Skip to main content
Version: 2.1.1-preview

MT.1163 - Signature Update Interval should be 1-4 hours

Overview​

Checks that the signature update interval is configured between 1-4 hours in all assigned Microsoft Defender Antivirus policies.

Infrequent signature updates reduce detection of the latest threats, leaving endpoints vulnerable to newly discovered malware and exploits.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Set Signature Update Interval to 1-4 hours

Test Metadata​

FieldValue
Test IDMT.1163
SeverityHigh
SuiteM365 Advisor
CategoryDefender
PowerShell testTest-MtMdeSignatureUpdateInterval
TagsDefender, M365Advisor, MT.1163

Remediation​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Set Signature Update Interval to 1-4 hours

Source​

  • Pester test: tests/M365Advisor/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/M365Advisor/defender/Test-MtMdeSignatureUpdateInterval.ps1