Microsoft has launched a public preview of Defender for Linux Workstations, an extension of its Defender for Endpoint platform aimed at Linux desktops. The tool brings antivirus protection, vulnerability management, device isolation, and administrative controls for inventory and security settings to Linux machines.
The preview requires a standalone Defender for Endpoint Plan 2 subscription or a Microsoft 365 E5/E7 license. Supported distributions include RHEL, CentOS, Ubuntu LTS, SUSE Linux Enterprise Server, and Oracle Linux. Microsoft says there is no separate desktop agent to deploy; administrators can manage it the same way they already handle Linux servers.
The move is driven by growing Linux desktop adoption among developers, which Microsoft says makes those systems more attractive to attackers. The Register notes that many developers already use Linux, citing a 2025 Stack Overflow survey showing Ubuntu at 27.7% of professional work versus Windows at 49.5%. The publication also suggests that while the technical integration may be smooth, some users could resist corporate compliance enforced through Microsoft's tooling.