Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft Defender for Endpoint now supports Linux desktop devices in Public Preview. Microsoft says Linux distributions supported on its server platform are also supported on desktops, with eligibility determined by the distribution, CPU architecture and kernel—not by whether the machine runs GNOME, KDE or another desktop environment.
Desktop onboarding uses the same deployment packages, deployment methods and security capabilities as Linux servers. Organizations should nevertheless verify the live prerequisites matrix, because supported versions differ by distribution and architecture.
What the Linux desktop announcement means
The change applies to Microsoft Defender for Endpoint, not a separate consumer antivirus edition. A Linux workstation can be onboarded to the Defender service, appear in the Microsoft security portal and receive the applicable endpoint policies, but desktop support remains a Public Preview feature. Preview status means Microsoft has made the capability available for evaluation and deployment, while support commitments and behavior can change before general availability.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallMicrosoft’s current prerequisites guidance, updated 22 September 2026, supersedes older licensing FAQs that said Linux client devices were unsupported. Those older pages may still appear in search results, but they describe the previous support position.
#1 Best Overall
Which Linux distributions are eligible?
The supported-distribution model includes x64 and ARM64 entries for these distribution families:
- Red Hat Enterprise Linux
- CentOS and CentOS Stream
- Ubuntu LTS and Ubuntu Pro
- Debian
- SUSE Linux Enterprise Server and openSUSE Leap
- Oracle Linux
- Amazon Linux
- Fedora
- Rocky Linux
- AlmaLinux
- Mariner
That list is a family-level summary, not a guarantee that every release is supported. Microsoft’s live prerequisites table is authoritative for the exact release, architecture and kernel combination. A distribution or release absent from that table is unsupported.
Kernel and custom-distribution rules
The stated minimum for the supported-distribution model is kernel 3.10.0-327 or later. Meeting that number alone does not make an arbitrary Linux build eligible; the distribution and release must also match Microsoft’s matrix.
Rank #2
A customized distribution derived from a supported vendor distribution may run when it meets the kernel requirements, but Microsoft does not treat it as part of the validated support baseline. If a problem occurs, Microsoft may require reproduction on an unmodified supported distribution before investigating further.
Licensing for Linux desktop onboarding
Microsoft lists Microsoft Defender for Endpoint P2 for desktop onboarding. P2 is also available through Microsoft 365 E5 and Microsoft 365 E7. Server plans are separate, so an organization should confirm that each desktop user or device is covered by the appropriate entitlement rather than assuming a server license transfers to workstations.
Technical prerequisites
Each Linux endpoint must meet Microsoft’s baseline requirements:
- At least one CPU core
- At least 2 GB of disk space
- At least 1 GB of RAM
systemdinstalled- Network access to Microsoft Defender cloud-service URLs
Proxy design is a significant deployment constraint. PAC files, WPAD, authenticated proxies, SSL inspection and intercepting proxies are unsupported. Microsoft documents transparent or static proxy approaches instead. Test the endpoint’s route to the required cloud services before onboarding a large fleet; a package can install successfully while cloud connectivity, policy delivery or reporting remains broken.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to deploy Defender on a Linux desktop
Microsoft’s documented Linux deployment methods apply to desktops and servers. Microsoft recommends using a deployment tool rather than repeating a manual installation on every workstation, particularly for managed fleets.
- Confirm the exact distribution release, CPU architecture and kernel against Microsoft’s current Linux prerequisites table.
- Verify the device has the required license,
systemd, CPU, memory and disk capacity. - Configure an allowed network path to Microsoft Defender cloud services, avoiding the unsupported proxy types.
- Use your organization’s deployment tool to install the Defender package and apply the onboarding configuration.
- Check the local Defender health status and confirm that the device appears in the security portal with the expected policies.
- For custom installation paths, local repositories or upgrades, follow the deployment-tool procedure rather than substituting an untested package workflow.
Tool-based deployment reduces repetitive work and supports scenarios such as upgrades, custom paths and local package repositories. The exact commands and package names vary by distribution, so use the instructions for the selected release instead of copying a command intended for another package manager.
Why a Linux desktop may appear as a server
Defender does not classify a device solely from the presence of a graphical desktop. Its classification logic evaluates operating-system metadata, distribution product information, subscriptions and licensing, system-purpose declarations, cloud and vendor metadata, image SKUs, Ubuntu Pro contracts, VMware properties, virtual-desktop indicators and installation records.
When those signals do not conclusively identify a workstation, Microsoft Defender for Endpoint classifies the device as a Server by default. This affects portal inventory, licensing interpretation and the policy expectations administrators may apply. A desktop showing as a server is therefore not proof that Linux desktop support failed; it may indicate that the available identity signals were inconclusive.
Coexistence limits with other Linux security software
Do not run Defender alongside another Fanotify-based security solution in blocking mode. Microsoft considers that combination unsupported and warns that it can produce unpredictable behavior, including system hangs.
Microsoft identifies a validated FAPolicyD exception for Red Hat Enterprise Linux and Fedora when the Defender health check is healthy. Treat that as a narrowly defined compatibility condition, not as approval for every Fanotify or application-control configuration. Check health after changing either product and test the combination on a representative workstation before broad rollout.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Amazon Linux 2 ARM64 lifecycle warning
Support for Amazon Linux 2 on ARM64 ends on 31 October 2026. Microsoft identifies Defender version 101.25122.0004 as the last supported version for that combination and advises migration to a supported distribution. The notice does not affect AMD64/x86_64 machines.
Organizations running Amazon Linux 2 ARM64 should inventory those devices now, plan a supported-distribution migration and avoid treating the last supported Defender version as a long-term update path.
Recommended Free Tools
Quick Recap
What administrators should verify before rollout
- Desktop support is still Public Preview.
- The precise distribution release and architecture are present in Microsoft’s current support table.
- The kernel is at least 3.10.0-327 and meets any distribution-specific conditions.
- Users or devices have Defender for Endpoint P2, including through an eligible Microsoft 365 E5 or E7 subscription.
systemd, 1 GB RAM, 2 GB disk and at least one CPU core are available.- Cloud connectivity works without PAC, WPAD, authenticated, SSL-inspecting or intercepting proxies.
- No other Fanotify-based blocker is enabled alongside Defender.
- Portal classification is reviewed so devices defaulted to Server are handled under the intended licensing and policy model.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
