From 25a195a98a979cd6f77c6e194ec3896caba5e8c6 Mon Sep 17 00:00:00 2001 From: jayeshgohil-microsoft Date: Wed, 6 Aug 2025 13:38:08 +0530 Subject: [PATCH] Update mde-linux-prerequisites.md for fapolicyd support FAPolicyD and MDE Linux can co-exist and it is evaluated with recent efforts. --- defender-endpoint/mde-linux-prerequisites.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/defender-endpoint/mde-linux-prerequisites.md b/defender-endpoint/mde-linux-prerequisites.md index 1cf689f060..575bc8a669 100644 --- a/defender-endpoint/mde-linux-prerequisites.md +++ b/defender-endpoint/mde-linux-prerequisites.md @@ -121,8 +121,10 @@ The following Linux server distributions and x64 (AMD64/EM64T) versions are supp > [!WARNING] > Running Defender for Endpoint on Linux with other fanotify-based security solutions isn't supported. It can lead to unpredictable results, including hanging the operating system. -> If there are any other applications on the system that use fanotify in blocking mode, applications are listed in the conflicting_applications field of the mdatp health command output. -> The Linux FAPolicyD feature uses fanotify in blocking mode, and is therefore unsupported when running Defender for Endpoint in active mode. You can still safely take advantage of Defender for Endpoint on Linux EDR functionality after configuring the antivirus functionality Real Time Protection Enabled to passive mode. See [Enforcement level for Microsoft Defender Antivirus](/defender-endpoint/linux-preferences#enforcement-level-for-microsoft-defender-antivirus). +> If there are any other applications on the system that use fanotify in blocking mode, applications are listed in the conflicting_applications field of the mdatp health command output. +> You can still safely take advantage of Defender for Endpoint on Linux EDR functionality after configuring the antivirus functionality Real Time Protection Enabled to passive mode. See  [Enforcement level for Microsoft Defender Antivirus](/defender-endpoint/linux-preferences#enforcement-level-for-microsoft-defender-antivirus). +> +> **The Linux FAPolicyD is an exception in this. It is supported with Linux Defender for Endpoint on RHEL & FEDORA platforms.** ## Supported filesystems for real-time protection and quick, full, and custom scans |Real-time protection and quick/full scans|Custom scans|