Get Windows Defender policy payload details
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}
MDMDeviceMgmt.READCopied!
Authorization: d92d4xxxxxxxxxxxxx15f52
Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response
Unique identifier of the payload item. Obtain from the Get Payload Item IDs response
curl --request GET \
--url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id} \
--header 'Accept: application/json' \
--header 'Authorization: d92d4xxxxxxxxxxxxx15f52'Unique identifier of the payload item
Allow Archive Scanning. Default: true
Allow Behavior Monitoring. Default: true
Allow Cloud Protection. Default: true
Allow Email Scanning. Default: false
Allow Full Scan On Mapped Networkdrives. Default: false
Allow Full Scan Removable Drive Scanning. Default: true
Allow Intrusion Prevention System. Default: true
Allow Ioav Protection. Default: true
Cloud Block Level. Default: 0
Allow Onaccess Protection. Default: true
Allow Realtime Monitoring. Default: true
Allow Scanning Network Files. Default: false
Allow Script Scanning. Default: true
Allow User Ui Access. Default: true
Check For Signatures Before Runningscan. Default: false
Pua Protection. Default: 0
Realtime Scan Direction. Default: 0
Scan Parameter. Default: 1
Allow Switch To Async Inspection. Default: false
Disable Cpu Throttle On Idle Scans. Default: true
Disable Network Protection Perf Telemetry. Default: false
Enable Filehash Computation. Default: false
Hide Exclusions From Local Admins. Default: false
Hide Exclusions From Local Users. Default: false
Full configuration details of Defender payload item
{
"allow_behavior_monitoring": true,
"disable_cpu_throttle_on_idle_scans": true,
"allow_switch_to_async_inspection": false,
"hide_exclusions_from_local_admins": false,
"allow_scanning_network_files": false,
"scan_parameter": "2",
"allow_realtime_monitoring": true,
"disable_network_protection_perf_telemetry": false,
"allow_email_scanning": false,
"hide_exclusions_from_local_users": false,
"allow_onaccess_protection": true,
"allow_archive_scanning": true,
"allow_ioav_protection": true,
"allow_full_scan_on_mapped_networkdrives": false,
"allow_cloud_protection": true,
"pua_protection": "1",
"allow_script_scanning": true,
"cloud_block_level": "2",
"check_for_signatures_before_runningscan": false,
"payload_id": "9007199254741295",
"allow_full_scan_removable_drive_scanning": true,
"allow_user_ui_access": true,
"enable_filehash_computation": false,
"allow_intrusion_prevention_system": true,
"realtime_scan_direction": "1"
}
![]()
Duration: 1 minute | Threshold: 120 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.