How to use Microsoft Defender api '/api/files/{id}' to detect malicious file

Gandbhir, Aseema 0

If i have a file and i convert it into hash can Microsoft defender api '/api/files/{id}' inform me if the file is malicious ?

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2025-11-18T20:50:53.25+00:00

Hello @Gandbhir, Aseema,
Thank you for reaching out.
The Microsoft Defender for Endpoint API endpoint GET /api/files/{id} can help you determine if a file is considered malicious based on its hash by looking at the Determination Type Value in the Response https://learn.microsoft.com/en-us/defender-endpoint/api/get-file-information. Check to see if it is Malware or Pua – Potentially Unwanted Application (PUA) and act accordingly.

Your answer