Yes, you read that correctly. Microsoft is bringing its Defender security software to Linux desktops. The company has announced that Microsoft Defender for Endpoint now officially supports Linux desktop environments, with the feature currently available in public preview.
And before anyone starts wondering whether Microsoft has suddenly decided that every Linux user needs antivirus software, there’s an important distinction. This isn’t the consumer version of Defender familiar to Windows users. Instead, it’s Microsoft’s enterprise security platform for organizations running Linux workstations.
According to Microsoft, the expansion is driven by the growing use of Linux desktops among developers. These machines often access source code repositories, cloud infrastructure, credentials, and other sensitive resources, making them attractive targets for attackers.
The idea is to give enterprise security teams the same visibility and protection across Linux desktops that they already have for Windows, macOS, and Linux servers.
As for the capabilities, Defender for Endpoint provides real-time antivirus protection, endpoint detection and response, threat investigation, vulnerability management, and centralized security monitoring through the Microsoft Defender portal.
Security administrators can use these tools to investigate suspicious activity, identify compromised machines, and respond to threats without managing Linux workstations through a separate security platform.
Interestingly, Microsoft isn’t introducing a completely new Linux security agent for this purpose. According to its documentation, the desktop version uses the same deployment packages, installation methods, and security capabilities already available for Linux servers.
The supported distributions are also the same. The list includes Ubuntu LTS, Debian, Fedora, Red Hat Enterprise Linux, openSUSE Leap, SUSE Linux Enterprise, Rocky Linux, AlmaLinux, and several others.
Desktop environment choice doesn’t matter. Whether a workstation runs GNOME, KDE Plasma, or another graphical environment, compatibility depends on the underlying distribution and kernel rather than the desktop itself.
There’s also an interesting detail regarding device identification. Defender attempts to determine whether a Linux installation is a server or workstation using operating system metadata and other system characteristics. When it cannot reliably identify a machine as a workstation, it classifies it as a server by default.
Of course, Defender’s presence on Linux isn’t entirely new. Microsoft introduced its antivirus solution for Linux servers back in 2020, subsequently expanding its enterprise threat detection and response capabilities. What’s changing now is the official inclusion of desktop workstations.
Finally, it’s also worth emphasizing that this remains a public preview, not a generally available release. Organizations interested in deploying it will need an appropriate Microsoft Defender for Endpoint subscription and must meet the existing Linux system requirements.
For more details, see Microsoft’s official announcement
Microsoft can walk west until their hats float.
It’s just another step in their EEE program.
My personal desktop? Hahahahahaha nope
My work laptop? Nervously shuffles this article under the rug before the C-suite finds it
My company has a “yOu neeD a ViRusscaNNer on YoUr BYOd” (even on Linux) I installed clamAV. The only thing it does is silence the IT guys.
Yeah, similar here. We use Pareto Security (which is perfectly fine). I’m a bit worried though that some decision maker sees this and thinks "neat, now allachines can be managed via [whatever the Microsoft interface for that is called]
A couple of years ago they changed the phone policy, you can only read work email on your phone when you install Microsoft intune and basically give the company admin access. We all use personal phones (company doesn’t provide them), so basically my entire team decided to just not get work emails on our phones. Most of my team is self employed (freelance). Now sometimes I get complaints I don’t respond to emails quickly… Yeah what on earth could be the reason for that…
Windows Defender is a good Antivirus, but which Linux user in their right mind would install Microsoft software voluntarily?
I strongly disagree. I know this is the Internet consensus nowadays, but I have seen malware beating Defender multiple times. The last two times it was not zero day malware, but rather Defender failed due to architectural reasons. (not robust, reliable enough definition update mechanism & scanning stalled so the -relatively ancient- virus just disabled defender before it could’ve protected you) The last time happened a little over a year ago, so it’s not ancient history.
Sure, if you have a fresh WIndows install & Defender correctly updated its database, then it might benchmark very well. Detection itself will only stall under very specific circumstances that are not uncommon, but will not occur on a typical test rig.
I have never seen such problems with Eset & Bitdefender. Even Kasparesky is doing a better job at pretending to be not spyware but an actual security suite than Defender.
I think a general rule would be an antivirus unaffiliated with data center construction.
“Would you like our spyware on your computer? We’ll make sure we’re the only spyware.”
lol
I bet they would like that. They can fuck right off though.
lol that’s gonna be a nope from me, dawg
It’s closed source software, right?
I switched to Linux to get away from Windows, thank you very much. I also won’t forget how in 2014, the remains at an African-American gravesite got moved and damaged—just so they could build another data centre.
They know they’re at risk of losing their market share with Windows, so they’re pivoting to Linux. They don’t get that they’re the virus!
🤮
