www.it-connect.fr
Microsoft Defender for Endpoint Now Supports Linux Workstations
Microsoft Defender for Endpoint can now protect Linux workstations. “Yeah, right,” some may say, yet Microsoft is announcing compatibility with several distributions, including Ubuntu, Fedora, and Debian. Here’s what you need to know.
Until now, Microsoft Defender for Endpoint on Linux was primarily designed for servers, whether on-premises or in the cloud. Linux workstations, on the other hand, remained outside the scope of the Redmond firm’s EDR. But that is now a thing of the past.
In an article published on the Microsoft Defender for Endpoint blog, Megha Priya from Microsoft says this new capability is aimed especially at Linux developers. The reason is that their workstations are sensitive because of the access they provide: source code repositories, CI/CD pipelines, cloud infrastructure, containers, and more.
"If their workstation is compromised, an attacker gains not just access to a laptop, but a foothold in the pipelines that build and deliver the organization’s software", we can read.
One Agent for Servers and Workstations
Microsoft explains that the Defender for Endpoint agent for workstations is the same as the one used for servers. That also means everything is already in place, including the packages and deployment methods already used for Linux servers (Defender deployment tool, installation script, Ansible, Chef, Puppet, etc.). In practice, it is Defender EDR itself that determines whether the machine is a server or a workstation.
To determine the device type, the Defender for Endpoint agent evaluates several criteria: system metadata, distribution-specific information, Ubuntu Pro entitlements, and desktop-related details. One small nuance: if these signals are inconclusive, the device is classified as a server by default. Microsoft explains this mechanism in its documentation.
Ultimately, support for a Linux PC depends mainly on the distribution and Linux kernel version, not on the desktop environment (GNOME, KDE, or any other one). All server-supported distributions are also supported on workstations, including RHEL, CentOS, Ubuntu, Debian, SLES, Fedora, and Oracle Linux. The list published on Microsoft Learn also includes Rocky Linux, AlmaLinux, and openSUSE Leap.
As for features, it will offer the equivalent of what is available on other platforms, namely:
- Protection and detection: EDR, Microsoft Defender Antivirus, and threat analysis.
- Exposure management: Microsoft Defender Vulnerability Management, device inventory, and security settings management.
- Investigation and response: Advanced Hunting, Live Response, and device isolation.
A Plan 2 License Is Required
There is an important requirement to use Microsoft Defender for Endpoint on Linux: you need a Microsoft Defender for Endpoint Plan 2 license (standalone) or a Microsoft 365 E5 or E7 license. Microsoft does not mention Plan 1 or Defender for Business.
Also be careful when coexisting with another tool. The documentation states: "Running Defender for Endpoint on Linux alongside other Fanotify-based security solutions is not supported and may lead to unpredictable behavior, including system freezes."
For organizations that do not have these licenses, alternatives still exist, even if they are not in the same category as an EDR. For example, I wrote a guide to install and configure the ClamAV antivirus on a Linux machine.
What do you think?
