Microsoft Defender for Endpoint
Endpoint protection

Microsoft Defender Endpoint Releases

In brief

Cloned Linux virtual machines are now correctly identified as unique Defender for Endpoint devices. SIGILL crashes on processors without SSE4.1 support were fixed, along with general reliability improvements.

What Defender admins need to know

No administrator action is stated; affected Linux deployments should experience more accurate device identification and improved stability.

Summaries are generated from the documentation change itself.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

Feature area Update summary
Device identity Fixed an issue where cloned Linux virtual machines could retain the source image's machine identifier, causing multiple endpoints to appear with the same Microsoft Defender for Endpoint device identity.Each cloned endpoint is now correctly identified as a unique device.
Bug fix Fixed SIGILL crashes on systems with processors that don't support SSE4.1. The crashes were caused by bundled open-source libraries.
GeneralReliability and quality improvements.

Linux | September 2026 | 101.26072.0005