Commands › Exchange Online

Get-ContentMalwareMdoAggregateReport

Exchange Online ExchangeOnlineManagement Get-*

View a summary detections by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams in Microsoft Defender for Office 365.

Quick start script

# Get-ContentMalwareMdoAggregateReport — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-ContentMalwareMdoAggregateReport | Format-List

# 3. Export for evidence / drift tracking
Get-ContentMalwareMdoAggregateReport | Export-Clixml .\ContentMalwareMdoAggregateReport-$(Get-Date -Format yyyyMMdd).xml

Syntax

Get-ContentMalwareMdoAggregateReport
 [-DetectionTechnology <MultiValuedProperty>]
 [-EndDate <System.DateTime>]
 [-Page <Int32>]
 [-PageSize <Int32>]
 [-StartDate <System.DateTime>]
 [-Workload <MultiValuedProperty>]
 [<CommonParameters>]

Parameters (6)

Parameter	Type	What it controls
-DetectionTechnology	MultiValuedProperty	The DetectionTechnology parameter filters the results by what classified the file as malware. Valid values are:
-EndDate	DateTime	The EndDate parameter specifies the end date of the date range.
-Page	Int32	The Page parameter specifies the page number of the results you want to view. Valid input for this parameter is an integer between 1 and 1000. The default value is 1.
-PageSize	Int32	The PageSize parameter specifies the maximum number of entries per page. Valid input for this parameter is an integer between 1 and 5000. The default value is 1000.
-StartDate	DateTime	The EndDate parameter specifies the start date of the date range.
-Workload	MultiValuedProperty	The Workload parameter filters the results by where the detected file is located. Valid values are:

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.