Access to this page requires authorization. You can try signing in or changing directories .
Access to this page requires authorization. You can try changing directories .
This article lists the prerequisites for deploying and onboarding Defender for Endpoint on Linux servers.
If you want to run multiple security solutions side by side, see Considerations for performance, configuration, and support .
You might have already configured mutual security exclusions for devices onboarded to Microsoft Defender for Endpoint. If you still need to set mutual exclusions to avoid conflicts, see Add Microsoft Defender for Endpoint to the exclusion list for your existing solution .
To onboard servers to Defender for Endpoint, server licenses are required. You can choose from the following options:
Microsoft Defender for Servers Plan 1 or Plan 2
Microsoft Defender for Endpoint for servers
Microsoft Defender for Business servers (for small and medium-sized businesses only)
To onboard desktops to Defender for Endpoint, choose the following option:
Microsoft Defender for Endpoint P2 (Also available with Microsoft 365 E5 and Microsoft 365 E7)
For more detailed information licensing requirements for Microsoft Defender for Endpoint, see Microsoft Defender for Endpoint licensing information .
CPU : One CPU core minimum. For high-performance workloads, more cores are recommended.
Disk Space : 2 GB minimum. For high-performance workloads, more disk space might be needed.
Memory : 1 GB of RAM minimum. For high-performance workloads, more memory might be needed.
For installation at a custom path, refer to Prerequisites and system requirements for custom location installation .
Performance tuning might be needed based on workloads. For more information, see Performance tuning for Microsoft Defender for Endpoint on Linux
Software requirements
Linux server endpoints should have systemd (system manager) installed.
Linux distributions using system manager support both SystemV and Upstart. The Microsoft Defender for Endpoint on Linux agent is independent from Operation Management Suite (OMS) agent . Microsoft Defender for Endpoint relies on its own independent telemetry pipeline.
To use device isolation functionality , the following must be enabled:
iptables and ip6tables , or iptables-nft and ip6tables-nft
Linux server endpoints should be able to access the endpoints documented in:
Microsoft Defender for Endpoint streamlined connectivity URLs - commercial (commercial customers)
Microsoft Defender for Endpoint streamlined connectivity URLs - US government environments (US Government customers).
If necessary, configure static proxy discovery .
PAC, WPAD, and authenticated proxies aren't supported. Use only static or transparent proxies. SSL inspection and intercepting proxies aren't supported for security reasons. Configure an exception for SSL inspection and your proxy server to allow direct data pass-through from Defender for Endpoint on Linux to the relevant URLs without interception. Adding your interception certificate to the global store doesn't enable interception.
Verify if devices can connect to Defender for Endpoint cloud services
Prepare your environment, as described in Step 1 of the following article Configure your network environment to ensure connectivity with Defender for Endpoint service .
Prepare your environment, as described in Step 1 of the following article Configure your network environment to ensure connectivity with Defender for Endpoint service .
Connect Defender for Endpoint on Linux through a proxy server by using the following discovery methods: Transparent proxy Manual static proxy configuration
Connect Defender for Endpoint on Linux through a proxy server by using the following discovery methods:
Manual static proxy configuration
Permit anonymous traffic in the previously listed URLs, if a proxy or firewall blocks traffic.
Permit anonymous traffic in the previously listed URLs, if a proxy or firewall blocks traffic.
Configuration for transparent proxies isn't needed for Defender for Endpoint. See Manual Static Proxy Configuration.
For troubleshooting steps, see Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux .
Supported Linux distributions
Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Defender support is based on the underlying distribution and kernel version, irrespective of the desktop environment running on top of the distribution. Deployment packages, methods and security capabilities remain the same across both Linux servers and desktops.
Microsoft Defender for Endpoint determines whether a Linux device should be classified as a Server or Workstation by evaluating multiple system and environment attributes in a predefined order. These signals include operating system metadata, distribution-specific product information, subscription and licensing details, system purpose declarations, cloud and vendor metadata, image SKUs, Ubuntu Pro contracts, VMware guest properties, virtual desktop indicators, installation records, and other distribution-specific attributes.
When the available signals do not conclusively identify a device as a Workstation, Microsoft Defender for Endpoint classifies the device as a Server by default. This behaviour is by design and ensures a deterministic classification when workstation-specific indicators are not present.
When the available signals do not conclusively identify a device as a Workstation, Microsoft Defender for Endpoint classifies the device as a Server by default. This behaviour is by design and ensures a deterministic classification when workstation-specific indicators are not present.
The following Linux server distributions are supported on servers and desktops:
Support for Microsoft Defender for Endpoint on Amazon Linux 2 (AL2) running on ARM64 architecture will be deprecated on 31 October 2026 .
The last supported Defender version for AL2 (ARM64) is 101.25122.0004 (expiry 31 October 2026). After that date, official support for AL2 (ARM64) will end . Customers are advised to migrate to a supported Linux distribution before this date to ensure continued protection and support.
This change applies only to ARM64-based AL2 machines. AMD64/x86_64 architectures are not impacted .
Distributions and versions that aren't explicitly listed above are unsupported Microsoft Defender for Endpoint is kernel-version agnostic for all other supported distributions and versions. The minimal requirement for the kernel version is 3.10.0-327 or later.
Microsoft Defender for Endpoint on Linux can be installed and may function on customized operating systems that meet minimal kernel requirements and are derived from known, standard, vendor‑provided Linux distributions that Microsoft supports. Customers are free to onboard and run Defender for Endpoint on such environments; Microsoft doesn't block onboarding or execution. However, these customized environments aren't part of Microsoft's validated or maintained support baseline. As a result, they're treated as custom OS configurations from a support perspective. Customers are expected to validate Defender for Endpoint within these custom environments and, if needed, reproduce issues on a supported, standard (unmodified) Linux distribution. If an issue can't be reproduced on a supported standard base distribution, Microsoft might not be able to proceed with further investigation or remediation. For full support coverage and a predictable support experience, customers are recommended to run Defender for Endpoint on a supported, vendor-provided Linux distribution as outlined in the official prerequisites.
Running Defender for Endpoint on Linux alongside other Fanotify-based security solutions isn't supported and may lead to unpredictable behavior, including system hangs. If any applications use Fanotify in blocking mode, they'll appear in the conflicting_applications field of the mdatp health command output. You can still safely take advantage of Defender for Endpoint on Linux by setting antivirus enforcement level to passive. See Configure security settings in Microsoft Defender for Endpoint on Linux . EXCEPTION: The Linux FAPolicyD feature, which also uses Fanotify in blocking mode, is supported with Defender for Endpoint in active mode on RHEL and Fedora platforms, provided that mdatp health reports a healthy status. This exception is based on validated compatibility specific to these distributions.
To scan NFS v3 mount points, make sure to set the no_root_squash export option. Without this option, scanning NFS v3 can potentially fail due to lack of permissions.
Roles and permissions
Administrative privileges on the Linux endpoint are required for installation.
Administrative privileges on the Linux endpoint are required for installation.
An appropriate role assigned in Defender for Endpoint. See Role-based access control .
An appropriate role assigned in Defender for Endpoint. See Role-based access control .
Installation methods and tools
There are several methods and tools that you can use to deploy Microsoft Defender for Endpoint on supported Linux distributions .
It's recommended to use Deployment Tool based deployment, as it simplifies the onboarding process, reduces manual tasks, and supports a wide range of deployment scenarios, including custom installation paths, upgrades, and local repository. All deployment methods apply to servers as well as desktops. For more information, see
Deployment tool based deployment (Recommended)
Deployment tool based deployment (Recommended)
Installer script based deployment
Installer script based deployment
Ansible based deployment
Ansible based deployment
Chef based deployment
Chef based deployment
Puppet based deployment
Puppet based deployment
SaltStack based deployment
SaltStack based deployment
Golden Image based deployment
Golden Image based deployment
Deployment to a custom location
Deployment to a custom location
Direct onboarding with Defender for Cloud
Direct onboarding with Defender for Cloud
Guidance for Defender for Endpoint on Linux endpoints with SAP
Guidance for Defender for Endpoint on Linux endpoints with SAP
On Linux, Microsoft Defender for Endpoint creates a mdatp user with random UID and GID values. If you want to control these values, create a mdatp user before installation using the /usr/sbin/nologin shell option. Here's an example: mdatp:x:UID:GID::/ /mdatp:/usr/sbin/nologin .
If you experience any installation issues, self-troubleshooting resources are available. See the links in the Related content section .
Deploy Defender for Endpoint on Linux
Configure Defender for Endpoint on Linux
Deploy updates for Defender for Endpoint on Linux
Use Microsoft Defender for Endpoint Security Settings Management to manage Microsoft Defender Antivirus
Troubleshoot cloud connectivity issues for Microsoft Defender for Endpoint on Linux
Investigate agent health issues
Troubleshoot missing events or alerts issues for Microsoft Defender for Endpoint on Linux
Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux
Install Defender for Endpoint on Linux to a custom path
Was this page helpful?
Need help with this topic?
Want to try using Ask Learn to clarify or guide you through this topic?
Last updated on 2026-09-22
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
