Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux

4 September 2026Feature update+45 / −21 lines

In brief

Starting with release 101.26062.0005, Defender for Endpoint on Linux verifies the antivirus engine signature before loading it. The offlineDefinitionUpdateVerifySig setting is deprecated and no longer has any effect.

What Defender admins need to know

No administrator action is required. Administrators can use mdatp health --details definitions and mdatp health --details features to view the verification state.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux

[!INCLUDE Microsoft 365 Defender rebranding]

This article walks you through setting up offline security intelligence updates for Microsoft Defender for Endpoint on Linux. Use this approach to keep antivirus definitions current on Linux devices that have limited or no internet connectivity, by downloading updates to a local mirror server and distributing them across your fleet. Before you begin, review the Prerequisites to ensure your environment meets the requirements.

How offline security intelligence updates work

This article describes how to configure offline security intelligence updates in Defender for Endpoint on Linux. This capability enables you to update security intelligence (also referred to as definitions or signatures) on Linux devices that have limited or no exposure to the internet. With this configuration, you use a local hosting server, called a mirror server, that connects to the Microsoft cloud to download security intelligence updates. Other Linux devices pull these updates from your mirror server at predefined intervals.

Local directory structure after cloning the repo or downloading the zipped file

After cloningUse the repo or downloadingfollowing example directory listing to verify that your local copy contains the zipped file, the local directoryexpected linux/definition_downloader structure should be as follows:and scripts: 

user@vm:~/mdatp-xplat$ tree linux/definition_downloader/

To manually execute the downloader script, configure the parameters in the `settings.json` file as per the description in the previous section, and use one of the following commands based on the OS of the mirror server:

- Bash: Run the following command to fetch the latest offline definition updates into the configured download folder:

  ```bash
  ./xplat_offline_updates_download.sh

  • PowerShell: If your mirror server runs Windows, use the PowerShell downloader script to retrieve the offline definition package: 

    ./xplat_offline_updates_download.ps1

Managed JSON

The mdatp_managed.json file is the managed configuration file that Defender for Endpoint on Linux reads at startup to apply policy settings. Use the following sample mdatp_managed.json and, update the parameters as per the configurationyour configuration, and copy the file to the location /etc/opt/microsoft/mdatp/managed/mdatp_managed.json. 

{
    "offlineDefinitionUpdateUrl": "http://172.22.199.67:8000/linux/production/",
    "offlineDefinitionUpdateFallbackToCloud":false,
    "offlineDefinitionUpdate": "enabled"
  },
  "features": {
    "offlineDefinitionUpdateVerifySig": "enabled"
  }
}

| offlineDefinitionUpdateUrl | String | URL value generated as part of the mirror server setup. This can be either in terms of the remote server URL or a directory (local/remote mount point). See Host the offline security intelligence updates on the mirror server for information about how to specify this path.| | offlineDefinitionUpdate | enabled/disabled | When set to enabled, the offline security intelligence update feature is enabled, and vice versa. | | offlineDefinitionUpdateFallbackToCloud | True/False | Determine Defender for Endpoint security intelligence update approach when offline mirror server fails to serve the update request. If set to true, the update is retried via the Microsoft cloud when offline security intelligence update failed; else, vice versa. | |

Engine signature verification

Starting with release 101.26062.0005, Defender for Endpoint on Linux verifies the antivirus engine's digital signature before loading it. This default-on behavior helps protect your devices against tampered or unsigned engine files.

What you need to know

  • Signature verification is enabled automatically on new installations and upgrades. No separate action is required.
  • If an engine file fails signature verification, Defender for Endpoint doesn't load it.
  • The offlineDefinitionUpdateVerifySig | enabled/disabled | When set to enabled, downloaded definitions are verified on the endpoints; else, vice versa. This setting is deprecated and no longer has any effect. If your managed configuration uses this setting, no replacement action is required because engine signature verification is enabled by default starting from version 101.25092.0005,default.

Run the following commands to view the signature verification state:

mdatp health --details definitions
mdatp health --details features

The relevant fields appear in both command outputs:

offline_definition_update_verify_sig : "DEPRECATED"
engine_signature_verification        : "enabled"

Values such as the definitions version, timestamps, and therefore is not available for configuration in the Defender portal. |update source URI vary by device.

Verify the configuration

To test if the settings are applied correctly on the Linux endpoints, run the following command: mdatp health --details definitions 


A sampleThe following example output would look likeshows the following code snippet:fields that confirm definitions were updated successfully and the offline update configuration is applied:

```console
user@vm:~$ mdatp health --details definitions
definitions_update_fail_reason              : ""
offline_definition_url_configured           : "http://172.XX.XXX.XX:8000/linux/production/" [managed]
offline_definition_update                   : "enabled" [managed]
offline_definition_update_verify_sig        : "DEPRECATED"
engine_signature_verification               : "enabled"
offline_definition_update_fallback_to_cloud : false[managed]

Automatic updates occur under the following conditions:

  • If the enforcement level for the antivirus engine is set to real_time, and the fields automaticDefinitionUpdateEnabled and offline_definition_update in the mdatp_managed.jsonmanaged jsonconfiguration file are set to true, then the offline security intelligence updates are triggered automatically at periodic intervals.
  • By default, this periodic interval is 8 hours. But it can be configured by setting the definitionUpdatesInterval parameter in the managed json.mdatp_managed.json file.

Manual update

To trigger the offline security intelligence update manually to download the signatures from the mirror server on the Linux endpoints, run the following command:command to force an immediate definition update from the configured source:

mdatp definitions update

1. Verify that the update was successful by running the command: `mdatp health --details --definitions`.

1. Verify the following fields:fields. The following sample output shows the definition health fields that indicate a successful update:

```console
user@vm:~$ mdatp health --details definitions

If updates fail, are stuck, or don't start, follow these steps to troubleshoot:

1. Check the status of offline security intelligence updates by usingupdates. Use the following command:command to review the current definition state and update source:

 ```bash
 mdatp health --details definitions

 Look for information in the `definitions_update_fail_reason` section.

1. Make sure that `offline_definition_update` and `offline_definition_update_verify_sig``engine_signature_verification` are enabled.

1. Make sure that `definitions_update_source_uri` is equal to `offline_definition_url_configured`.

 - `definitions_update_source_uri` is the source from where the signatures were downloaded.
 - `offline_definition_url_configured` is the source from where signatures should be downloaded, the one mentioned in the managed config file.

1. Try performing theRun a connectivity test to check ifconfirm the endpoint can reach the mirror server is reachable from the host:and required Defender services:

 ```bash
 mdatp connectivity test

  1. Try to initiate a manualIf connectivity succeeds, manually retry the definition update usingwith the following command:

    mdatp definitions update