Secure Linux desktops with Microsoft Defender

As more developers begin to use Linux desktops, they become more attractive to attackers: high-privilege, high-value, and easy for admins to overlook. A developer using Linux for day-to-day development may interact with source code repositories, continuous integration and continuous delivery (CI/CD) pipelines, cloud infrastructure, container environments and internal development platforms. If their workstation is compromised, an attacker doesn’t just gain access to a laptop, but a foothold in the pipelines that build and ship the organization’s software. As Linux adoption expands beyond the data center, organizations need a consistent approach to protecting Linux wherever it is used.

That’s why we’ve extended our industry-leading endpoint protection in Microsoft Defender, bringing enterprise-grade protection, detection, vulnerability management and response capabilities to Linux workstations.

Enterprise-grade protection for Linux desktops

Defender support for Linux workstations spans all three key areas of endpoint security:

Protect and detect

• Endpoint detection and response (EDR)
• Microsoft Defender next-gen antivirus
• Threat analytics

Exposure management

• Microsoft Defender Vulnerability Management
• Device inventory
• Security settings management

Investigate and respond

• Advanced hunting
• Live response
• Device isolation

The result is broader Linux protection, delivered through the tools and processes security teams already trust.

Give security teams a consistent and simplified view across the endpoint estate

With Defender on Linux desktops, organizations can:

• Onboard quickly using the deployment methods already validated for Linux servers
• Reduce operational complexity by protecting Linux desktops and servers with one agent and one security operations experience
• Improve visibility across heterogeneous endpoint environments
• Strengthen developer workstation security where users interact with source code, cloud infrastructure and other critical resources
• Accelerate investigation and response through a consistent security operations experience

Defender protects Linux desktops with the same deployment organizations already use to protect Linux servers. There is no separate desktop-specific agent to deploy or maintain, and existing deployment packages, deployment methods and security capabilities on Linux servers extend directly to Linux workstations.

Deployment options in the Microsoft Defender portal

Defender automatically identifies whether a Linux device is a server or a workstation, so devices appear correctly within inventory and security workflows without any additional administrative effort. With Microsoft Defender, security operations teams can gain visibility into Linux workstations alongside the rest of their enterprise endpoint estate. They can respond through a single portal, whether Linux is running in the data centre, in the cloud, or on an engineer’s desk.

Get started

Defender support is based on the underlying Linux distribution and kernel version, regardless of the desktop environment running on top of the distribution. Every distribution currently supported by Microsoft Defender on Linux servers is supported on Linux desktops as well — including RHEL, CentOS, Ubuntu, Debian, SLES, Fedora and Oracle Linux, running GNOME, KDE or other desktop environments.

Defender on Linux desktops requires the standalone Microsoft Defender for Endpoint Plan 2 or Microsoft 365 E5 and E7.

If your organization runs Linux on developer, engineering or security desktops, now is the time to close that visibility gap. To join the public preview, onboard eligible Linux workstations using any of the existing deployment methods. Before you begin, review what’s new in Defender and complete the pre-requisites.

This is another step towards our vision of helping organizations secure every endpoint, no matter which operating system or platform.

To learn more about endpoint protection with Microsoft Defender, check out our website. To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.