Linux | February 2026 | 101.25122.0004
Analysis / inference: Microsoft released Defender for Endpoint on Linux version 101.25122.0004, introducing new network configuration URL requirements, username preservation for login events, and improved log validation diagnostics.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Endpoint releases · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
The February 2026 update adds specific required cloud configuration URLs for commercial, DoD, GCC High, and GCC Mod environments, preserves username data for login events involving nonexistent users, and refines log file permission validation logic for mdatp health reporting.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisNetwork configuration requirements for Defender for Endpoint on Linux have been updated, requiring explicit firewall or proxy allowlisting of new cloud configuration endpoints to maintain agent connectivity.
Failure to update network allowlists for the newly specified URLs will prevent Linux endpoints from receiving internal configurations from the cloud.
Section 03 · Recommended actions
- Update network firewall and proxy allowlists with the configuration URL specific to your tenant type.
- Review updated MDE on Linux documentation for comprehensive streamlined connectivity URL requirements.
- Verify egress firewall and proxy rules allow the tenant-appropriate configuration URL such as https://config.edge.skype.com/config/v1 for commercial customers.