Yes, you read that correctly. Microsoft is bringing its Defender security software to Linux desktops. The company has announced that Microsoft Defender for Endpoint now officially supports Linux desktop environments, with the feature currently available in public preview.
And before anyone starts wondering whether Microsoft has suddenly decided that every Linux user needs antivirus software, there’s an important distinction. This isn’t the consumer version of Defender familiar to Windows users. Instead, it’s Microsoft’s enterprise security platform for organizations running Linux workstations.
According to Microsoft, the expansion is driven by the growing use of Linux desktops among developers. These machines often access source code repositories, cloud infrastructure, credentials, and other sensitive resources, making them attractive targets for attackers.
The idea is to give enterprise security teams the same visibility and protection across Linux desktops that they already have for Windows, macOS, and Linux servers.
As for the capabilities, Defender for Endpoint provides real-time antivirus protection, endpoint detection and response, threat investigation, vulnerability management, and centralized security monitoring through the Microsoft Defender portal.
Security administrators can use these tools to investigate suspicious activity, identify compromised machines, and respond to threats without managing Linux workstations through a separate security platform.
Interestingly, Microsoft isn’t introducing a completely new Linux security agent for this purpose. According to its documentation, the desktop version uses the same deployment packages, installation methods, and security capabilities already available for Linux servers.
The supported distributions are also the same. The list includes Ubuntu LTS, Debian, Fedora, Red Hat Enterprise Linux, openSUSE Leap, SUSE Linux Enterprise, Rocky Linux, AlmaLinux, and several others.
Desktop environment choice doesn’t matter. Whether a workstation runs GNOME, KDE Plasma, or another graphical environment, compatibility depends on the underlying distribution and kernel rather than the desktop itself.
There’s also an interesting detail regarding device identification. Defender attempts to determine whether a Linux installation is a server or workstation using operating system metadata and other system characteristics. When it cannot reliably identify a machine as a workstation, it classifies it as a server by default.
Of course, Defender’s presence on Linux isn’t entirely new. Microsoft introduced its antivirus solution for Linux servers back in 2020, subsequently expanding its enterprise threat detection and response capabilities. What’s changing now is the official inclusion of desktop workstations.
Finally, it’s also worth emphasizing that this remains a public preview, not a generally available release. Organizations interested in deploying it will need an appropriate Microsoft Defender for Endpoint subscription and must meet the existing Linux system requirements.
For more details, see Microsoft’s official announcement.
A lot of nice sounding words when it’s really about employee monitoring and control.
This is bad news for Linux developers at work. One reason for wanting Linux is to get rid of all the privacy violating corporate spyware. Now corporate forces this spyware on you, or you can’t access any corporate resources from your machine.
Have fun developing when you need to start worrying what sudo commands you run, because some raise alerts in IT.
I hope someone reverse engineers mdatp and documents how to limit how much of your privacy it can invade. That shit needs to be jailed into namespaces that are limited to absolute minimum necessary.
Microslop wants to spy on your Linux Desktop with Ofender*
No they don’t. They want endpoint access to Linux computers. For reference, see Crowdstrike.
Then I need a tool to remove Microslop Defender safely too
I was actually excited to read this because I thought if it was open source, you could just un-Microsoft the code but yeah, that was naive of me. Fucking clowns.
Ironically security is one of the single most commonly used excuses for companies and governments to violate your privacy. Sorry microsoft, you can’t scan all my files. Womp womp.
Lemmy put it like this: free courses in self-defence are cool and all. But do they really have to be organised by the town’s serial sex offender?
On one hand the sex offender would know all the tactics he’ll use to rape you. On the other hand, would he share all the tactics he would use? Or would he share just enough for you to believe him?
🤣
Will this somehow make IO as slow as Windows?
It slows down compiling on Mac 8-10x when compared with VM on the same Mac. Horrible piece of shit… And a spyware. It also scans your IP traffic but I don’t know how big is the performance hit.
This is so Linux purists can use their OS of choice in environments that require attestation so as to pass conditional access requirements.
If this leads to more companies accepting Linux as a Desktop OS for their employees, I think this is actually a good move. Helps Linux to become more widespread, and maybe even non-IT people will get to know it better. This in turn could lead to more people using Linux in their private lives as well.
I guess, between this, Epic Games Slopnauncher, the mass of people coining since 2025…
Is… Is 2026, the actual year of the Linux Desktop? I know we won’t get the grandiose everything is suddenly Linux, but kind of feels like we’ve been getting there, and now ((Popular and Trash)) companies are migrating, in some capacity
I don’t know but I finally went all in this year and boy am I happy. Bazzite is rock solid and runs all I need without issues.
coining?
LOOOOOOOL.
Get fucked, Microsoft.
Ahhhaaahahahaha
Why is everyone pushing me towards bsd?