Your Linux Dev Laptop Can Now Report to Defender: What the Preview Actually Needs

If your company protects Windows PCs with Microsoft Defender for Endpoint, your Ubuntu or Fedora laptop may soon get the same agent. Microsoft added Linux desktop support in public preview in September 2026, and it uses the same mdatp agent that already runs on Linux servers.

We went through the Microsoft Learn pages and the Microsoft Security announcement to see what that means for developers and the admins who manage their machines. Everything below comes from those sources, and where something is still preview, we say so.

TL;DR

• It is a public preview, not general availability.
• There is no separate desktop agent. Same packages, same deployment methods, same features as on Linux servers.
• Desktops need Defender for Endpoint Plan 2, or Microsoft 365 E5 or E7.
• Support depends on the distro and kernel, not on the desktop environment. GNOME, KDE and others are all fine.
• Onboarding is one script. Verifying it takes two mdatp commands.

Why developers should care

A developer laptop holds source code, cloud credentials, SSH keys and access to CI/CD. Microsoft's own announcement makes the same point: a compromised workstation is a foothold in the pipelines that build and ship your software. Until now, many security teams could see the Linux servers but not the Linux laptops.

If you are the person who runs Linux at work, this is the change that may land on your machine next. If you are the person who manages those machines, it removes a blind spot.

What you need before you start

Microsoft's prerequisites page lists these requirements:

• License: Defender for Endpoint Plan 2, Microsoft 365 E5 or Microsoft 365 E7 for desktops. Servers use a different set of licenses, such as Defender for Servers.
• Distro: one on the supported list. Ubuntu LTS 16.04 to 26.04 and Fedora 33 to 44 are listed for x64. RHEL, Debian, SUSE, Oracle Linux, Rocky, AlmaLinux and others are listed too. Anything not listed is unsupported.
• Kernel: 3.10.0-327 or later.
• Hardware: at least 1 CPU core, 1 GB of RAM and 2 GB of free disk space.
• systemd must be your init system.
• Network: outbound HTTPS to the Defender endpoints. PAC, WPAD and authenticated proxies are not supported, and neither is SSL inspection.

Defender decides whether a device is a server or a workstation from signals such as OS metadata, licensing details and virtual desktop indicators. If the signals are unclear, the device is classified as a server. After onboarding, check the device inventory to confirm your laptop shows up as a workstation.

Onboarding with the Defender deployment tool

Microsoft recommends the Defender deployment tool for new installs. It installs the agent and onboards the device in one step. Note that the page for this tool is itself labeled preview.

1. In the Microsoft Defender portal, go to Settings > Endpoints > Device management > Onboarding.
2. Pick Linux as the operating system.
3. Under Defender deployment tool, select Download package.

The package is specific to your tenant, so do not reuse it across tenants. Then on the machine:

unzip GatewayLinuxDefenderDeploymentTool.zip
chmod +x defender_deployment_tool.sh
sudo bash defender_deployment_tool.sh

This installs the latest agent from the production channel and onboards the device. Microsoft says it can take 5 to 20 minutes before the device appears in the inventory.

The tool also has a few flags that are worth knowing. All of these are from Microsoft's documentation:

# Check prerequisites without installing
sudo ./defender_deployment_tool.sh --pre-req

# Check that the required URLs are reachable
sudo ./defender_deployment_tool.sh --connectivity-test

# Remove Defender
sudo ./defender_deployment_tool.sh --remove

It also needs outbound access to msdefender.download.prss.microsoft.com on port 443, and either wget or curl installed. Its built-in checks stop the install if memory is under 1 GB, free disk is under 2 GB or glibc is older than 2.17.

Verify it worked

mdatp health --field org_id
mdatp health --field healthy

The first should return your organization ID. The second should return true. Right after the first start, healthy can be false while the agent downloads its first antimalware definitions. That can take a few minutes.

Other deployment routes

If you manage many machines, Microsoft says all existing methods work for desktops. That includes the installer script (mde_installer.sh from Microsoft's public GitHub repo), manual package install with dnf install mdatp on RHEL-family distros, and configuration management tools such as Ansible, Chef, Puppet and SaltStack.

What the agent does

Because it is the same agent, you get the Linux feature set:

• Antivirus with real-time and on-demand scans, plus passive mode for running next to another antivirus product.
• Endpoint detection and response, with the device timeline and advanced hunting.
• Response actions such as live response and device isolation.
• Vulnerability management and security settings management.

Antivirus exclusions and settings can be managed centrally from the Defender or Intune portal.

Gotchas worth knowing

• Other fanotify-based security tools. Running Defender next to another one is not supported and can cause system hangs. Use passive mode if you must. fapolicyd on RHEL and Fedora is the documented exception.
• Device isolation needs iptables and ip6tables, or the nft versions.
• Fedora 45 is not on the list yet. The documented range stops at Fedora 44.
• Amazon Linux 2 on ARM64 is marked as retiring on 31 October 2026.
• It is preview. Microsoft can change it before general availability, so start with a pilot group instead of the whole fleet.

One more thing for WSL users

Microsoft's what's new page also lists a Defender plug-in for WSL containers (WSLc) as generally available. It brings WSL container activity into device inventory, alerts, incidents, the device timeline and advanced hunting. That is a separate feature from Linux desktop support, but it is relevant if you do most of your Linux work inside Windows.

Your turn

If your employer runs Defender on your Linux machine, do you want to know it is there, and what would you want admins to tell developers before it is rolled out? And if you have tried the preview, what broke first?

Originally published on WindowsMode.