Microsoft now lets organizations protect Linux workstations with Microsoft Defender for Endpoint. The company opened a public preview on October 14, 2026, and it extends the same protection Linux servers already get to the laptops and desktops that developers and engineers use every day.
This guide explains what the preview includes, which distributions it supports, what you need to run it, and the limits you should check before you roll it out.
What Microsoft Defender for Endpoint Offers on Linux Desktops
The desktop preview gives Linux workstations the full Defender for Endpoint feature set rather than a trimmed version.
Security teams get the following tools on enrolled Linux desktops:
- Next-generation antivirus for real-time malware scanning
- Endpoint detection and response (EDR) with threat analytics
- Defender Vulnerability Management, device inventory and security settings management
- Advanced hunting for custom threat queries across the fleet
- Live response for remote investigation on an affected machine
- Device isolation, which cuts a compromised workstation off the network while it stays connected to Defender
Admins manage these Linux desktops in the same Microsoft Defender portal they already use for Windows PCs and Linux servers, so the whole fleet sits in one console.
Why Linux Developer Workstations Are a Security Risk
Developer machines hold some of the most valuable access inside a company, and attackers know it.
A typical engineer’s Linux laptop connects to source code repositories, CI/CD build pipelines, cloud consoles and container registries. It often stores SSH keys, API tokens and cloud credentials too. Many companies lock down Windows endpoints and Linux servers but leave these workstations with little monitoring. Microsoft argues that one compromised developer laptop can hand an attacker a direct path into the systems that build and ship software, and the desktop preview aims to close that gap.
How Defender Detects Linux Desktops vs Servers
Microsoft does not ship a separate desktop package. The existing Linux agent now decides on its own what kind of machine it runs on.
The agent reads several signals to make that call, including:
- Operating system metadata
- Subscription and licensing details
- Cloud provider and vendor metadata
- Image SKUs and Ubuntu Pro contracts
- Virtual desktop indicators
If these signals do not give a clear answer, Defender labels the device as a server. Microsoft has not yet explained how it counts a desktop that the agent wrongly tags as a server for licensing, so admins should check inventory classifications after onboarding.
Microsoft Defender for Linux Desktop Pricing and License Requirements
Desktop coverage needs a higher license tier than Linux servers do, and this is the main cost consideration.
| Device type | Eligible licenses |
|---|---|
| Linux desktop | Microsoft Defender for Endpoint Plan 2, or Microsoft 365 E5 / E7 (which include Plan 2) |
| Linux server | Defender for Servers Plan 1 or Plan 2, Defender for Endpoint for servers, or Defender for Business servers |
Microsoft offers no free, standalone or consumer edition. If you run Linux on a personal PC with no company tenant behind it, you have nothing to install. The preview only makes sense for organizations that already pay for the Microsoft security stack.
Supported Linux Distros for Defender (Ubuntu, Debian, Fedora, RHEL)
Support follows the distribution and kernel version, not the desktop environment, so GNOME, KDE and other desktops all work.
On x64 systems, Microsoft supports:
- Ubuntu LTS 16.04 through 26.04
- Debian 9 through 13
- Fedora 33 through 44
- Red Hat Enterprise Linux 7.2 through 10.x
- SUSE Linux Enterprise Server 12 through 16
- openSUSE Leap 15.6 and 16
- Oracle Linux, Rocky Linux, AlmaLinux and CentOS
On ARM64 systems, the list is shorter and starts at Ubuntu 20.04, Debian 11 and Fedora 40.
The minimum kernel version is 3.10.0-327.
What About Linux Mint, Arch and Other Distros
Microsoft will not stop you from installing the agent on a distro built from a supported base, such as Linux Mint on top of Ubuntu. However, it treats those systems as outside its tested baseline, and its support team may ask you to reproduce a problem on a standard distribution first. Arch Linux does not appear on the supported list.
Defender for Linux System Requirements and Known Issues
The agent has light hardware needs, but a few network and software conflicts can trip up desktop users.
Minimum requirements:
- 1 CPU core
- 1 GB of RAM
- 2 GB of free disk space
systemdas the init system
Known limitations:
- Proxies: The agent does not support PAC, WPAD or authenticated proxies. If your network uses an SSL-inspecting proxy, configure it to let Defender traffic pass without inspection.
- Other security tools: Running Defender next to another product that uses
fanotify(the Linux kernel’s file-access monitoring interface) can hang the system. Switch Defender antivirus to passive mode if you must keep the other tool. - Performance: Microsoft’s own troubleshooting guidance notes that some apps can slow down under the agent. Developer workstations compile code and pull container images constantly, so plan to add scan exclusions for the busiest processes.
How to Install and Onboard Microsoft Defender on Linux Desktops
You enroll Linux desktops with the same methods you already use for Linux servers.
- Confirm your tenant has Defender for Endpoint Plan 2 or a Microsoft 365 E5 or E7 subscription.
- Check that each workstation runs a supported distro and kernel and meets the hardware requirements.
- Onboard the machine with any existing Linux deployment method, such as a package manager install, a script, or a configuration tool like Ansible or Puppet.
- Open the Microsoft Defender portal and confirm the device appears as a workstation, not a server, in device inventory.
- Add antivirus exclusions for heavy build and container processes if users report slowdowns.
Other Defender for Linux Updates in 2026
The desktop preview is part of a wider set of Linux additions Microsoft has rolled out over recent months.
Defender’s documentation listed the desktop preview in September 2026, before the official announcement. In the same month, Microsoft added a preview of memory scanning for Linux, which inspects running processes for threats that never write to disk. Antivirus and tamper protection audit modes for Linux arrived in August 2026. Microsoft has not announced a general availability date for desktop support yet.
Is Microsoft Defender on Linux Worth It? Privacy and Performance Concerns
Not every Linux user welcomes a Microsoft agent on their workstation, and two objections come up most often.
The first is telemetry. Linux users raised data collection questions when Defender for Endpoint reached Linux servers in 2020, and the same worries apply to desktops that hold personal and project files. The second is cost and lock-in. Requiring Plan 2 raises licensing spend and ties Linux endpoint protection to Microsoft’s ecosystem. For companies that already run Microsoft 365 and need antivirus on every endpoint for compliance or cyber insurance, though, adding Linux desktops to an existing console is simpler than managing a second security vendor.
Frequently Asked Questions
Is Microsoft Defender for Linux desktops free?
No. Microsoft only offers desktop coverage to organizations with Defender for Endpoint Plan 2 or a Microsoft 365 E5 or E7 subscription. There is no free or consumer version for personal Linux PCs.
Can I install Microsoft Defender on Linux Mint?
You can install it, because Microsoft does not block distros derived from a supported base like Ubuntu. Microsoft does not officially validate Linux Mint, so support may ask you to reproduce issues on stock Ubuntu.
Does Microsoft Defender work on Arch Linux?
No. Arch Linux is not on Microsoft’s supported distribution list.
Do I need a separate installer for Linux desktops?
No. Desktops use the same agent and packages as Linux servers. The agent detects whether the device is a workstation or a server on its own.
Which desktop environments does Defender support?
Defender works with any desktop environment, including GNOME and KDE, as long as the distribution, kernel and systemd requirements are met.
When will Defender for Linux desktops reach general availability?
Microsoft has not given a date. The feature remains in public preview for now.
