Microsoft Defender for Endpoint expands support to Linux workstations

Microsoft has announced that Microsoft Defender for Endpoint now supports Linux workstations, expanding its protection capabilities beyond Linux servers. The update includes compatibility with several distributions, such as Ubuntu, Fedora, and Debian.

The expansion specifically targets developers and technology professionals. Microsoft noted that these workstations are high-value targets because they often provide access to sensitive assets, including source code repositories, CI/CD pipelines, cloud infrastructure, and containers. A compromise of a developer's workstation could serve as an anchor point for attackers to infiltrate an organization's software delivery pipelines.

The workstation agent uses the same technology as the server version, allowing organizations to use existing deployment methods like Ansible, Chef, or Puppet. The EDR (Endpoint Detection and Response) system automatically determines whether a machine is a server or a workstation by evaluating system metadata, distribution information, and desktop-related signals. If these signals are inconclusive, the device is classified as a server by default.