Microsoft Defender for Endpoint
Endpoint protectionWhats New In Microsoft Defender Endpoint
In brief
The documentation adds antivirus audit mode for Linux as generally available. It provides real-time malware detection and alerting without automatically quarantining files or terminating processes.
What Defender admins need to know
Administrators can evaluate malware detections and alerts without automatic remediation.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Type | Feature | Preview/GA | Description |
|---|---|---|---|
| Feature | Antivirus audit mode for Linux | GA | Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement.Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later. |
| Release - macOS | Build 101.26092.0009 | GA | Release version 20.126092.9.0 released: See enhancements and features for this release. |
| Release - macOS | Build 101.26082.0012 | GA | Release version 20.126082.12.0 released: See enhancements and features for this release. |
| Feature | Vulnerability assessment for Microsoft Store applications | GA | Vulnerability assessment for applications installed via the Microsoft Store is now generally available. Defender Vulnerability Management detects supported Microsoft Store applications, adds them to the software inventory, and assesses them for vulnerabilities. Coverage is currently limited to a select set of commonly used applications. Use the Software evidence area on the software page to view the file path for the vulnerable application, along with a suggested query showing the vulnerable app, version, and file location. |
@@ -58,6 +58,7 @@ Learn more about [Preview features](/en-us/defender-xdr/preview).
| Type | Feature | Preview/GA | Description |
| --- | --- | --- | --- |
+| Feature | [Antivirus audit mode for Linux](linux-preferences#antivirus-antimalware-and-edr-settings-in-defender-for-endpoint-on-linux) | GA | Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement.**Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007 or later.** |
| Release - macOS | Build 101.26092.0009 | GA | Release version 20.126092.9.0 released: See [enhancements and features for this release](microsoft-defender-endpoint-releases#macos--october-2026--101260920009). |
| Release - macOS | Build 101.26082.0012 | GA | Release version 20.126082.12.0 released: See [enhancements and features for this release](microsoft-defender-endpoint-releases#macos--october-2026--101260820012). |
| Feature | [Vulnerability assessment for Microsoft Store applications](/en-us/defender-vulnerability-management/tvm-software-inventory#microsoft-store-applications) | GA | Vulnerability assessment for applications installed via the Microsoft Store is now generally available. Defender Vulnerability Management detects supported Microsoft Store applications, adds them to the software inventory, and assesses them for vulnerabilities. Coverage is currently limited to a select set of commonly used applications. Use the **Software evidence** area on the software page to view the file path for the vulnerable application, along with a suggested query showing the vulnerable app, version, and file location. |