I’ve updated my MDE Feature Comparison by OS again. The headline change since August is that Microsoft Defender for Endpoint is now available for Linux desktops in public preview. There are a few other additions worth calling out, particularly around Linux protection modes and WSL containers.
Linux desktop support uses the same supported distributions, deployment methods, and security capabilities as Linux server support. It does not make every Linux feature generally available: desktop support itself is still in public preview, and Linux network protection is currently documented only for AMD64 servers in preview. Linux desktops need an MDE Plan 2 licence; server licensing follows the applicable server entitlement. I’ve labelled the shared Linux column and its limitations more clearly in the table.
Quick plug
If the comparison is useful and you want to go much deeper, MDE In Depth, 2nd Edition is available now. Paul, Ian, and I cover the architecture, deployment, configuration, investigation, hunting, response, and day-to-day operation of Defender for Endpoint in considerably more detail than I can fit into one comparison table.
I’ve also got two LinkedIn Learning courses if you prefer that format:
- Deploying and Managing Defender for Endpoint for Windows covers onboarding, antivirus, attack surface reduction, firewall, and device control.
- Controlling Cybersecurity Risk with Defender Vulnerability Management covers asset visibility, security recommendations, remediation, and reporting.
Notes
As usual, this is a best-efforts comparison. Microsoft documents platform support, licensing, agent versions, and preview status in different places, and those details matter. A tick in the Linux column should be read alongside the desktop preview and feature-specific notes. Feedback is very welcome if you spot something I’ve missed.
Changelog
- Added Linux desktop public preview support and clarified the separate desktop and server licensing requirements. Linux network protection and web content filtering remain marked as AMD64 server previews.
- Updated supported macOS releases to macOS 27 (Golden Gate), macOS 26 (Tahoe), and macOS 15 (Sequoia).
- Updated WSL container (WSLc) support to generally available. The WSL plug-in provides inventory, alerts, timeline, and hunting visibility; it doesn’t provide antimalware, vulnerability management, or response actions on the WSL logical device.
- Added Linux antivirus audit mode in preview. It detects threats in real time without automatically remediating them and differs from passive mode.
- Clarified tamper protection in one row: Windows blocks changes, macOS offers block and audit modes, and Linux currently has an audit-only preview.
- Updated vulnerability assessment for a limited set of Microsoft Store apps to generally available.
- Corrected the table’s platform headings so Windows Server 2008 R2 sits under Windows Server, and the shared Linux column is labelled for servers and desktop preview.