You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-exclusions.md
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Provide and validate exclusions for Microsoft Defender for Endpoint
4
4
ms.service: defender-endpoint
5
5
ms.author: ewalsh
6
6
author: emmwalshh
7
-
ms.reviewer: gopkr, ardeshmukh
7
+
ms.reviewer: ratujdange, ardeshmukh
8
8
ms.localizationpriority: medium
9
9
manager: deniseb
10
10
audience: ITPro
@@ -15,7 +15,7 @@ ms.collection:
15
15
ms.topic: conceptual
16
16
ms.subservice: linux
17
17
search.appverid: met150
18
-
ms.date: 03/28/2025
18
+
ms.date: 06/06/2025
19
19
---
20
20
21
21
# Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
@@ -32,7 +32,7 @@ ms.date: 03/28/2025
32
32
This article provides information on how to define antivirus and global exclusions for Microsoft Defender for Endpoint. Antivirus exclusions apply to on-demand scans, real-time protection (RTP), and behavior monitoring (BM). Global exclusions apply to real-time protection (RTP), behavior monitoring (BM), and endpoint detection and response (EDR), thus stopping all the associated antivirus detections, EDR alerts, and visibility for the excluded item.
33
33
34
34
> [!IMPORTANT]
35
-
> The antivirus exclusions described in this article apply to only antivirus capabilities and not to endpoint detection and response (EDR). Files that you exclude using the antivirus exclusions described in this article can still trigger EDR alerts and other detections. Global exclusions described in this section apply to antivirus **and** endpoint detection and response capabilities, thus stopping all associated antivirus protection, EDR alerts, and detections. Global exclusions are currently in public preview, and are available in Defender for Endpoint version `101.23092.0012` or later, in the Insiders Slow and Production rings. For EDR exclusions, [contact support](/microsoft-365/admin/get-help-support).
35
+
> The antivirus exclusions described in this article apply to only antivirus capabilities, and not to endpoint detection and response (EDR). Files that you exclude by using the antivirus exclusions described in this article can still result in EDR alerts and other detections. Global exclusions described in this section apply to antivirus and EDR capabilities, thus stopping all associated antivirus protection, EDR alerts, and detections. Global exclusions are available in production for Defender for Endpoint on Linux, version `101.23092.0012` or later. For EDR-only exclusions, [contact support](/microsoft-365/admin/get-help-support).
36
36
37
37
You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Linux.
38
38
@@ -87,7 +87,7 @@ Wildcard|Description|Examples|
87
87
88
88
## How to configure the list of exclusions
89
89
90
-
You can configure exclusions using a management Json configuration, Defender for Endpoint security settings management, or the command line.
90
+
You can configure exclusions using a management JSON configuration, Defender for Endpoint security settings management, or the command line.
91
91
92
92
### Using the management console
93
93
@@ -141,7 +141,6 @@ In enterprise environments, exclusions can also be managed through a configurati
141
141
### Using Defender for Endpoint security settings management
142
142
143
143
> [!NOTE]
144
-
> This method is currently in private Preview. To enable this feature, please reach out to [email protected].
145
144
> Make sure to review the prerequisites: [Defender for Endpoint security settings management prerequisites](/mem/intune/protect/mde-security-integration#prerequisites)
146
145
147
146
You can use the Microsoft Intune admin center or the Microsoft Defender portal to manage exclusions as endpoint security policies and assign those policies to Microsoft Entra ID groups. If you're using this method for the first time, make sure to complete the following steps:
0 commit comments