Introduction
Run a Windows Defender scan on managed devices from an automation. Pair it with a Defender definition update action to ensure scans run against current signatures, or trigger scans on a schedule or in response to specific events like new device enrollment.
Windows Defender Scan
From the automation pipeline in edit mode, click + Add action and select Windows Defender scan from the Security category. The action panel opens with two sections: Action type (pre-set to Windows Defender scan) and Step configuration.
Add Level to Windows Defender as an Exclusion
The Add Level to Windows Defender as an exclusion checkbox is enabled by default. When checked, Level adds itself to Windows Defender's exclusion list before initiating the scan.
Without the exclusion, Windows Defender may flag Level's agent processes during the scan, which can interrupt the operation or produce false positives.
💡 TIP: Run a Windows Defender Update action before this one to ensure the scan uses the latest definitions. Add both actions to the same automation in sequence.
Conditions
The Conditions section lets you restrict when this action runs based on device attributes or the outcome of a previous action. Expand the section to add conditions.
See Action Conditions for the full reference on condition types, operators, and values.
Additional Options
Expand Additional options for execution settings including action name, failure behavior, output variables, and retries.
See Actions Overview for the full reference on additional options available on every action.
FAQ
Does this action work on macOS or Linux? No. Windows Defender is Windows-only. This action is silently ignored on macOS and Linux devices. If your automation targets a mixed-OS group, only Windows devices will execute this step.
What type of scan does this run? A full scan. Level runs a complete scan of all files and directories on the device, not a quick scan.
What happens if the device is offline when the action runs? The action queues and resumes once the device comes back online.
Why would I leave the exclusion checkbox enabled? It prevents Defender from flagging Level's processes during the scan, which can cause interruptions or false positives. Leave it on unless your organization has a policy against automated exclusions.
Who can add or modify this action in an automation? Technicians with permission to edit automations in the relevant group. See Workspace → Permissions for access control configuration.