Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Whats New In Microsoft Defender Endpoint

4 September 2026New feature+24 / −1 lines

In brief

The page now lists Linux memory scanning, WSL container plug-in support, Linux audit modes, Linux offboarding API support, Store application vulnerability assessment, the Linux Deployment Tool, and macOS releases, with Preview or GA status.

What Defender admins need to know

Administrators can review the linked details and status of these capabilities to assess their relevance to their environments.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Learn more about Preview features.

JulySeptember 2026

Type Feature Preview/GA Description
FeatureMemory scan for LinuxPreviewMemory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are increasingly challenging for security teams because they can execute directly in memory with little or no footprint on disk, making them more difficult to detect using traditional file-based scanning techniques. Memory Scan helps improve visibility into these threats and strengthens protection against sophisticated attack methods such as in-memory malware and malicious code injection.

Available in Defender version 101.26071.0005 or later in Insiders-slow channel.
FeatureMicrosoft Defender for Endpoint plug-in support for WSL containers (WSLc)PreviewExtend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping security teams investigate and respond to threats across both Windows and Linux workloads.

Available in Public Preview. To enroll, complete the registration form.

August 2026

TypeFeaturePreview/GADescription
FeatureTamper protection in audit mode for LinuxPreviewDetects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking the activity.

Available in Microsoft Defender for Endpoint on Linux version 101.26072.0004 or later in Insiders-slow channel.
FeatureAntivirus audit mode for LinuxPreviewProvides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement.

Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later.
FeatureOffboarding API support for LinuxGAEnables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale.

Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later.
Release - macOSBuild 101.26062.0012GARelease version 20.126062.12.0 released: See enhancements and features for this release.
FeatureVulnerability assessment for Microsoft Store applicationsPreviewYou can now monitor vulnerabilities on devices running Microsoft Store applications, including Microsoft Teams, Mozilla Firefox, WhatsApp, Slack, Dropbox, DuckDuckGo, Dell Command, HP Smart, HP Support Assistant, Dell SupportAssist for Home PCs, and NVIDIA Control Panel (see Microsoft Store applications for the full list). Use the Software evidence area in the software page to view the file path for the vulnerable application, along with a suggested query showing the vulnerable app, version, and file location.
Release - macOSBuild 101.26062.0011GARelease version 20.126062.11.0 released: See enhancements and features for this release.

July 2026

TypeFeaturePreview/GADescription
Release - macOSBuild 101.26062.0009GARelease version 20.126062.9.0 released: See enhancements and features for this release.
Release - iOS Build 1.1.78290102 GA Release version 1.1.78290102 released: See enhancements and features for this release.
Feature AI agent runtime protection updates Preview AI agent runtime protection includes these enhancements:

- Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI and the GitHub Copilot app.
- Network inspection is now supported for agents that don't expose vendor-supported event interfaces, including OpenClaw and similar Node.js-based Claw agents.

For more information, see AI agent runtime protection with Microsoft Defender for Endpoint.
Release - macOS Build 101.26052.0016 GA Release version 20.126052.16.0 released: See enhancements and features for this release.
FeatureDefender Deployment Tool for LinuxGAAvailable from Defender for Endpoint on Linux version 101.26042.0011 and later.

The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation, supports custom installation paths, enables deployment of specific Defender versions from preferred update channels, and works seamlessly in environments that use local repositories.

In addition to a simplified deployment experience, customers can now gain complete visibility into deployment progress through Device Timeline integration, providing step-by-step installation, upgrade, and onboarding status, Advanced Hunting queries for fleet-wide deployment monitoring, and detailed error reporting, including deployment stage, status, exit code, and failure reason to simplify troubleshooting. These capabilities help administrators quickly identify deployment issues, track onboarding progress, and understand deployment outcomes across their Linux estate. Available from Defender version 101.26042.0011 onwards.

June 2026