DefenderDeviceAuthenticatedScanDefinition

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Name	Key	String	Name of the scan definition.
Id	Write	String	Unique identified for the scan definition.
IntervalInHours	Write	UInt32	Interval in hours to run the scan.
Target	Write	String	Target of the scan definition.
IsActive	Write	Boolean	Determines if the scan definition is active or not.
ScanType	Write	String	Type of scan.
ScannerAgent	Write	MSFT_DefenderDeviceAuthenticatedScanDefinitionScanAgent	Information about the associated scan agent.
ScanAuthenticationParams	Write	MSFT_DefenderDeviceAuthenticatedScanDefinitionAuthenticationParams	Authentication parameters.
Ensure	Write	String	Present ensures the instance exists, absent ensures it is removed.	Absent, Present
Credential	Write	PSCredential	Credentials of the workload's Admin
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Id of the Azure Active Directory tenant used for authentication.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
CertificatePassword	Write	PSCredential	Username can be made up to anything but password will be used for CertificatePassword
CertificatePath	Write	String	Path to certificate used in service principal usually a PFX file.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	String[]	Access token used for authentication.

Embedded Instances

MSFT_DefenderDeviceAuthenticatedScanDefinitionScanAgent

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
id	Write	String	Unique identified for the scan agent.
machineId	Write	String	Id of the machine associated with the agent.
machineName	Write	String	Name of the machine associated with the agent.

MSFT_DefenderDeviceAuthenticatedScanDefinitionAuthenticationParams

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
DataType	Write	String	Odata type associated with the request.
Type	Write	String	Type of scan.
KeyVaultUrl	Write	String	An optional property that specifies from which KeyVault the scanner should retrieve credentials. If KeyVault is specified there's no need to specify username, password.
KeyVaultSecretName	Write	String	An optional property that specifies KeyVault secret name from which the scanner should retrieve credentials. If KeyVault is specified there's no need to specify username, password.
Domain	Write	String	Domain name when using WindowsAuthParams.
Username	Write	String	Username when using WindowsAuthParams or the username when choosing SnmpAuthParams with any type other than CommunityString.
IsGMSAUser	Write	Boolean	Must be set to true when choosing WindowsAuthParams.
CommunityString	Write	String	Community string to use when choosing SnmpAuthParams with CommunityString.
AuthProtocol	Write	String	Auth protocol to use with SnmpAuthParams and AuthNoPriv or AuthPriv. Possible values are MD5, SHA1.
AuthPassword	Write	String	Auth password to use with SnmpAuthParams and AuthNoPriv or AuthPriv.
PrivProtocol	Write	String	Priv protocol to use with SnmpAuthParams and AuthPriv. Possible values are DES, 3DES, AES.
PrivPassword	Write	String	Priv password to use with SnmpAuthParams and AuthPriv.

Description

Configures device authenticated scan definitions in Defender.

Permissions

WindowsDefenderATP

To authenticate with the WindowsDefenderATP API, this resource requires the following permissions:

Delegated permissions

• Read

• Machine.Read.All

• Update

• Machine.ReadWrite.All

Application permissions

• Read

• Machine.Read.All

• Update

• Machine.ReadWrite.All

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        DefenderDeviceAuthenticatedScanDefinition "DefenderDeviceAuthenticatedScanDefinition-Example"
        {
            Ensure                   = "Present";
            IntervalInHours          = 1;
            IsActive                 = $True;
            Name                     = "Datacentre Network Scan";
            ScanAuthenticationParams = MSFT_DefenderDeviceAuthenticatedScanDefinitionAuthenticationParams{
                Type         = "AuthPriv"
                DataType     = "#microsoft.windowsDefenderATP.api.SnmpAuthParams"
                Username     = "svc-network-scanner"
                AuthProtocol = "SHA1"
                AuthPassword = "<snmp-auth-password>"
                PrivProtocol = "AES"
                PrivPassword = "<snmp-priv-password>"
            };
            ScannerAgent             = MSFT_DefenderDeviceAuthenticatedScanDefinitionScanAgent{
                machineId   = "<defender-machine-id>"
                machineName = "CONTOSO-SCAN01"
                id          = "<defender-scan-agent-id>"
            };
            ScanType                 = "Network";
            Target                   = "10.20.30.0/24";
            ApplicationId            = $ApplicationId;
            TenantId                 = $TenantId;
            CertificateThumbprint    = $CertificateThumbprint;
        }
    }
}

Example 2

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        DefenderDeviceAuthenticatedScanDefinition "DefenderDeviceAuthenticatedScanDefinition-Example"
        {
            Ensure                   = "Present";
            IntervalInHours          = 24; # Updated Property
            IsActive                 = $True;
            Name                     = "Datacentre Network Scan";
            ScanAuthenticationParams = MSFT_DefenderDeviceAuthenticatedScanDefinitionAuthenticationParams{
                Type         = "AuthPriv"
                DataType     = "#microsoft.windowsDefenderATP.api.SnmpAuthParams"
                Username     = "svc-network-scanner"
                AuthProtocol = "SHA1"
                AuthPassword = "<snmp-auth-password>"
                PrivProtocol = "AES"
                PrivPassword = "<snmp-priv-password>"
            };
            ScannerAgent             = MSFT_DefenderDeviceAuthenticatedScanDefinitionScanAgent{
                machineId   = "<defender-machine-id>"
                machineName = "CONTOSO-SCAN01"
                id          = "<defender-scan-agent-id>"
            };
            ScanType                 = "Network";
            Target                   = "10.20.30.0/24";
            ApplicationId            = $ApplicationId;
            TenantId                 = $TenantId;
            CertificateThumbprint    = $CertificateThumbprint;
        }
    }
}

Example 3

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        DefenderDeviceAuthenticatedScanDefinition "DefenderDeviceAuthenticatedScanDefinition-Example"
        {
            Ensure                = "Absent";
            Name                  = "Datacentre Network Scan";
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}