Linux | August 2025 | Platform: 101.25062.0003
Analysis / inference: Microsoft released Defender for Endpoint on Linux platform version 101.25062.0003 featuring custom installation paths, root requirements for quarantines, and Fapolicyd compatibility.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Endpoint releases · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
The new Linux platform release introduces preview support for custom installation paths, restricts the mdatp threat quarantine add command to root users, permits live custom definition path updates without stopping the service, and adds Fapolicyd compatibility for RHEL and Fedora distributions.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisAdministrators managing Linux security agents need to adjust deployment and permission workflows to align with new root requirements for threat quarantine and custom installation paths.
Enables running EDR and antivirus alongside Fapolicyd without conflict and reduces downtime during definition path updates, while tightening quarantine command execution to superuser accounts.
Section 03 · Recommended actions
- Review automation calling the mdatp threat quarantine add command to ensure proper root execution context.
- Evaluate the custom installation path preview features for specific Linux distribution layouts.
- Validate compatibility if running Fapolicyd on RHEL or Fedora distributions alongside Defender for Endpoint.
- Verify installer scripts for custom location preview deployments
- Check automation scripts utilizing mdatp threat quarantine add for root privilege compliance
- Review configuration management for live updates of custom definition paths