Endpoint and identity
Microsoft Defender for Endpoint
EDR, attack surface reduction and vulnerability management for devices.
News
Defender for Endpoint news
8 posts in the last 180 days from Microsoft's blogs, Tech Community and Azure Updates.
Defender for Endpoint
Secure Linux desktops with Microsoft Defender
As more developers begin to use Linux desktops, they become more attractive to attackers: high-privilege, high-value, and easy for admins to overlook.
Microsoft Defender for Endpoint BlogDefender for Endpoint
Become a Microsoft Defender for Endpoint Ninja
Do you want to become a ninja for Microsoft Defender for Endpoint? We can help you get there!
Microsoft Defender for Endpoint BlogDefender for Endpoint
Introducing scheduled antivirus scans on Microsoft Defender Linux
Security teams rely on scheduled scans to ensure consistent coverage across devices, detect dormant or missed threats, and meet compliance requirements.
Microsoft Defender for Endpoint BlogDefender for Endpoint
Reduce unnecessary internet exposure with Microsoft Defender
In today’s threat landscape, internet exposure , i.e. devices that allow inbound connectivity from the public internet, continues to be a major vector for initial access…
Microsoft Defender for Endpoint BlogDefender for Endpoint
Microsoft Defender now monitors RPC activity
Remote procedure call (RPC) is a protocol commonly abused by attackers that allows functions implemented in a separate process, and potentially on a remote machine, to…
Microsoft Defender for Endpoint BlogDefender for Endpoint
Elevate your telemetry using custom data collection in Microsoft Defender
At Ignite in November, we announced that Microsoft Defender is now the only endpoint protection solution that allows data-hungry security teams to meet specific…
Microsoft Defender for Endpoint BlogDefender for Endpoint
How Microsoft Defender used predictive shielding to proactively disrupt a ransomware attack
Modern ransomware attacks are increasingly designed to blend in with normal IT operations, using trusted administrative tools to quietly weaken defenses and distribute…
Microsoft Defender for Endpoint BlogDefender for Endpoint
Introducing selective response actions for high-value assets in Microsoft Defender
Deploying Microsoft Defender on high-value assets (HVAs) such as domain controllers, ADFS servers, and other Tier-0 systems, requires a thoughtful approach to balance…
Microsoft Defender for Endpoint Blog
Product changes
New features and changes
All 113 entries Microsoft documented on Learn in the last 12 months, newest first.
November 2026
- GA
macOS release: Build 101.26092.0012
macOS release: Build 101.26092.0012. Release version 20.126092.12.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Linux · November 2026 · 101.26101.0000
Release details Release version Engine version Signature version 30.126101.0000.0 1.1.26090.3000 1.459.148.0 Enhancements and features Feature area Update summary Security Upgraded OpenSSL version to 3.6.4 Bug fix Fixed missing CentOS minor patch version in the Defender portal General Optimized memory usage…
October 2026
- GA
macOS release: Build 101.26092.0009
macOS release: Build 101.26092.0009. Release version 20.126092.9.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26082.0012
macOS release: Build 101.26082.0012. Release version 20.126082.12.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows Antivirus · October 2026 · Platform 4.18.26100.4 · Engine 1.1.26100.4
Release details Component Version Date Platform 4.18.26100.4 October 27, 2026 Engine 1.1.26100.4 October 27, 2026 Security intelligence 1 1.463.1.0 October 27, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- GA
Local AI agent discovery on Windows and macOS
Local AI agent discovery on Windows and macOS. Discover supported local AI agents and their configured MCP servers on onboarded Windows and macOS devices, and investigate them in the AI agent inventory and advanced hunting. Windows requires Microsoft Defender Antivirus…
DocsLocal AI agent discovery with Microsoft Defender for EndpointNewDiscover local AI agents with Microsoft Defender for EndpointNewMicrosoft Defender for Endpoint AI agent support matrixNew
Local AI agent discovery with Microsoft Defender for Endpoint Learn how Microsoft Defender discovers local AI agents and MCP servers configured on your devices through inventory and investigation capabilities.
- Release
Linux · October 2026 · 101.26091.0004
Release details Release version Engine version Signature version 30.126091.0004.0 1.1.26070.5001 1.457.364.0 Enhancements and features Feature area Update summary Platform Support Added support for Azure Linux 4. Visibility Added TCP socket bind telemetry, improving visibility into processes binding to local network…
- Release
Linux · October 2026 · 101.26091.0003
Release details Release version Engine version Signature version 30.126091.0003.0 1.1.26090.3000 1.461.35.0 Enhancements and features Feature area Update summary Security Upgraded libcurl to version 8.22.0 to address CVE-2026-9546. Security Hardened quarantine operations by enforcing authorization checks and protecting against file-path manipulation…
- GA
Antivirus audit mode for Linux
Antivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…
DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated
Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.
September 2026
- GA
macOS release: Build 101.26072.0017
macOS release: Build 101.26072.0017. Release version 20.126072.17.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows Antivirus · September 2026 · Platform 4.18.26090.9 · Engine 1.1.26090.9
Release details Component Version Date Platform 4.18.26090.9 October 12, 2026 Engine 1.1.26090.9 October 12, 2026 Security intelligence 1 1.461.1.0 October 12, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Preview
Microsoft Defender support for Linux Desktops
Microsoft Defender support for Linux Desktops. Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Deployment methods and security capabilities remain consistent across both…
DocsPrerequisites for Microsoft Defender for Endpoint on LinuxNew
Prerequisites for Microsoft Defender for Endpoint on Linux Describes the requirements needed to install and use Microsoft Defender for Endpoint on Linux.
- GA
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…
DocsMicrosoft Defender for Endpoint plug-in for Windows Subsystem for …New
Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) Learn how to set up and use the Defender for Endpoint plug-in for Windows Subsystem for Linux.
- Preview
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…
DocsMicrosoft Defender for Endpoint plug-in for Windows Subsystem for …Newregistration form
Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) Learn how to set up and use the Defender for Endpoint plug-in for Windows Subsystem for Linux.
- Preview
Memory scan for Linux
Memory scan for Linux. Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are…
DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated
Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.
- Release
Linux · September 2026 · 101.26081.0010
Release details Release version Engine version Signature version 30.126081.0010.0 1.1.26090.3000 1.459.287.0 Enhancements and features Feature area Update summary Device identity Fixed an issue where cloned Linux virtual machines could retain the source image's machine identifier, causing multiple endpoints to appear…
- Release
Linux · September 2026 · 101.26072.0005
Release details Release version Engine version Signature version 30.126072.0005.0 1.1.26070.5001 1.459.239.0 Enhancements and features Feature area Update summary Security Memory scanning (preview) adds process memory scanning to detect known malicious behaviors and memory-resident threats, which strengthens protection against in-memory attacks…
DocsNew features in Microsoft Defender for EndpointNew
New features in Microsoft Defender for Endpoint This article describes new features available in Microsoft Defender for Endpoint, including both Windows and cross-platform updates.
August 2026
- GA
macOS release: Build 101.26062.0012
macOS release: Build 101.26062.0012. Release version 20.126062.12.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26062.0011
macOS release: Build 101.26062.0011. Release version 20.126062.11.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows Antivirus · August 2026-2 · Platform 4.18.26080.4 · Engine 1.1.26080.3
Release details Component Version Date Platform 4.18.26080.4 September 17, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Release
Windows Antivirus · August 2026 · Platform 4.18.26080.3 · Engine 1.1.26080.3
Release details Component Version Date Platform 4.18.26080.3 September 1, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …ASR rules overview
ASR rules overview Learn about attack surface reduction (ASR) rules in Microsoft Defender Antivirus, including requirements, configuration methods, modes, exclusions, and policy conflict resolution.
- Preview
Tamper protection in audit mode for Linux
Tamper protection in audit mode for Linux. Detects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking…
DocsUse tamper protection in audit mode for Microsoft Defender for …
Use tamper protection in audit mode for Microsoft Defender for Endpoint on Linux Learn how to verify, test, and investigate tamper protection in audit mode for Microsoft Defender for Endpoint on supported Linux devices.
- GA
Offboarding API support for Linux
Offboarding API support for Linux. Enables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale. Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007…
Offboard machine API Learn how to use an API to offboard a device from Microsoft Defender for Endpoint.
- Preview
Antivirus audit mode for Linux
Antivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…
DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated
Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.
July 2026
- GA
macOS release: Build 101.26062.0009
macOS release: Build 101.26062.0009. Release version 20.126062.9.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26052.0016
macOS release: Build 101.26052.0016. Release version 20.126052.16.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
iOS · July 2026 · Platform Version: 1.1.79080103
Release details Platform version Release Date 1.1.79080103 July 20, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes.
- Release
iOS · July 2026 · Platform Version: 1.1.78290102
Release details Platform version Release Date 1.1.78290102 July 3, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes. Feature Improvement in compliance flow.
- GA
iOS release: Build 1.1.78290102
iOS release: Build 1.1.78290102. Release version 1.1.78290102 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows Antivirus · July 2026 · Platform 4.18.26070.9 · Engine 1.1.26070.7
Release details Component Version Date Platform 4.18.26070.9 August 5, 2026 Engine 1.1.26070.7 August 5, 2026 Security intelligence 1 1.457.11.0 August 5, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Release
Linux · July 2026 · 101.26052.0012
Release details Release version Engine version Signature version 30.126052.0012.0 1.1.26040.3001 1.449.136.0 Enhancements and features Feature area Update summary Visibility Improved antivirus enforcement visibility. The mdatp health command now includes a new antivirus_enforcement_level field that shows whether antivirus is running in…
- GA
Defender Deployment Tool for Linux
Defender Deployment Tool for Linux. Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation…
DocsDeploy Microsoft Defender endpoint security to Linux devices using the …Updated
Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool (preview) Learn how to use the Defender deployment tool to install and onboard Microsoft Defender for Endpoint on Linux devices and verify deployment.
- Release
Android · July 2026 · Platform: 1.0.9107.0101
Release details Platform version Release Date 1.0.9107.0101 July 21, 2026 Enhancements and features Feature Area Update Summary General Performance improvements and general bug fixes.
- Preview
AI agent runtime protection updates
AI agent runtime protection updates. AI agent runtime protection includes these enhancements: - Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI…
DocsAI Agent Runtime Protection with Microsoft Defender for Endpoint …New
AI Agent Runtime Protection with Microsoft Defender for Endpoint (Preview) Learn how Microsoft Defender for Endpoint provides runtime protection for local AI agents by detecting and blocking prompt injection attacks.
June 2026
- GA
macOS release: Build 101.26042.0020
macOS release: Build 101.26042.0020. Release version 20.126042.20.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
iOS · June 2026 · Platform Version: 1.1.78020101
Release details Platform version Release Date 1.1.78020101 June 11, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes.
- Release
iOS · June 2026 · Platform Version: 1.1.77280101
Release details Platform version Release Date 1.1.77280101 June 1, 2026 Enhancements and features Feature Area Update Summary Feature Enhancements The Trust this network option is now only applicable to unsecure networks. Suspicious/rogue networks can't be trusted by users. Improvements Performance…
- GA
Windows release: Windows Defender Antivirus: Platform 4.18.26050.15 / Engine 1.1.26050.11
Windows release: Windows Defender Antivirus: Platform 4.18.26050.15 / Engine 1.1.26050.11. See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows Antivirus · June 2026 · Platform 4.18.26060.3008 · Engine 1.1.26060.3008
Release details Component Version Date Platform 4.18.26060.3008 June 30, 2026 Engine 1.1.26060.3008 June 30, 2026 Security intelligence 1 1.455.25.0 June 30, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- GA
Selective Response Actions
Selective Response Actions. Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering…
DocsSelective response actions on critical assets in Microsoft Defender …
Selective response actions on critical assets in Microsoft Defender for Endpoint Learn how to onboard Tier-0 and high-value assets with restricted security operations in Microsoft Defender for Endpoint to reduce operational risk.
- Preview
Local AI agent runtime protection
Local AI agent runtime protection. Runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before…
DocsSet up AI agent runtime protection with Microsoft Defender for …New
Set up AI agent runtime protection with Microsoft Defender for Endpoint (Preview) Learn how to configure Microsoft Defender for Endpoint AI agent runtime protection to detect, audit, and block prompt injection on Windows devices.
- Preview
Local AI agent discovery — macOS support and new agents
Local AI agent discovery — macOS support and new agents. Local AI agent discovery now supports macOS endpoints in addition to Windows. This update also adds discovery support for new agents including Junie CLI, Kiro CLI, Warp, Hermes Agent, Goose…
DocsLocal AI agent discovery with Microsoft Defender for EndpointNew
Local AI agent discovery with Microsoft Defender for Endpoint Learn how Microsoft Defender discovers local AI agents and MCP servers configured on your devices through inventory and investigation capabilities.
- Preview
Local AI agent discovery
Local AI agent discovery. Microsoft Defender for Endpoint now automatically discovers supported local AI agents running on onboarded Windows devices — including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as…
DocsDiscover AI agents and assess security posture using Microsoft …NewDiscover local AI agents with Microsoft Defender for EndpointNew
Discover AI agents and assess security posture using Microsoft Defender Learn how to discover AI agents, review their risk and security posture, and access recommendations, incidents, alerts, and Advanced Hunting in Microsoft Defender.
- Release
Linux · June 2026 · 101.26042.0011
Release details Release version Engine version Signature version 30.126042.0011.0 1.1.26040.3001 1.449.136.0 Enhancements and features Feature area Update summary Resolved build issue This release contains a fix for a previously reported issue where Microsoft Defender for Endpoint on Linux could become…
DocsConfigure offline security intelligence updates for Microsoft Defender …UpdatedDeviceFileEvents table in the advanced hunting schemaDeviceProcessEvents table in the advanced hunting schemaDeviceNetworkEvents table in the advanced hunting schema
Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux devices with limited or no internet connectivity.
- GA
Linux release: Build 101.26042.0009
Linux release: Build 101.26042.0009. Release version 30.126042.0009.0 - see considerations and updates for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Enhanced Defender deployment tool for Windows
Enhanced Defender deployment tool for Windows. The new version of the tool streamlines onboarding and enhances security by: - Bundling the onboarding package directly into the tool's executable. - Generating a key during deployment package creation that is required for…
DocsUse the Microsoft Defender deployment tool for WindowsNew
Use the Microsoft Defender deployment tool for Windows Learn how to use the Microsoft Defender deployment tool to onboard, update, stage, and offboard supported Windows devices.
- Release
Android · June 2026 · Platform: 1.0.9029.0101
Release details Platform version Release Date 1.0.9029.0101 June 30, 2026 Enhancements and features Feature Area Update Summary General Performance improvements and general bug fixes.
- Release
Android · June 2026 · Platform: 1.0.9014.0101
Release details Platform version Release Date 1.0.9014.0101 June 19, 2026 Enhancements and features Feature Area Update Summary General Performance improvements and general bug fixes.
- Release
Android · June 2026 · Platform: 1.0.9003.0101
Release details Platform version Release Date 1.0.9003.0101 June 8, 2026 Enhancements and features Feature Area Update Summary Feature Enhancements The Trust this network option is now only applicable to unsecure networks. Suspicious/rogue networks can't be trusted by users. Fixes The…
- GA
Android release: Build 1.0.9029.0101
Android release: Build 1.0.9029.0101. Release version 1.0.9029.0101 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
May 2026
- Release
iOS · May 2026 · Platform Version: 1.1.77130101
Release details Platform version Release Date 1.1.77130101 May 15, 2026 Enhancements and features Feature Area Update Summary Fixes Fixed unexpected hang in Control Filter. Improvements Performance improvements and general bug fixes. Telemetry Enhanced telemetry for onboarding events.
- GA
Windows release: Windows Defender Antivirus: Platform 4.18.26040.7 / Engine 1.1.26040.8
Windows release: Windows Defender Antivirus: Platform 4.18.26040.7 / Engine 1.1.26040.8. See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows Antivirus · May 2026 · Platform 4.18.26050.15 · Engine 1.1.26050.11
Release details Component Version Date Platform 4.18.26050.15 June 9, 2026 Engine 1.1.26050.11 June 9, 2026 Security intelligence 1 1.453.4.0 June 9, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Preview
Selective Response Actions
Selective Response Actions. Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering…
DocsSelective response actions on critical assets in Microsoft Defender …
Selective response actions on critical assets in Microsoft Defender for Endpoint Learn how to onboard Tier-0 and high-value assets with restricted security operations in Microsoft Defender for Endpoint to reduce operational risk.
- Preview
Schedule antivirus scans on Linux
Schedule antivirus scans on Linux. You can now configure scheduled antivirus scans on Microsoft Defender for Endpoint on Linux. Scheduled scans support hourly quick scans, interval-based quick scans, and weekly full scans, with options for low-priority execution, idle-time scheduling, and…
DocsSchedule Microsoft Defender for Endpoint antivirus scans on Linux
Schedule Microsoft Defender for Endpoint antivirus scans on Linux Learn how to schedule Microsoft Defender for Endpoint antivirus scans on Linux using the Microsoft Defender portal, Microsoft Intune, managed JSON, or the command line.
- GA
Defender endpoint security solution for Windows 7 SP1 and Windows Server 2008 R2 SP1
Defender endpoint security solution for Windows 7 SP1 and Windows Server 2008 R2 SP1. The Defender for endpoint security solution for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices is now generally available. The solution provides advanced…
DocsOnboard previous versions of Windows on Microsoft Defender for …Use the Microsoft Defender deployment tool for WindowsNew
Onboard previous versions of Windows on Microsoft Defender for Endpoint Onboard supported previous versions of Windows devices so that they can send sensor data to the Microsoft Defender for Endpoint sensor
- GA
Custom data collection
Custom data collection. Custom data collection is now generally available. This feature enables organizations to expand and customize telemetry collection beyond default configurations with rule-based filtering for specific events from endpoint devices. The maximum event limit per rule has been…
DocsCustom data collection in Microsoft Defender for EndpointUpdated
Custom data collection in Microsoft Defender for Endpoint Custom data collection allows organizations to tailor telemetry collection to their specific threat hunting needs with customizable filters and enhanced visibility.
- GA
Configure offline security intelligence update settings for Linux from the Defender and Intune portals
Configure offline security intelligence update settings for Linux from the Defender and Intune portals. You can now configure offline security intelligence update settings for Linux directly from the Defender and Intune portals.
DocsConfigure offline security intelligence updates for Microsoft Defender …Updated
Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux devices with limited or no internet connectivity.
- Preview
Automatic device isolation (automatic attack disruption)
Automatic device isolation (automatic attack disruption). Microsoft Defender for Endpoint can now automatically isolate compromised devices as part of automatic attack disruption . Isolation blocks most network traffic while keeping the device connected to security services. The action is time-limited…
DocsTake response actions on a device in Microsoft Defender for EndpointUpdatedAutomatic attack disruption in Microsoft Defender
Take response actions on a device in Microsoft Defender for Endpoint Respond to attacks on a device in Microsoft Defender for Endpoint by isolating it, collecting an investigation package, running a scan, or restricting apps.
- Release
Android · May 2026 · Platform: 1.0.8913.0101
Release details Platform version Release Date 1.0.8913.0101 May 18, 2026 Enhancements and features Feature Area Update Summary Feature Enhancements Android malware scanning now covers system apps, along with the existing support for installed apps. General Performance improvements and general bug…
April 2026
- GA
macOS release: Build 4.18.25040.1
macOS release: Build 4.18.25040.1. Release version 4.18.25040.1 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26032.0016
macOS release: Build 101.26032.0016. Release version 20.126032.16.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26022.0020
macOS release: Build 101.26022.0020. Release version 20.126022.20.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26022.0018
macOS release: Build 101.26022.0018. Release version 20.126022.18.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Windows release: Windows Defender Antivirus: Platform 4.18.26030.3011 / Engine 1.1.26030.3008
Windows release: Windows Defender Antivirus: Platform 4.18.26030.3011 / Engine 1.1.26030.3008. See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows Antivirus · April 2026 · Platform 4.18.26040.7 · Engine 1.1.26040.8
Release details Component Version Date Platform 4.18.26040.7 May 12, 2026 Engine 1.1.26040.8 May 5, 2026 Security intelligence 1 1.451.6.0 May 12, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …CVE-2026-41091CVE-2026-45498CVE-2026-45584
- Preview
View action status in the Activities tab (Preview)
View action status in the Activities tab (Preview). You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page…
DocsDetails and Results of an Automatic Attack Disruption ActionTake response actions on a device in Microsoft Defender for EndpointUpdated
Details and Results of an Automatic Attack Disruption Action Learn how to review automatic attack disruption results in Microsoft Defender XDR, including the summary card, Activities tab, Action center, and advanced hunting queries.
- Release
Linux · April 2026 · 101.26032.0000
Release details Release version Engine version Signature version 30.126032.0000.0 1.1.26010.1004 1.445.617.0 Enhancements and features Feature area Update summary Visibility Expanded visibility into Linux kernel module (.ko) file activity - including creation, rename, and deletion. Configuration Offline security intelligence updates now…
- GA
Linux release: Build 101.26032.0000
Linux release: Build 101.26032.0000. Release version 30.126032.0000.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Android · April 2026 · Platform: 1.0.8805.0103
Release details Platform version Release Date 1.0.8805.0103 April 7, 2025 Enhancements and features Feature area Update summary General Performance improvement and bug fixes.
- GA
Android release: Build 1.0.8805.0103
Android release: Build 1.0.8805.0103. Build 1.0.8805.0103 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
March 2026
- Release
Linux · March 24, 2026 · Update: post-release fix
Fixed an issue in the January 2026 release, where real-time scanning of the /dev/watchdog device could trigger unexpected system reboots on systems with hardware watchdog enabled. For more information, see Linux | January 2026 | Platform: 101.25102.0005 .
- GA
The proactive user containment (contain user) action as part of the predictive shielding feature is now genera
The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available. This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious…
DocsTake response actions on a device in Microsoft Defender for EndpointUpdated
Take response actions on a device in Microsoft Defender for Endpoint Respond to attacks on a device in Microsoft Defender for Endpoint by isolating it, collecting an investigation package, running a scan, or restricting apps.
- GA
macOS release: Build 101.26012.0017
macOS release: Build 101.26012.0017. Release version 20.126012.17.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26012.0015
macOS release: Build 101.26012.0015. Release version 20.126012.15.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Windows release: Windows Defender Antivirus: Platform 4.18.26020.6 / Engine 1.1.26020.3
Windows release: Windows Defender Antivirus: Platform 4.18.26020.6 / Engine 1.1.26020.3. See enhancements and features for this release .
DocsMicrosoft Defender Antivirus updates - Previous versions for technical …
Microsoft Defender Antivirus updates - Previous versions for technical upgrade support Understand the type of technical support offered for previous versions of Microsoft Defender Antivirus
- Release
Windows Antivirus · March 2026 · Platform 4.18.26030.3011 · Engine 1.1.26030.3008
Release details Component Version Date Platform 4.18.26030.3011 April 14, 2026 Engine 1.1.26030.3008 April 8, 2026 Security intelligence 1 1.449.16.0 April 14, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- GA
Proactive user containment (contain user)
Proactive user containment (contain user). The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available. This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised…
DocsTake response actions on a device in Microsoft Defender for EndpointUpdated
Take response actions on a device in Microsoft Defender for Endpoint Respond to attacks on a device in Microsoft Defender for Endpoint by isolating it, collecting an investigation package, running a scan, or restricting apps.
- Release
Linux · March 2026 · 101.26021.0002
Release details Release version Engine version Signature version 30.126021.0002.0 1.1.26010.1003 1.445.553.0 Enhancements and features Feature area Update summary Performance and stability Improved agent performance and stability under sustained, high‑throughput workloads.
- Release
Linux · March 2026 · 101.26012.0007
Release details Release version Engine version Signature version 30.126012.0007.0 1.1.25110.3002 1.443.508.0 Enhancements and features Feature area Update summary Vulnerability detection Strengthened Linux security coverage for Python workloads by improving vulnerability detection across system, user, and virtual environments, expanding coverage for…
- GA
Linux release: Build 101.26021.0002
Linux release: Build 101.26021.0002. Release version 30.126021.0002.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Linux release: Build 101.26012.0007
Linux release: Build 101.26012.0007. Release version 30.126012.0007.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Library management for live response
Library management for live response. Library management for live response is now generally available. This feature provides a centralized view for managing files and scripts used during live response sessions.
DocsManage the live response file library in Microsoft Defender for …
Manage the live response file library in Microsoft Defender for Endpoint Use Microsoft Defender for Endpoint to configure libraries for live response.
February 2026
- Release
macOS · February 2026 · Platform: 101.25122.0008
Release details Platform version Release version Engine version Signature version 101.25122.0008 20.125122.8.0 1.1.25100.4000 1.439.74.0 Enhancements and features Bug and performance fixes
- GA
macOS release: Build 101.26012.0012
macOS release: Build 101.26012.0012. Release version 20.126012.12.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.25122.0008
macOS release: Build 101.25122.0008. Release version 20.125122.8.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Windows · February 2026 · Platform: 10.8821
Release details OS KB Windows Server 2025, all editions KB5078740 Windows Server 2022 KB5078766 Windows Server 2019, Windows 10 1809 KB5078752 Windows 11 26H1 KB5077239 Windows 11 24H2, Windows 11 25H2 KB5077241 Windows 11 23H2 KB5078883 Windows 10 21H2, Windows…
- GA
Windows release: Windows Defender Antivirus: Platform 4.18.26010.5 / Engine 1.1.26010.1
Windows release: Windows Defender Antivirus: Platform 4.18.26010.5 / Engine 1.1.26010.1. See enhancements and features for this release .
DocsMicrosoft Defender Antivirus updates - Previous versions for technical …
Microsoft Defender Antivirus updates - Previous versions for technical upgrade support Understand the type of technical support offered for previous versions of Microsoft Defender Antivirus
- GA
Windows release: Sense version 10.8821
Windows release: Sense version 10.8821. Release details are now available: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
What's new and release notes documentation updates
What's new and release notes documentation updates. The what's new and OS-specific release notes pages are now updated to provide better visibility and access to new features, improvements, and fixes: - The what's new page (this page) is now named…
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Linux · February 2026 · 101.25122.0004
Release details Platform version Release version Engine version Signature version 101.25122.0004 20.125122.0004 1.1.25110.3002 1.443.508.0 Enhancements and features Feature area Update summary Network configuration The following URLs must be allowed to enable Defender on Linux endpoints to receive internal configurations from…
DocsMicrosoft Defender for Endpoint streamlined connectivity URLs - …UpdatedMicrosoft Defender for Endpoint streamlined connectivity URLs - US …
Microsoft Defender for Endpoint streamlined connectivity URLs - commercial Get a list of the streamlined connectivity URLs required to onboard and maintain devices in Microsoft Defender for Endpoint in US commercial cloud environments.
- GA
Linux release: Build 101.25122.0004
Linux release: Build 101.25122.0004. Release version 30.125122.0004.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Preview
Library management for live response
Library management for live response. You can now view and manage files and scripts used during live response sessions in the Microsoft Defender portal. With this enhancement, you get a centralized view of all uploaded files and their properties, and…
DocsManage the live response file library in Microsoft Defender for …
Manage the live response file library in Microsoft Defender for Endpoint Use Microsoft Defender for Endpoint to configure libraries for live response.
- Preview
Enhanced Defender deployment tool for Windows
Enhanced Defender deployment tool for Windows. The new version of the tool streamlines onboarding and enhances security by: - Bundling the onboarding package directly into the tool's executable. - Generating a key during deployment package creation that is required for…
- GA
Effective settings tab
Effective settings tab. The Effective settings tab under the device inventory Configuration management tab is now generally available. In this tab, you can view the actual value and configuration source of each security setting on a device. This helps identify…
DocsInvestigate devices in Microsoft Defender for Endpoint
Investigate devices in Microsoft Defender for Endpoint Learn how to investigate devices by reviewing alerts, timelines, network connections, and security assessments in Microsoft Defender for Endpoint.
January 2026
- Release
macOS · January 2026 · Platform: 101.25122.0007
Release details Platform version Release version Engine version Signature version 101.25122.0007 20.125122.7.0 1.1.25100.4000 1.439.74.0 Enhancements and features Bug and performance fixes
- Release
macOS · January 2026 · Platform: 101.25122.0006
Release details Platform version Release version Engine version Signature version 101.25122.0006 20.125122.6.0 1.1.25100.4000 1.439.74.0 Enhancements and features Feature area Update summary General Bug and performance fixes.
- GA
macOS release: Build 101.25122.0007
macOS release: Build 101.25122.0007. Release version 20.125122.7.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.25122.0006
macOS release: Build 101.25122.0006. Release version 20.125122.6.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- Release
Linux · January 2026 · Platform: 101.25102.0005
Release details Platform version Release version Engine version Signature version 101.25102.0005 30.125102.0005.0 1.1.25090.6000 1.439.338.0 Enhancements and features Feature area Update summary Vulnerability detection Enhanced vulnerability detection for React components through improved telemetry. This feature includes support for identifying (CVE-2025-55182) …
Docs(CVE-2025-55182)
- GA
Linux release: Build 101.25102.0005
Linux release: Build 101.25102.0005. Release version 30.125102.0005.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
December 2025
- Release
macOS · December 2025 · Platform: 101.25102.0019
Release details Platform version Release version Engine version Signature version 101.25102.0019 20.125102.19.0 1.1.25090.2000 1.435.600.0 Enhancements and features Feature area Update summary Vulnerability Management CVE-2025-55182 (React2Shell) - Microsoft Defender Vulnerability Management (MDVM) can now surface devices that this vulnerability may affect.
- GA
macOS release: Build 101.25102.0019
macOS release: Build 101.25102.0019. Release version 20.125102.19.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Windows release: Windows Defender Antivirus: Platform 4.18.25110.6 / Engine 1.1.25110.1
Windows release: Windows Defender Antivirus: Platform 4.18.25110.6 / Engine 1.1.25110.1. See enhancements and features for this release .
DocsMicrosoft Defender Antivirus updates - Previous versions for technical …
Microsoft Defender Antivirus updates - Previous versions for technical upgrade support Understand the type of technical support offered for previous versions of Microsoft Defender Antivirus
- Release
Linux · December 2025 · Platform: 101.25092.0005
Release details Platform version Release version Engine version Signature version 101.25092.0005 30.125092.0005.0 1.1.25090.4000 1.437.18.0 Enhancements and features Feature area Update summary Vulnerability detection Enhanced vulnerability detection for vulnerable React components through deeper component analysis and enhanced telemetry. This includes support…
Docs(CVE-2025-55182)
- Release
Linux · December 2025 · Platform: 101.25092.0002
Release details Platform version Release version Engine version Signature version 101.25092.0002 30.125092.0002.0 1.1.25090.4000 1.437.18.0 Enhancements and features Feature area Update summary Critical fix Includes critical fix related to machine identifier ensuring every endpoint is accurately identified as a unique device.
- GA
Linux release: Build 101.25092.0005
Linux release: Build 101.25092.0005. Release version 30.125092.0005.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Linux release: Build 101.25092.0002
Linux release: Build 101.25092.0002. Release version 30.125092.0002.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
CVE exceptions
CVE exceptions. CVE exceptions are now generally available, and also support the False positive justification and the status field as part of the response for the GET /api/vulnerabilities request. Learn more .
DocsExceptions in Microsoft Defender Vulnerability ManagementGet all vulnerabilities
Exceptions in Microsoft Defender Vulnerability Management Learn how to create, view, and manage exceptions in Microsoft Defender Vulnerability Management to exclude data from remediation efforts and improve risk reporting.
- Release
Android · December 2025 · Platform: 1.0.8412.0101
Release details Platform version Release Date 1.0.8412.0101 December 15, 2025 Enhancements and features Feature area Update summary General Performance improvement and bug fixes.
- Release
Android · December 2025 · Platform: 1.0.8321.0101
Release details Platform version Release Date 1.0.8321.0101 December 2, 2025 Enhancements and features Feature area Update summary Root detection Native root detection for Microsoft Defender is now GA. General Performance improvement and bug fixes.
- GA
Android release: Build 1.0.8412.0101
Android release: Build 1.0.8412.0101. Build 1.0.8412.0101 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Android release: Build 1.0.8321.0101
Android release: Build 1.0.8321.0101. Build 1.0.8321.0101 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
No changes match.