Defender for Endpoint options

Question

Hi guys,&nbsp;We've recently started testing out the Plan 1 license, and despite reading the (Become a Microsoft 365 Defender Ninja) article, I still have some - probably pretty amateur - questions about the whole service:- Is there no scan scheduling option on the M365 Defender admin site? The Learn article lists Powershell, WMI and Group Policy as options to schedule scans, but it seems weird not to have a dedicated page for it, so I'm hoping it's just me not looking at the right place.- Some of our would-be end users have local admin rights. Can I restrict their access to the Defender process on their machines, so they can't turn it off? 3rd party applications have their own password, but I didn't find anything like this on the M365 Defender admin site.&nbsp;Thanks in advance,Gabor

jbmartin6 · Answer

you want to enable Tamper Protection: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide#requirements-for-managing-tamper-protection-in-the-microsoft-365-defender-portal

gaborbiro · Answer

Thanks, that's a great feature, I'll ask the test user to try to modify the settings to see just how complex this setting is, but it seems pretty great.Any idea for the scheduling issue?

mohamedalishahul · Answer

schedule scan is one of Microsoft Defender Antivirus capability. it can't be control from M365 Defender portal, but it can be managed by using, PowerShell, group policy, Intune or MECM (sccm).

Note: you can initiate the AV scan from defender portal but cant schedule it.

gaborbiro · Answer

Thanks for the reassurance, we'll try the scheduling with those methods.

Forum Discussion

Defender for Endpoint options

4 Replies