Skip to main content
Version: 2.1.1-preview

MT.1158 - Scan should be scheduled

Overview​

Checks that a scheduled scan day is configured in all assigned Microsoft Defender Antivirus policies.

An irregular scan schedule may miss persistent threats on managed devices, allowing malware to remain undetected for extended periods.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Configure Schedule Scan Day to a specific day.

Test Metadata​

FieldValue
Test IDMT.1158
SeverityHigh
SuiteM365 Advisor
CategoryDefender
PowerShell testTest-MtMdeScheduleScanDay
TagsDefender, M365Advisor, MT.1158

Remediation​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Configure Schedule Scan Day to a specific day.

Source​

  • Pester test: tests/M365Advisor/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/M365Advisor/defender/Test-MtMdeScheduleScanDay.ps1