate`boolean Run a scan after definitions are updated	boolean	Specifies whether to start a process scan after new security intelligence updates are downloaded on the device. Enabling this setting will trigger an antivirus scan on the running processes of the device.	Default: true	Range: —
`scanArchives`boolean Scanning inside archive files	boolean	If true, Defender will unpack archives and scan files inside them. Otherwise archive content will be skipped, that will improve scanning performance.	Default: true	Range: —
`maximumOnDemandScanThreads`integer Degree of parallelism for on-demand scans	integer	Specifies the degree of parallelism for on-demand scans. This corresponds to the number of threads used to perform the scan and impacts the CPU usage, as well as the duration of the on-demand scan.	Default: 2	Range: 1 – 64
`exclusionsMergePolicy`string Exclusions merge	string	Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (merge) or only administrator-defined exclusions (admin_only). This setting can be used to restrict local users from defining their own exclusions.	Default: "merge"	Range: Merge (merge), Admin Only (admin_only)
`exclusions`array Scan exclusions	array	Entities that have been excluded from the scan. Exclusions can be specified by full paths, extensions, or file names.	Default: —	Range: —
dict Exclusions	dict	—	Default: —	Range: —
`$type`string Type	string	Specify content excluded from being scanned by type.	Default: "excludedPath"	Range: Path (excludedPath), File extension (excludedFileExtension), Process name (excludedFileName)
`path`string Path	string	Path to exclude, wildcards are supported	Default: —	Range: 1 – —
`isDirectory`boolean Is directory	boolean	Directory if selected, or file if not selected	Default: false	Range: —
`extension`string File extension	string	Specify content excluded from being scanned by file extension.	Default: —	Range: 1 – —
`name`string Process name	string	Process name, either or full path or file name, wildcards supported	Default: —	Range: 1 – —
`allowedThreats`array Allowed threats	array	List of threats (identified by their name) that are not blocked by the product and are instead allowed to run.	Default: —	Range: —
string Threat	string	—	Default: —	Range: —
`disallowedThreatActions`array Disallowed threat actions	array	Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list are not displayed in the user interface. Use unique values.	Default: —	Range: —
string Action	string	—	Default: —	Range: Allow Threats (restricts users from allowing threats) (allow), Restore Threats (restricts users from restoring threats from the quarantine) (restore)
`threatTypeSettings`array Threat type settings	array	The threatTypeSettings preference in the antivirus engine is used to control how certain threat types are handled by the product.	Default: —	Range: —
dict Setting	dict	—	Default: —	Range: —
`key`string Threat type	string	Type of the threat for which the behavior is configured.	Default: —	Range: Potentially Unwanted Application (potentially_unwanted_application), Archive Bomb (archive_bomb)
`value`string Action to take	string	Action to take when coming across a threat of the type specified in the preceding section.	Default: "audit"	Range: Audit (audit), Block (block), Off (off)
`threatTypeSettingsMergePolicy`string Threat type settings merge	string	Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (merge) or only administrator-defined settings (admin_only). This setting can be used to restrict local users from defining their own settings for different threat types.	Default: "merge"	Range: Merge (merge), Admin Only (admin_only)
`scanResultsRetentionDays`integer Scan results retention	integer	Specify the number of days that results are retained in the scan history on the device. Old scan results are removed from the history. Old quarantined files that are also removed from the disk.	Default: 90	Range: 1 – 180
`scanHistoryMaximumItems`integer Scan history size	integer	Specify the maximum number of entries to keep in the scan history. Entries include all on-demand scans performed in the past and all antivirus detections.	Default: 10000	Range: 5000 – 15000
`enableRealTimeProtection`boolean Real-time protection	boolean	Locates and stops malware from installing or running on your device. You can turn off this setting for a short time before it turns back on automatically.	Default: true	Range: —
`passiveMode`boolean Passive mode	boolean	Whether the antivirus engine runs in passive mode or not.	Default: false	Range: —
`cloudService`dict Cloud delivered protection preferences	dict	Configure the cloud-driven protection features of Microsoft Defender for Endpoint.	Default: —	Range: —
`enabled`boolean Cloud delivered protection	boolean	Provides increased, faster protection with access to the latest protection data in the cloud. Works best with automatic sample submission turned on	Default: true	Range: —
`diagnosticLevel`string Diagnostic data collection	string	We encourage you to share your diagnostic and usage data with us to help improve Microsoft products and services.	Default: "optional"	Range: Optional (optional), Required (required)
`cloudBlockLevel`string Cloud Block Level	string	Determines how aggressive Defender for Endpoint will be in blocking and scanning suspicious files.	Default: "normal"	Range: Normal: The default blocking level (normal), Moderate: Delivers verdict only for high confidence detections (moderate), High: Aggressively blocks unknown files while optimizing for performance (greater chance of blocking non-harmful files) (high), High Plus: Aggressively blocks unknown files and applies additional protection measures (might impact client device performance) (high_plus), Zero Tolerance: Blocks all unknown programs (zero_tolerance)
`automaticSampleSubmission`boolean Enable / disable automatic sample submissions	boolean	Determines whether suspicious samples are sent to Microsoft.	Default: true	Range: —
`automaticDefinitionUpdateEnabled`boolean Automatic security intelligence updates	boolean	Determines whether security intelligence updates are installed automatically:	Default: true	Range: —
`automaticSampleSubmissionConsent`string Automatic sample submission Consent	string	Sends sample files to Microsoft to help protect device users and your organization from potential threats	Default: "safe"	Range: None (none), Safe (safe), All (all)
`userInterface`dict User interface preferences	dict	Manage the preferences for the user interface.	Default: —	Range: —
`hideStatusMenuIcon`boolean Hide status menu icon	boolean	Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not.	Default: false	Range: —
`userInitiatedFeedback`string User initiated feedback	string	Specify whether users can submit feedback to Microsoft by going to Help > Send Feedback.	Default: "enabled"	Range: Enabled (enabled), Disabled (disabled)
`consumerExperience`string Control sign-in to consumer version	string	Specify whether users can sign into the consumer version of Microsoft Defender	Default: "enabled"	Range: Enabled (enabled), Disabled (disabled)
`edr`dict EDR preferences	dict	Manage the preferences of the endpoint detection and response (EDR) component.	Default: —	Range: —
`tags`array Device tags	array	—	Default: —	Range: — – 1
dict Tag	dict	—	Default: —	Range: —
`key`string Type of tag	string	Specifies the type of tag	Default: —	Range: Group (GROUP)
`value`string Value of tag	string	Specifies the value of tag	Default: —	Range: —
`groupIds`string Group identifier	string	—	Default: —	Range: —
`tamperProtection`dict Tamper protection	dict	Tamper protection helps prevent unauthorized removal of Microsoft Defender for Endpoint.	Default: —	Range: —
`enforcementLevel`string Enforcement level	string	Specifies if tamper protection is disabled, in audit mode, or enforced	Default: "block"	Range: Disabled: Tamper protection is completely off (disabled), Audit: Tampering operations are logged, but not blocked (audit), Block: Tamper protection is on, tampering operations are blocked (block)
`exclusions`array Process exclusions	array	Defines process that can interfere with Defender without considering it tampering	Default: —	Range: —
dict Process identity	dict	—	Default: —	Range: —
`path`string Process path	string	Full and exact path to the process binary	Default: —	Range: —
`teamId`string Process's TeamIdentifier	string	Code signature TeamIdentifier	Default: —	Range: —
`signingId`string Process's Signing Identifier	string	Code signature Identifier	Default: —	Range: —
`args`array Process's arguments	array	Command line arguments	Default: —	Range: —
string Argument	string	—	Default: —	Range: —
`deviceControl`dict Device Control	dict	Device control can be used to customize the URL target for notifications raised by device control, and allow or block removable devices.	Default: —	Range: —
`navigationTarget`string Customize URL target for notifications raised by device control	string	Configure the URL that is opened when end users click the notification shown when a device control policy is enforced.	Default: —	Range: —
`removableMediaPolicy`dict Allow or block removable devices	dict	Restrict access to removable media.	Default: —	Range: —
`enforcementLevel`string Policy enforcement level	string	Set the removable media enforcement level.	Default: —	Range: Audit: A notification is displayed to the user, however the device can still be used. (audit), Block: A notification is displayed to the user, and the device cannot be used. (block)
`permission`array Default permission level	array	The default permission level for devices that do not match anything else in the policy.	Default: —	Range: —
string Permissions	string	—	Default: —	Range: None (none), Read (read), Write (write), Execute (execute)
`vendors`dict Vendors	dict	Restrict removable media by vendor.	Default: —	Range: —
`{{key}}`string Vendor ID	string	—	Default: —	Range: —
`{{value}}`dict Vendor Details	dict	—	Default: —	Range: —
`permission`array Permission level	array	—	Default: —	Range: —
string Permissions	string	—	Default: —	Range: None (none), Read (read), Write (write), Execute (execute)
`products`dict Products	dict	—	Default: —	Range: —
`{{key}}`string Product ID	string	—	Default: —	Range: —
`{{value}}`dict Product Details	dict	—	Default: —	Range: —
`permission`array Permission level	array	—	Default: —	Range: —
string Permissions	string	—	Default: —	Range: None (none), Read (read), Write (write), Execute (execute)
`serialNumbers`dict Serial Numbers	dict	—	Default: —	Range: —
`{{key}}`string Serial Number	string	—	Default: —	Range: —
`{{value}}`array Serial Number Details	array	—	Default: —	Range: —
string Permissions	string	—	Default: —	Range: None (none), Read (read), Write (write), Execute (execute)
`policy`string Device Control Policy	string	JSON string representing the device control policy	Default: —	Range: —
`features`dict Features	dict	—	Default: —	Range: —
`dataLossPrevention`string Use Data Loss Prevention	string	Whether data loss prevention enforcement is enabled on the machine.	Default: "disabled"	Range: enabled, disabled
`scheduledScan`string Scheduled Scan	string	Schedule scans with Microsoft Defender for Endpoint.	Default: "enabled"	Range: enabled, disabled
`networkProtection`dict Network protection	dict	—	Default: —	Range: —
`enforcementLevel`string Enforcement level	string	Specifies if network protection is disabled, in audit mode, or enforced	Default: "audit"	Range: disabled, audit, block
`dlp`dict Data Loss Prevention	dict	—	Default: —	Range: —
`exclusions`array Exclusions	array	—	Default: —	Range: —
dict Exclusion	dict	—	Default: —	Range: —
`signingId`string Signing ID	string	The signing id of the application to exclude from data loss prevention.	Default: —	Range: —
`flag`integer Flag	integer	Bit flags to control the type of exclusion(s) to apply. EPS=0x1, AX=0x2.	Default: —	Range: —
`features`array Features	array	—	Default: —	Range: —
dict Feature	dict	—	Default: —	Range: —
`name`string Feature Name	string	The name of a DLP feature to enable or disable.	Default: —	Range: —
`state`string State	string	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	Default: "enabled"	Range: enabled, disabled
`ring`string Release Ring	string	Limit enabling the feature to a specific deployment ring.	Default: "production"	Range: insiderFast, external, production
`scheduledScan`dict Scheduled scan configuration	dict	—	Default: —	Range: —
`checkForDefinitionsUpdate`boolean Check for definitions update	boolean	Check for definitions update before initiating a scheduled scan	Default: false	Range: —
`dailyConfiguration`dict Daily and Hourly quick scan configuration	dict	Check for definitions update before initiating a scheduled scan	Default: —	Range: —
`timeOfDay`integer Time of day	integer	Specifies the time of day, as the number of minutes after midnight, to perform a daily quick scan.	Default: 0	Range: 0 – 1440
`interval`integer Start time	integer	Specify how many hours should elapse before the next hourly quick scan. 0 indicates no hourly quick scan. 1 indicates a scan every hour. 24 indicates a scan once a day.	Default: 0	Range: 0 – 24
`ignoreExclusions`boolean Ignore exclusions	boolean	Should exclusions be ignored during a scheduled scan	Default: false	Range: —
`lowPriorityScheduledScan`boolean Low priority scheduled scan	boolean	Should scheduled scan be run with low priority. (Scan might take longer to complete).	Default: false	Range: —
`runScanWhenIdle`boolean Run scheduled scan when idle	boolean	Run scheduled scan when the device is idle. Only applicable for weekly full scans.	Default: false	Range: —
`weeklyConfiguration`dict Weekly scheduled scan configuration	dict	Should scheduled scan be run with low priority. (Scan might take longer to complete).	Default: —	Range: —
`scanType`string Scan type	string	Specifies the type of scan to perform.	Default: "quick"	Range: quick, full
`dayOfWeek`integer Day of week	integer	Specifies the day of the week to perform a weekly scan. 0 indicates never. 1-7 indicates Sunday - Saturday. 8 indicates every day.	Default: 0	Range: 0 – 8
`timeOfDay`integer Time of day	integer	Specifies the time of day, as the number of minutes after midnight, to perform a weekly scan.	Default: 0	Range: 0 – 1440
`randomizeScanStartTime`integer Randomize scheduled scan start time	integer	Randomize the start time of a daily and weekly scheduled scan to any interval from 0 to 23 hours.	Default: 0	Range: 0 – 23