Supported Microsoft Defender for Endpoint capabilities by platform

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

Learn how to Onboard devices and configure Microsoft Defender for Endpoint capabilities.

The following table gives information about the supported Microsoft Defender for Endpoint capabilities by platform.

Operating System Windows 10 & 11 Windows Server 2012 R2 [1],
2016 [1],
2019 & 2022,
1803+
macOS Linux
Prevention
Attack Surface Reduction Yes. Yes. No No
Device Control Yes. No Yes. No
Firewall Yes. Yes. No No
Network Protection Yes. Yes. Yes. Yes. [2]
Next-generation protection Yes. Yes. Yes. Yes.
Tamper Protection Yes. Yes. Yes. No
Web Protection Yes. Yes. Yes. Yes. [2]
Detection
Advanced Hunting Yes. Yes. Yes. Yes.
Custom file indicators Yes. Yes. Yes. Yes.
Custom network indicators Yes. Yes. Yes. Yes. [2]
EDR Block Yes. Yes. No No
Passive Mode Yes. Yes. Yes. Yes.
Sense detection sensor Yes. Yes. Yes. Yes.
Endpoint & network device discovery Yes. Yes. [5] No No
Vulnerability management Yes. Yes. Yes. Yes. [6]
Response
Automated Investigation & Response (AIR) Yes. Yes. No No
Device response capabilities: collect investigation package Yes. Yes. Yes. [3] Yes. [3]
Device response capabilities: run antivirus scan Yes. Yes. Yes. Yes.
Device isolation Yes. Yes. Yes. Yes.
File response capabilities: collect file, deep analysis, block file, stop, and quarantine processes Yes. Yes. Yes. [4] Yes. [4]
Live Response Yes. Yes. Yes. Yes.

[1] Refers to the modern, unified solution for Windows Server 2012 R2 and Windows Server 2016. For more information, see Onboard Windows Servers to the Defender for Endpoint service.

[2] Feature is currently in preview (Microsoft Defender for Endpoint preview features).

[3] Feature is currently in preview (Microsoft Defender for Endpoint preview features). Or you can also use Live Response [2].

[4] Collect file only. Or, you can use Live Response [2].

[5] Endpoint & network device discovery is supported on Windows Server 2019 or later, Windows 10, and Windows 11.

[6] Microsoft Defender Vulnerability Management is not supported on Rocky and Alma currently.

Note

Windows 7, 8.1, Windows Server 2008 R2 include support for the EDR sensor, and antivirus using System Center Endpoint Protection (SCEP).

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.