Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Configure security settings in Microsoft Defender for Endpoint on Linux

4 September 2026New feature+68 / −41 lines

In brief

The article now documents four antivirus enforcement levels, including audit mode (Preview), states that passive is the default, and adds a command to verify the active level. Audit mode requires Defender for Endpoint version 101.26062.0007 or later.

What Defender admins need to know

Review Linux enforcement profiles and health checks to account for the passive default, audit mode, and the new antivirus_enforcement_level verification field.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure security settings in Microsoft Defender for Endpoint on Linux

You can use the command line to configure specific settings, gather diagnostics, run scans, and more. For more information, see Linux resources: Configure using command line.

Configure settings with Defender for Endpoint Security Settings Management

You can configure Defender for Endpoint on Linux in the Microsoft Defender portal at (Microsoft Defender portal) using Defender for Endpoint Security Settings Management. For more information, including how to create, edit, and verify security policies, see Use Microsoft Defender for Endpoint Security Settings Management to manage Microsoft Defender Antivirus.

ConfigurationUse a configuration profile to manage security settings

You can configure settings in Defender for Endpoint on Linux through a configuration profile that uses a .json file. After you set up your profile, you can deploy it by using your management tool of choice. Preferences managed by the enterprise take precedence over preferences set locally on the device.

In other words, users in your enterprise aren't able to change preferences that are set through this configuration profile. If exclusions were added through the managed configuration profile, they can only be removed through the managed configuration profile. The command line works for exclusions added locally.

This sectionThe following configuration profile guidance describes the structure of the Defender for Endpoint on Linux configuration profile, includes a recommended starter profile, and explains how to deploy it.

Configuration profile structure

Recommended configuration profile

This sectionThe following recommended configuration profile guidance includes two configuration profile examples:

  • Sample profile to help you get started with recommended settings.
  • Full configuration profile example for organizations who want more granular control over security settings.
Full configuration profile example

The following complete managed configuration profileexample contains entries for all settings described in this articlearticle, including antivirus engine, scheduled scan, cloud service, advanced feature, network protection, EDR, and exclusion settings. You can be useduse this profile for more advanced scenarios where you want more control.granular control over each setting. 

{

|Description|JSON Value|Defender portal value|
|---|---|---|
|**Key**|`antivirusEngine`enforcementLevel`|Antivirus Engine|Enforcement level|
|**Data type**|Dictionary (nested preference)String|Drop down|
|**Possible values**|Collapsed Section|`real_time`<br/>`audit`<br/>`on_demand`<br/>`passive`|Not configured<br/>Real-time<br/>Audit<br/>On-demand<br/>Passive|

For descriptions of the dictionary contents and policy properties, see [Enforcement level for Microsoft Defender Antivirus](#enforcement-level-for-microsoft-defender-antivirus), [Scan exclusions](#scan-exclusions), [Threat type settings](#threat-type-settings), and [Exclusion merge policy](#exclusion-merge-policy).

#### Enforcement level for Microsoft Defender Antivirus

Specifies the enforcement preference of the antivirus engine. There are threefour values for setting enforcement level:
Enforcement level Description
Real-time Actively monitors, detects, and remediates threats in real time.
Audit(Preview) Actively monitors and detects threats in real time without automatically remediating them.
On-demand Detects and remediates threats only during manual or scheduled scans.
Passive Doesn't provide real-time threat detection. Threats can still be detected during manual or scheduled scans.
Verify the enforcement level

To verify the active antivirus enforcement level, run: 

mdatp health --field antivirus_enforcement_level

The command returns the active enforcement level (real_time, audit, on_demand, or passive).