Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP

4 September 2026Feature update+63 / −96 lines

In brief

The Linux-on-SAP guidance was revised, including terminology and supported-distribution wording. The explicit requirement for Microsoft Defender for Endpoint build 101.24082.0004 or later is no longer present.

What Defender admins need to know

Review deployment standards and confirm the Defender build requirements used in your SAP environments. No administrator action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP

This article provides deployment guidance for Microsoft Defender for Endpoint on Linux for SAP. This articleSAP includes recommended SAP OSS (Online Services System) notes, the system requirements, prerequisites, important configuration settings, recommended antivirus exclusions, and guidance on scheduling antivirus scans.

Conventional security defenses that have been commonly used to protect SAP systems, such as isolating infrastructure behind firewalls and limiting interactive operating system logons, are no longer considered sufficient to mitigate modern sophisticated threats. It's essential to deploy modern defenses to detect and contain threats in real-real time. SAP applicationsapplications, unlike most other workloadsworkloads, require basic assessment and validation before deployingyou deploy Microsoft Defender for Endpoint. The enterprise security administrators should contact the SAP Basis team before deploying Defender for Endpoint. The SAP Basis Team should be cross cross-trained with a basic level of knowledge about Defender for Endpoint.

Recommended SAP OSS Notesnotes

SAP Applicationsapplications on Linux

Here are some important pointpoints about SAP applications on Linux Server:

  • SAP only supports SUSE, Redhat,Red Hat, and Oracle Linux. Other distributions aren't supported for SAP S4 or NetWeaver applications.
  • SUSE 15.x, RedhatRed Hat 9.xx, and Oracle Linux 9.x are recommended. The supported distributions include all common Linux distributions but not SUSE 12.x.
  • SUSE 11.x, RedhatRed Hat 6.xx, and Oracle Linux 6.x aren't supported.
  • RedhatRed Hat 7.x and 8.x, and Oracle Linux 7.x and 8.x are technically supported, but are no longer tested in combination with SAP software.
  • SUSE and RedhatRed Hat offer tailored distributions for SAP. These "for SAP" versions of SUSE and RedhatRed Hat might have different packages preinstalled and possibly different kernels.
  • SAP only supports certain Linux File systems. In general, XFS and EXT3 are used. Oracle Automatic Storage Management (ASM) filesystem is sometimes used for Oracle DBMS and can't be read by Defender for Endpoint.
  • Some SAP applications use standalone engines, such as TREX, Adobe Document Server, Content Server, and LiveCache. These engines require specific configuration and file exclusions.
  • SAP applications often have Transport and Interface directories with many thousands of small files. If the number of files is larger than 100,000, it might and affect performance. It's recommended to archive files.
  • It's recommended to deploy Defender for Endpoint to nonproductive SAP landscapes for several weeks before deploying to production. The SAP Basis Team should use tools, such as sysstat, KSAR, and nmon to verify if CPU and other performance parameters are impacted. It's also possible to configure broad exclusions with the global scope parameter and then incrementally reduce the number of directories that are excluded.

Prerequisites for deploying Microsoft Defender for Endpoint on Linux on SAP VMs

As of December 2024, Defender for Endpoint on Linux can safely be configured with real-time protection enabled.

The default configuration option for deployment as an Azure Extension for Antivirus is passive mode. This means that Microsoft Defender Antivirus, the antivirus/anti-malwareantimalware component of Microsoft Defender for Endpoint, doesn't intercept IO calls. We recommend running Defender for Endpoint in with real-time protection enabled on all SAP applications. As such:

  • Real-time protection is turned on: Microsoft Defender Antivirus intercepts IO calls in real time.
  • On-demand scanning is turned on: You can use scan capabilities on the endpoint.
  • Automatic threat remediation is turned on: Files are moved and the security administrator is alerted.
  • Security intelligence updates are turned on: Alerts are available in the Microsoft Defender portal.

Online Kernelkernel patching tools, such as Ksplice or similar, can lead to unpredictable OS stability if Defender for Endpoint is running. It's recommended to temporarily stop the Defender for Endpoint daemon before performing online Kernelkernel patching. After the Kernelkernel is updated, Defender for Endpoint on Linux can be safely restarted. This action is especially important on large SAP HANA VMs with huge memory contexts.

When Microsoft Defender Antivirus is running with real-time protection, it's no longer required to schedule scans. You should run a scan at least once to set a baseline. Then, if necessary, the Linux crontab is typically used to schedule Microsoft Defender Antivirus scans and log rotation tasks. For more information, see How to schedule scans with Microsoft Defender for Endpoint (Linux).

Endpoint detection and response (EDR) functionality is active whenever Microsoft Defender for Endpoint on Linux is installed. EDR functionality can be disabled through command line or configuration by using global exclusions. For more information on troubleshooting EDR, see the sections Useful commands and Useful links (in this article).

Important configuration settings for Microsoft Defender for Endpoint on SAP on Linux

It's recommended to check the installation and configuration of Defender for Endpoint with the command mdatp health.

The key parameters recommended for SAP applications are as follows: 

healthy = true
release_ring = Production (Prerelease and insider rings shouldn't be used with SAP Applications.)
real_time_protection_enabled = true  (Real-time protection can be enabled for SAP NetWeaver applications and enables real-time IO interception.)
automatic_definition_update_enabled = true
definition_status = "up_to_date" (Run a manual update if a new value is identified.)
edr_early_preview_enabled = "disabled" (If enabled on SAP systems it might lead to system instability.)
conflicting_applications = [ ] (Other antivirus or security software installed on a VM such as Clam.)
supplementary_events_subsystem = "ebpf" (Don't proceed if ebpf isn't displayed. Contact the security admin team.)

For information about troubleshooting installation issues, see Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux.

Recommended Microsoft Defender for Endpoint Antivirus Exclusionsantivirus exclusions for SAP on Linux

Your enterprise security team must obtainshould get a full list of antivirus exclusions from the SAP Administratorsadministrators (typically the SAP Basis Team). It's recommended to initially exclude:

  • DBMS data files, log files, and temp files, including disks containing backup files
  • The entire contents of the SAPMNT directory
  • The entire contents of the SAPLOC directory
  • The entire contents of the TRANS directory
  • Hana –HANA: exclude /hana/shared, /hana/data, and /hana/log - seelog. See Note 17309301730930.
  • SQL Server –: Configure antivirus software to work with SQL Server
  • Oracle –: See How To Configure Anti-Virus On Oracle Database Server (Doc ID 782354.1).
  • DB2 –: IBM documentation: Which DB2 directories to exclude with antivirus software
  • SAP ASE –: contact SAPSAP.
  • MaxDB –: contact SAPSAP.
  • Adobe Document Server, SAP Archive Directories, TREX, LiveCache, Content Server, and other standalone engines must be tested carefully in nonproduction landscapes before deployingyou deploy Defender for Endpoint in production

Oracle ASM systems don't need exclusions as Microsoft Defender for Endpoint can't read ASM disks.

Customers with Pacemaker clusters should also configure these exclusions: 

mdatp exclusion folder add --path /usr/lib/pacemaker/  (for RedHat /var/lib/pacemaker/)


mdatp exclusion process add --name pacemakerd


mdatp exclusion process add --name pacemaker-controld

mdatp exclusion process add --name pacemaker-schedulerd

mdatp exclusion process add --name pacemaker-attrd

mdatp exclusion process add --name pacemaker-based

mdatp exclusion process add --name pacemaker-execd

mdatp exclusion process add --name pacemaker-fenced

mdatp exclusion process add --name crm_*

Customers running the Azure Security security policy might trigger a scan using the Freeware Clam AV solution. It's recommended to disable Clam AV scan after a VM has been protected with Microsoft Defender for Endpoint by using the following commands: 

sudo azsecd config  -s clamav -d "Disabled"


sudo service azsecd restart


sudo azsecd status

The following articles detail how to configure antivirus exclusions for processes, files, and folders per individual VM:

SchedulingSchedule a daily antivirus scan (optional)

The recommended configuration for SAP applications enables real-time interception of IO calls for antivirus scanning. The recommended setting is passive modereal-time protection, in which real_time_protection_enabled = true.

SAP applications running on older versions of Linux or on hardware that's overloaded might consider using real_time_protection_enabled = false. In this case, antivirus scans should be scheduled.

For more information, see How to schedule scans with Microsoft Defender for Endpoint (Linux).

Large SAP systems might have more than 20 SAP application servers, each with a connection to the SAPMNT NFS share. Twenty or more application servers simultaneously scanning the same NFS server will likely overload the NFS server. By default, Defender for Endpoint on Linux doesn't scan NFS sources.

If there's a requirement to scan SAPMNT, then this scan should be configured on one or two VMs only.

Scheduled scans for SAP ECC, BW, CRM, SCM, Solution Manager, and other components should be staggered at different times to avoidprevent all SAP components from overloading a shared NFS storage source shared by all SAP components.source.

Useful Commandscommands

If, during manual zypper installation on SUSE an error "Nothing provides 'policycoreutils'" occurs, see Troubleshoot installation issues for Microsoft Defender for Endpoint on Linux.

There are severalSeveral command-line commands that can control the operation of mdatp. To enable passive mode, you can use the following command: 

mdatp config passive-mode --value enabled

To turn on real-time protection, you can use the command: 

mdatp config real-time-protection --value enabled

This command tells mdatp to retrieve the latest definitions from the cloud: 

mdatp definitions update

This command tests whether mdatp can connect to the cloud-based endpoints on the network: 

mdatp connectivity test

These commands update the mdatp software, if needed: 

yum update mdatp

zypper update mdatp

Because mdatp runs as a Linux system service, you can control mdatp using the service command, for example: 

service mdatp status

This command creates a diagnostic file that can be uploaded to Microsoft support: 

sudo mdatp diagnostic create

Useful links

Related articles