Microsoft Defender for Endpoint

com.microsoft.wdav

Microsoft Defender for Endpoint settings

macOS

Configuration Keys (10)

Key	Type	Title	Description	Default	Range
`antivirusEngine`	dict	Antivirus engine	Manages the preferences of the antivirus component of Microsoft Defender for Endpoint.	—	—
`behaviorMonitoring`	string	Behavior Monitoring	Determines whether behavior monitoring and blocking capability is enabled on the device or not.	"enabled"
`enforcementLevel`	string	Enforcement level for antivirus engine	Enforcement level of antivirus engine. On-demand: Files are scanned only on demand; Passive: Same as on-demand, but also security intelligence updates are enabled, and the status menu icon is hidden; Real-time: Scan files as they are accessed. Depends on: antivirusEngine.behaviorMonitoring ∈ [enabled]	"real_time"
`enableFileHashComputation`	boolean	Enable file hash computation	When this feature is enabled, Defender for Endpoint will compute hashes for files it scans.	false	—
`scanAfterDefinitionUpdate`	boolean	Run a scan after definitions are updated	Specifies whether to start a process scan after new security intelligence updates are downloaded on the device. Enabling this setting will trigger an antivirus scan on the running processes of the device.	true	—
`scanArchives`	boolean	Scanning inside archive files	If true, Defender will unpack archives and scan files inside them. Otherwise archive content will be skipped, that will improve scanning performance.	true	—
`maximumOnDemandScanThreads`	integer	Degree of parallelism for on-demand scans	The number of threads used to perform the scan.	2
`exclusionsMergePolicy`	string	Exclusions merge	Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (merge) or only administrator-defined exclusions (admin_only). This setting can be used to restrict local users from defining their own exclusions.	"merge"
`exclusions`	array	Scan exclusions	Entities that have been excluded from the scan. Exclusions can be specified by full paths, extensions, or file names.	—	—
	dict	Exclusions	—	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
`allowedThreats`	array	Allowed threats	List of threats (identified by their name) that are not blocked by the product and are instead allowed to run.	—	—
	string	Threat	—	—	—
`disallowedThreatActions`	array	Disallowed threat actions	Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list are not displayed in the user interface. Use unique values.	—	—
	string	Action	—	—
`threatTypeSettings`	array	Threat type settings	The threatTypeSettings preference in the antivirus engine is used to control how certain threat types are handled by the product.	—	—
	dict	Setting	—	—	—
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`threatTypeSettingsMergePolicy`	string	Threat type settings merge	Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (merge) or only administrator-defined settings (admin_only). This setting can be used to restrict local users from defining their own settings for different threat types.	"merge"
`scanResultsRetentionDays`	string	Antivirus scan history retention	The number of days (1-180) that results are retained in the scan history on the device.	"90"
`scanHistoryMaximumItems`	string	Maximum number of items in the antivirus scan history	The maximum number of entries to keep in the scan history.	"10000"
`enableRealTimeProtection`	boolean	Real-time protection	Locates and stops malware from installing or running on your device. You can turn off this setting for a short time before it turns back on automatically.	true	—
`passiveMode`	boolean	Passive mode	Whether the antivirus engine runs in passive mode or not.	false	—
	dict	Exclusions	—	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
	string	Threat	—	—	—
	string	Action	—	—
	dict	Setting	—	—	—
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`cloudService`	dict	Cloud delivered protection preferences	Configure the cloud-driven protection features of Microsoft Defender for Endpoint.	—	—
`enabled`	boolean	Cloud delivered protection	Provides increased, faster protection with access to the latest protection data in the cloud. Works best with automatic sample submission turned on	true	—
`diagnosticLevel`	string	Diagnostic data collection	We encourage you to share your diagnostic and usage data with us to help improve Microsoft products and services.	"optional"
`cloudBlockLevel`	string	Cloud Block Level	Determines how aggressive Defender for Endpoint will be in blocking and scanning suspicious files.	"normal"
`automaticSampleSubmission`	boolean	Enable / disable automatic sample submissions	Determines whether suspicious samples are sent to Microsoft.	true	—
`automaticDefinitionUpdateEnabled`	boolean	Automatic security intelligence updates	Determines whether security intelligence updates are installed automatically:	true	—
`automaticSampleSubmissionConsent`	string	Automatic sample submission Consent	Sends sample files to Microsoft to help protect device users and your organization from potential threats	"safe"
`userInterface`	dict	User interface preferences	Manage the preferences for the user interface.	—	—
`hideStatusMenuIcon`	boolean	Hide status menu icon	Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not.	false	—
`userInitiatedFeedback`	string	User initiated feedback	Specify whether users can submit feedback to Microsoft by going to Help > Send Feedback.	"enabled"
`consumerExperience`	string	Control sign-in to consumer version	Specify whether users can sign into the consumer version of Microsoft Defender	"enabled"
`edr`	dict	EDR preferences	Manage the preferences of the endpoint detection and response (EDR) component.	—	—
`tags`	array	Device tags	—	—	—
	dict	Tag	—	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`groupIds`	string	Group identifier	—	—	—
	dict	Tag	—	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`tamperProtection`	dict	Tamper protection	Tamper protection helps prevent unauthorized removal of Microsoft Defender for Endpoint.	—	—
`enforcementLevel`	string	Enforcement level	Specifies if tamper protection is disabled, in audit mode, or enforced	"block"
`exclusions`	array	Process exclusions	Defines process that can interfere with Defender without considering it tampering	—	—
	dict	Process identity	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
	dict	Process identity	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
`deviceControl`	dict	Device Control	Device control can be used to customize the URL target for notifications raised by device control, and allow or block removable devices.	—	—
`navigationTarget`	string	Customize URL target for notifications raised by device control	Configure the URL that is opened when end users click the notification shown when a device control policy is enforced.	—	—
`removableMediaPolicy`	dict	Allow or block removable devices	Restrict access to removable media.	—	—
`enforcementLevel`	string	Policy enforcement level	Set the removable media enforcement level.	—
`permission`	array	Default permission level	The default permission level for devices that do not match anything else in the policy.	—	—
	string	Permissions	—	—
`vendors`	dict	Vendors	Restrict removable media by vendor.	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`policy`	string	Device Control Policy	JSON string representing the device control policy	—	—
`enforcementLevel`	string	Policy enforcement level	Set the removable media enforcement level.	—
`permission`	array	Default permission level	The default permission level for devices that do not match anything else in the policy.	—	—
	string	Permissions	—	—
`vendors`	dict	Vendors	Restrict removable media by vendor.	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`features`	dict	Features	—	—	—
`dataLossPrevention`	string	Use Data Loss Prevention	Whether data loss prevention enforcement is enabled on the machine.	"disabled"
`scheduledScan`	string	Scheduled Scan	Schedule scans with Microsoft Defender for Endpoint.	"enabled"
`networkProtection`	dict	Network protection	—	—	—
`enforcementLevel`	string	Enforcement level	Specifies if network protection is disabled, in audit mode, or enforced	"audit"
`dlp`	dict	Data Loss Prevention	—	—	—
`exclusions`	array	Exclusions	—	—	—
	dict	Exclusion	—	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
`features`	array	Features	—	—	—
	dict	Feature	—	—	—
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
	dict	Exclusion	—	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
	dict	Feature	—	—	—
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
`scheduledScan`	dict	Scheduled scan configuration	—	—	—
`checkForDefinitionsUpdate`	boolean	Check for definitions update	Check for definitions update before initiating a scheduled scan	false	—
`dailyConfiguration`	dict	Daily and Hourly quick scan configuration	Check for definitions update before initiating a scheduled scan	—	—
`ignoreExclusions`	boolean	Ignore exclusions	Should exclusions be ignored during a scheduled scan	false	—
`lowPriorityScheduledScan`	boolean	Low priority scheduled scan	Should scheduled scan be run with low priority. (Scan might take longer to complete).	false	—
`runScanWhenIdle`	boolean	Run scheduled scan when idle	Run scheduled scan when the device is idle. Only applicable for weekly full scans.	false	—
`weeklyConfiguration`	dict	Weekly scheduled scan configuration	Should scheduled scan be run with low priority. (Scan might take longer to complete).	—	—
`scanType`	string	Scan type	Specifies the type of scan to perform.	"quick"
`scanType`	string	Scan type	Specifies the type of scan to perform.	"quick"
`behaviorMonitoring`	string	Behavior Monitoring	Determines whether behavior monitoring and blocking capability is enabled on the device or not.	"enabled"
`enforcementLevel`	string	Enforcement level for antivirus engine	Enforcement level of antivirus engine. On-demand: Files are scanned only on demand; Passive: Same as on-demand, but also security intelligence updates are enabled, and the status menu icon is hidden; Real-time: Scan files as they are accessed. Depends on: antivirusEngine.behaviorMonitoring ∈ [enabled]	"real_time"
`enableFileHashComputation`	boolean	Enable file hash computation	When this feature is enabled, Defender for Endpoint will compute hashes for files it scans.	false	—
`scanAfterDefinitionUpdate`	boolean	Run a scan after definitions are updated	Specifies whether to start a process scan after new security intelligence updates are downloaded on the device. Enabling this setting will trigger an antivirus scan on the running processes of the device.	true	—
`scanArchives`	boolean	Scanning inside archive files	If true, Defender will unpack archives and scan files inside them. Otherwise archive content will be skipped, that will improve scanning performance.	true	—
`maximumOnDemandScanThreads`	integer	Degree of parallelism for on-demand scans	The number of threads used to perform the scan.	2
`exclusionsMergePolicy`	string	Exclusions merge	Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (merge) or only administrator-defined exclusions (admin_only). This setting can be used to restrict local users from defining their own exclusions.	"merge"
`exclusions`	array	Scan exclusions	Entities that have been excluded from the scan. Exclusions can be specified by full paths, extensions, or file names.	—	—
	dict	Exclusions	—	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
`allowedThreats`	array	Allowed threats	List of threats (identified by their name) that are not blocked by the product and are instead allowed to run.	—	—
	string	Threat	—	—	—
`disallowedThreatActions`	array	Disallowed threat actions	Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list are not displayed in the user interface. Use unique values.	—	—
	string	Action	—	—
`threatTypeSettings`	array	Threat type settings	The threatTypeSettings preference in the antivirus engine is used to control how certain threat types are handled by the product.	—	—
	dict	Setting	—	—	—
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`threatTypeSettingsMergePolicy`	string	Threat type settings merge	Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (merge) or only administrator-defined settings (admin_only). This setting can be used to restrict local users from defining their own settings for different threat types.	"merge"
`scanResultsRetentionDays`	string	Antivirus scan history retention	The number of days (1-180) that results are retained in the scan history on the device.	"90"
`scanHistoryMaximumItems`	string	Maximum number of items in the antivirus scan history	The maximum number of entries to keep in the scan history.	"10000"
`enableRealTimeProtection`	boolean	Real-time protection	Locates and stops malware from installing or running on your device. You can turn off this setting for a short time before it turns back on automatically.	true	—
`passiveMode`	boolean	Passive mode	Whether the antivirus engine runs in passive mode or not.	false	—
	dict	Exclusions	—	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
`$type`	string	Type	Specify content excluded from being scanned by type.	"excludedPath"
`path`	string	Path	Path to exclude, wildcards are supported	—	—
`isDirectory`	boolean	Is directory	Directory if selected, or file if not selected	false	—
`extension`	string	File extension	Specify content excluded from being scanned by file extension.	—	—
`name`	string	Process name	Process name, either or full path or file name, wildcards supported	—	—
	string	Threat	—	—	—
	string	Action	—	—
	dict	Setting	—	—	—
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`key`	string	Threat type	Type of the threat for which the behavior is configured.	—
`value`	string	Action to take	Action to take when coming across a threat of the type specified in the preceding section.	"audit"
`enabled`	boolean	Cloud delivered protection	Provides increased, faster protection with access to the latest protection data in the cloud. Works best with automatic sample submission turned on	true	—
`diagnosticLevel`	string	Diagnostic data collection	We encourage you to share your diagnostic and usage data with us to help improve Microsoft products and services.	"optional"
`cloudBlockLevel`	string	Cloud Block Level	Determines how aggressive Defender for Endpoint will be in blocking and scanning suspicious files.	"normal"
`automaticSampleSubmission`	boolean	Enable / disable automatic sample submissions	Determines whether suspicious samples are sent to Microsoft.	true	—
`automaticDefinitionUpdateEnabled`	boolean	Automatic security intelligence updates	Determines whether security intelligence updates are installed automatically:	true	—
`automaticSampleSubmissionConsent`	string	Automatic sample submission Consent	Sends sample files to Microsoft to help protect device users and your organization from potential threats	"safe"
`hideStatusMenuIcon`	boolean	Hide status menu icon	Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not.	false	—
`userInitiatedFeedback`	string	User initiated feedback	Specify whether users can submit feedback to Microsoft by going to Help > Send Feedback.	"enabled"
`consumerExperience`	string	Control sign-in to consumer version	Specify whether users can sign into the consumer version of Microsoft Defender	"enabled"
`tags`	array	Device tags	—	—	—
	dict	Tag	—	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`groupIds`	string	Group identifier	—	—	—
	dict	Tag	—	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`key`	string	Type of tag	Specifies the type of tag	—
`value`	string	Value of tag	Specifies the value of tag	—	—
`enforcementLevel`	string	Enforcement level	Specifies if tamper protection is disabled, in audit mode, or enforced	"block"
`exclusions`	array	Process exclusions	Defines process that can interfere with Defender without considering it tampering	—	—
	dict	Process identity	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
	dict	Process identity	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
`path`	string	Process path	Full and exact path to the process binary	—	—
`teamId`	string	Process's TeamIdentifier	Code signature TeamIdentifier	—	—
`signingId`	string	Process's Signing Identifier	Code signature Identifier	—	—
`args`	array	Process's arguments	Command line arguments	—	—
	string	Argument	—	—	—
	string	Argument	—	—	—
`navigationTarget`	string	Customize URL target for notifications raised by device control	Configure the URL that is opened when end users click the notification shown when a device control policy is enforced.	—	—
`removableMediaPolicy`	dict	Allow or block removable devices	Restrict access to removable media.	—	—
`enforcementLevel`	string	Policy enforcement level	Set the removable media enforcement level.	—
`permission`	array	Default permission level	The default permission level for devices that do not match anything else in the policy.	—	—
	string	Permissions	—	—
`vendors`	dict	Vendors	Restrict removable media by vendor.	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`policy`	string	Device Control Policy	JSON string representing the device control policy	—	—
`enforcementLevel`	string	Policy enforcement level	Set the removable media enforcement level.	—
`permission`	array	Default permission level	The default permission level for devices that do not match anything else in the policy.	—	—
	string	Permissions	—	—
`vendors`	dict	Vendors	Restrict removable media by vendor.	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Vendor ID	—	—	—
`{{value}}`	dict	Vendor Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`products`	dict	Products	—	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Product ID	—	—	—
`{{value}}`	dict	Product Details	—	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`permission`	array	Permission level	—	—	—
	string	Permissions	—	—
`serialNumbers`	dict	Serial Numbers	—	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`{{key}}`	string	Serial Number	—	—	—
`{{value}}`	array	Serial Number Details	—	—	—
	string	Permissions	—	—
	string	Permissions	—	—
`dataLossPrevention`	string	Use Data Loss Prevention	Whether data loss prevention enforcement is enabled on the machine.	"disabled"
`scheduledScan`	string	Scheduled Scan	Schedule scans with Microsoft Defender for Endpoint.	"enabled"
`enforcementLevel`	string	Enforcement level	Specifies if network protection is disabled, in audit mode, or enforced	"audit"
`exclusions`	array	Exclusions	—	—	—
	dict	Exclusion	—	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
`features`	array	Features	—	—	—
	dict	Feature	—	—	—
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
	dict	Exclusion	—	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
`signingId`	string	Signing ID	The signing id of the application to exclude from data loss prevention.	—	—
	dict	Feature	—	—	—
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
`name`	string	Feature Name	The name of a DLP feature to enable or disable.	—	—
`state`	string	State	Enable a feature up to a deployment ring (default production), or force disable a feature for all rings.	"enabled"
`ring`	string	Release Ring	Limit enabling the feature to a specific deployment ring.	"production"
`checkForDefinitionsUpdate`	boolean	Check for definitions update	Check for definitions update before initiating a scheduled scan	false	—
`dailyConfiguration`	dict	Daily and Hourly quick scan configuration	Check for definitions update before initiating a scheduled scan	—	—
`ignoreExclusions`	boolean	Ignore exclusions	Should exclusions be ignored during a scheduled scan	false	—
`lowPriorityScheduledScan`	boolean	Low priority scheduled scan	Should scheduled scan be run with low priority. (Scan might take longer to complete).	false	—
`runScanWhenIdle`	boolean	Run scheduled scan when idle	Run scheduled scan when the device is idle. Only applicable for weekly full scans.	false	—
`weeklyConfiguration`	dict	Weekly scheduled scan configuration	Should scheduled scan be run with low priority. (Scan might take longer to complete).	—	—
`scanType`	string	Scan type	Specifies the type of scan to perform.	"quick"
`scanType`	string	Scan type	Specifies the type of scan to perform.	"quick"