|
| 1 | +--- |
| 2 | +title: Enabling deployment of Microsoft Defender for Endpoint for Linux to a custom location |
| 3 | +description: Describes how to deploy Microsoft Defender for Endpoint on Linux to a custom location instead of the default location. |
| 4 | +ms.service: defender-endpoint |
| 5 | +ms.author: painbar |
| 6 | +author: paulinbar |
| 7 | +ms.reviewer: meghapriya |
| 8 | +ms.localizationpriority: medium |
| 9 | +manager: orspodek |
| 10 | +audience: ITPro |
| 11 | +ms.collection: |
| 12 | +- m365-security |
| 13 | +- tier3 |
| 14 | +- mde-linux |
| 15 | +ms.topic: install-set-up-deploy |
| 16 | +ms.subservice: linux |
| 17 | +search.appverid: met150 |
| 18 | +ms.date: 08/18/2025 |
| 19 | +--- |
| 20 | + |
| 21 | +# Enabling deployment of Microsoft Defender for Endpoint to a custom location (preview) |
| 22 | + |
| 23 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] |
| 24 | + |
| 25 | +**Applies to:** |
| 26 | + |
| 27 | +- Microsoft Defender for Endpoint for servers |
| 28 | + |
| 29 | +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630&clcid=0x409&culture=&country=us) |
| 30 | +
|
| 31 | +## Introduction |
| 32 | + |
| 33 | +Microsoft Defender for Endpoint on Linux supports installation to custom locations, allowing organizations to deploy the agent to nonstandard locations based on their specific requirements. This feature is useful for environments that have: |
| 34 | + |
| 35 | +- Custom directory structures and organizational policies |
| 36 | +- Limited space on the root filesystem |
| 37 | +- Specific compliance requirements for application placement |
| 38 | + |
| 39 | +By default, Defender for Endpoint installs to the directory `/opt/microsoft/mdatp`. With custom location installation, you can choose a different base directory during the initial setup. Defender for Endpoint then uses its same internal folder structure in your specified location. After installation, the chosen location remains fixed, and subsequent upgrades will keep using your original custom location. Changing the installation location later isn't supported. If you need to use a different location, you have to uninstall Defender for Endpoint and then reinstall it to the new location. |
| 40 | + |
| 41 | +## Prerequisites and system requirements |
| 42 | + |
| 43 | +Before deploying Defender for Endpoint to a custom location, be sure the following requirements are met: |
| 44 | + |
| 45 | +### Prerequisites |
| 46 | + |
| 47 | +- The custom installation directory and its entire tree must have at least `rwxr-xr-x` (755) permissions. |
| 48 | + |
| 49 | +- The target location must have adequate disk space (minimum 2 GB, more for high-performance workloads). |
| 50 | + |
| 51 | +- If SELinux is enabled, the `semanage` tool must be installed to set the correct file context for the custom location. |
| 52 | + |
| 53 | +- For reasons of security and reliability, it's highly recommended to install to a location on a persistent, permanently-mounted local filesystem. Avoid using removable media, network mounts, or filesystems that could be unmounted during system operation, as this can cause Microsoft Defender for Endpoint service failures and create security risks. |
| 54 | + |
| 55 | +### Supported distributions and feature availability |
| 56 | + |
| 57 | +- Custom location installation is supported on all [supported Linux distributions](mde-linux-prerequisites.md#supported-linux-distributions) for both x64 and ARM64 architectures. |
| 58 | + |
| 59 | +- The custom location feature is available starting from version **101.25062.0003** of Defender for Endpoint on Linux. |
| 60 | + |
| 61 | +## Steps for installing to a custom location |
| 62 | + |
| 63 | +This section describes the additional steps required for deploying Defender for Endpoint to a custom location, using various supported methods. |
| 64 | + |
| 65 | +- **Installer script**: |
| 66 | + |
| 67 | + The recommended method is to run the `mde_installer.sh` script with the `--install-path /your/custom/path` option at the time of installation. For details, see the [installer script deployment guide](linux-installer-script.md). |
| 68 | + |
| 69 | +- **Third-party automation tools**: |
| 70 | + |
| 71 | + Solutions such as Ansible, Chef, Puppet, and SaltStack can automate deployment by running the `mde_installer.sh` script with the `--install-path /your/custom/path` option at the time of installation. For details, see the [installer script deployment guide](linux-installer-script.md). |
| 72 | + |
| 73 | +- **Manual installation**: |
| 74 | + |
| 75 | + If you prefer manual setup, you must perform additional preinstallation steps to prepare your custom location. See the [next section](#manual-installation-preinstallation-setup) for step-by-step instructions. |
| 76 | + |
| 77 | +### Manual installation: preinstallation setup |
| 78 | + |
| 79 | +In the [manual deployment steps](linux-install-manually.md#manual-deployment-steps), you need to complete an additional preinstallation setup to enable custom location installation. Follow the steps below as part of the [preinstall setup for custom location installation](linux-install-manually.md#preinstall-setup-for-custom-location-installation). |
| 80 | + |
| 81 | +1. **Set your custom path variable**: |
| 82 | + |
| 83 | + > [!NOTE] |
| 84 | + > The custom path must be an absolute path (for example, `/your/custom/path`). Relative paths aren't supported. |
| 85 | +
|
| 86 | + ```bash |
| 87 | + export CUSTOM_PATH="/your/custom/path" |
| 88 | + ``` |
| 89 | + |
| 90 | +1. **Create required directories and config file**: |
| 91 | + |
| 92 | + ```bash |
| 93 | + sudo mkdir -p "${CUSTOM_PATH}" |
| 94 | + sudo mkdir -p /etc/opt/microsoft/mdatp |
| 95 | + echo '{"path": "'${CUSTOM_PATH}'"}' | sudo tee /etc/opt/microsoft/mdatp/mde_path.json |
| 96 | + ``` |
| 97 | + |
| 98 | +1. **Set permissions**: |
| 99 | + |
| 100 | + ```bash |
| 101 | + sudo chmod 755 "${CUSTOM_PATH}" |
| 102 | + sudo chmod 644 /etc/opt/microsoft/mdatp/mde_path.json |
| 103 | + ``` |
| 104 | + |
| 105 | +1. **Create symlink**: |
| 106 | + |
| 107 | + ```bash |
| 108 | + sudo ln -sf "${CUSTOM_PATH}/opt/microsoft/mdatp" /opt/microsoft/mdatp |
| 109 | + ``` |
| 110 | + |
| 111 | +Then proceed with the standard installation steps for your distribution. |
| 112 | + |
| 113 | +## Upgrade and maintenance |
| 114 | + |
| 115 | +Upgrades for Defender for Endpoint installed in a custom location work the same as standard installations - the installer automatically preserves your existing location and configuration. |
| 116 | + |
| 117 | +> [!IMPORTANT] |
| 118 | +> Changing the installation path during an upgrade isn't supported. If you need to change the installation path, you must first uninstall Defender for Endpoint and then reinstall it to the new location. |
| 119 | +
|
| 120 | +## Frequently asked questions |
| 121 | +
|
| 122 | +**Can I install Defender for Endpoint to any directory?** |
| 123 | +Yes, as long as the path to the installation location is an absolute path with at least 755 permissions and enough space (minimum 2 GB). |
| 124 | +
|
| 125 | +**Can I change the Defender for Endpoint installation location after installation?** |
| 126 | +No, you must uninstall and reinstall to use a different location. |
| 127 | +
|
| 128 | +**How do I upgrade Defender for Endpoint in a custom location?** |
| 129 | +Run the usual upgrade commands. The installation location remains unchanged. |
| 130 | +
|
| 131 | +**Can I change the custom location during upgrade?** |
| 132 | +No, installation location changes require a fresh install. |
| 133 | +
|
| 134 | +## Troubleshooting |
| 135 | +
|
| 136 | +### 1. Verify the installation location |
| 137 | +
|
| 138 | +- **Check running processes:** |
| 139 | +
|
| 140 | + Run: `ps aux | grep wdavdaemon`. The output should contain wdavdaemon process paths for microsoft_mdatp. For example: |
| 141 | +
|
| 142 | + ``` |
| 143 | + root 747798 0.3 1.5 1037180 154336 ? Ssl 12:26 0:21 /var/tmp/TestInstall/microsoft_mdatp/opt/microsoft/mdatp/sbin/wdavdaemon |
| 144 | + root 747844 0.0 0.8 945692 79676 ? Sl 12:26 0:04 /var/tmp/TestInstall/microsoft_mdatp/opt/microsoft/mdatp/sbin/wdavdaemon edr 16 15 --log_level info |
| 145 | + ``` |
| 146 | +
|
| 147 | +- **Check service status:** |
| 148 | +
|
| 149 | + Run: `systemctl status mdatp` |
| 150 | + |
| 151 | + ``` |
| 152 | + ● mdatp.service - Microsoft Defender |
| 153 | + Loaded: loaded (/lib/systemd/system/mdatp.service; enabled; vendor preset: enabled) |
| 154 | + Active: active (running) since ... |
| 155 | + Main PID: 747798 (wdavdaemon) |
| 156 | + ... |
| 157 | + CGroup: /system.slice/mdatp.service |
| 158 | + ‣ 747798 /var/tmp/TestInstall/microsoft_mdatp/opt/microsoft/mdatp/sbin/wdavdaemon |
| 159 | + ``` |
| 160 | +
|
| 161 | +- **Check the custom installation path in the *mde_path.json* file:** |
| 162 | +
|
| 163 | + - Primary: `/etc/opt/microsoft/mdatp/mde_path.json` |
| 164 | + - Example: `{"path": "/var/tmp/TestInstall/microsoft_mdatp"}` |
| 165 | + - If missing or malformed, Microsoft Defender for Endpoint fallbacks to the secondary file. |
| 166 | + - Secondary: `<custom_installation_path>/opt/microsoft/mdatp/conf/mde_path.json` |
| 167 | + - Should match the primary config. |
| 168 | + - This file is created at installation time. |
| 169 | + - Inconsistencies may indicate installation corruption. |
| 170 | + - Ensure the path is absolute. |
| 171 | +
|
| 172 | +### 2. Verify the symlink to the custom location |
| 173 | +
|
| 174 | +Run: `ls -ltr /opt/microsoft/mdatp`. The output should show `/opt/microsoft/mdatp` as a symlink to your custom location. For example: |
| 175 | +
|
| 176 | +``` |
| 177 | +lrwxrwxrwx 1 root root ... /opt/microsoft/mdatp -> /var/tmp/TestInstall/microsoft_mdatp/opt/microsoft/mdatp |
| 178 | +``` |
| 179 | +
|
| 180 | +## Related content |
| 181 | +
|
| 182 | +- [Prerequisites for Defender for Endpoint on Linux](mde-linux-prerequisites.md) |
| 183 | +
|
| 184 | +- Deployment methods: |
| 185 | + - [Installer script based deployment](linux-installer-script.md) |
| 186 | + - [Ansible based deployment](linux-install-with-ansible.md) |
| 187 | + - [Chef based deployment](linux-deploy-defender-for-endpoint-with-chef.md) |
| 188 | + - [Puppet based deployment](linux-install-with-puppet.md) |
| 189 | + - [Saltstack based deployment](linux-install-with-saltack.md) |
| 190 | + - [Connect your non-Azure machines to Defender for Cloud with Defender for Endpoint](/azure/defender-for-cloud/onboard-machines-with-defender-for-endpoint) (direct onboarding using Defender for Cloud) |
| 191 | + - [Deployment guidance for Defender for Endpoint on Linux for SAP](mde-linux-deployment-on-sap.md) |
| 192 | + - [Deploy Defender for Endpoint on Linux manually](linux-install-manually.md) |
| 193 | +
|
| 194 | +[!INCLUDE [Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)] |
![m365-skilling-repo-management[bot]](https://avatars.githubusercontent.com/in/1161012?v=4&size=40){kind=avatar}
0 commit comments