Microsoft updated the Defender for Endpoint documentation in September 2026: Microsoft Defender for Endpoint now supports Linux desktops in Public Preview. Until now, many organizations read the Linux guidance mainly through a server lens. For companies with 10 to 250 users, the change matters when developers, administrators, engineering teams, or specialist departments use Linux workstations. These devices often sit outside standard Windows client processes, but they can contain source code, credentials, SSH keys, browser profiles, and administration tools. The practical step is therefore not a broad immediate rollout. It is a controlled inventory: which Linux desktops exist, which distributions are supported, how updates and network access are handled, and where a Defender pilot fits into day-to-day operations.
What Microsoft documented in September
In the Microsoft Defender for Endpoint what’s new article, Microsoft lists Linux desktop support for September 2026 as Public Preview. The prerequisites page also confirms that all Linux distributions currently supported on servers are now supported on Linux desktops. Microsoft states that deployment methods and security capabilities remain consistent across Linux servers and Linux desktops. That matters for smaller IT teams because they do not need to design a completely separate desktop process from scratch. At the same time, the feature remains a preview. Rollout, support expectations, and operational ownership should therefore be planned as a pilot rather than treated as an untested mass deployment.
Which devices should be reviewed
The new documentation does not affect every endpoint in the same way. ReByteIT should not turn it into a general Linux positioning topic, but for customers with mixed environments it is a useful review point in a Microsoft Defender operations check. Microsoft explains that Defender for Endpoint classifies Linux devices as Server or Workstation by evaluating multiple system and environment attributes. If the available signals do not conclusively identify a device as a Workstation, Microsoft Defender for Endpoint classifies it as a Server by default. That is why IT teams should not rely on host names alone, but compare real usage, device class, and onboarding target.
- Identify Linux laptops and workstations used by developers, administrators, and technical teams.
- Document distribution, architecture, kernel level, device purpose, and existing security tooling.
- Check whether devices appear in the Defender portal as the expected Workstation or Server type.
- Test ambiguous devices separately before adding them silently to a standard rollout group.
Prerequisites and limits
Microsoft lists the same supported distribution base for Linux desktops as for servers, including Ubuntu LTS, Debian, Red Hat Enterprise Linux, Fedora, SUSE, Oracle Linux, Rocky Linux, and AlmaLinux in specific versions. Microsoft documents minimum requirements of one CPU core, at least 2 GB of disk space, and at least 1 GB of RAM; high-performance workloads might need more. Device isolation requires iptables and ip6tables or their nft variants. Network access is also important: according to Microsoft, Defender for Endpoint on Linux does not support PAC, WPAD, authenticated proxies, or SSL inspection. Organizations therefore need to verify whether firewall and proxy rules allow the required direct Defender connectivity.
Deadlines and support notes
Microsoft does not name an end date or retirement deadline for the Linux desktop preview. However, the same prerequisites documentation contains one concrete deadline: support for Microsoft Defender for Endpoint on Amazon Linux 2 running on ARM64 architecture will be deprecated on October 31, 2026. Microsoft states that only AL2 ARM64 systems are affected, not AMD64/x86_64 architectures. For a Linux desktop pilot, this is a useful reason to separate architectures and distributions clearly. Another important limit is Fanotify: Microsoft warns that running Defender for Endpoint on Linux alongside other Fanotify-based security solutions in blocking mode is unsupported and can lead to unpredictable behavior, including system hangs.
Practical next steps
- Reconcile Linux desktops across inventory, device management, and the Defender portal.
- Mark supported distributions and special cases such as Amazon Linux 2 ARM64.
- Review proxy, firewall, and SSL inspection rules against Microsoft’s connectivity requirements before onboarding.
- Keep the pilot group small and explicitly check existing Fanotify-based security tools.
- Include the results in a Microsoft Security Assessment or Defender for Endpoint operations review.
Official Microsoft sources
- Microsoft Learn: New features in Microsoft Defender for Endpoint
- Microsoft Learn: Prerequisites for Microsoft Defender for Endpoint on Linux
- Microsoft Learn: Deploy Microsoft Defender for Endpoint on Linux manually
If you want to check whether Linux desktops, Windows endpoints, and servers are covered consistently in Microsoft Defender, we support inventory, pilot planning, and operational review – get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
