Microsoft Defender can now isolate compromised Linux endpoints

Microsoft announced today that it added device isolation support to Microsoft Defender for Endpoint (MDE) on onboarded Linux devices.

Enterprise admins can manually isolate Linux machines enrolled as part of a public preview using the Microsoft 365 Defender portal or .

Once isolated, threat actors will no longer have a connection to the breached system, cutting off their control and blocking malicious activity like data theft.

“Some attack scenarios may require you to isolate a device from the network. This action can help prevent the attacker from controlling the compromised device and performing further activities such as data exfiltration and lateral movement,” Microsoft explained.

“Just like in Windows devices, this device isolation feature disconnects the compromised device from the network while retaining connectivity to the Defender for Endpoint service, while continuing to monitor the device.”

Isolated devices can be reconnected to the network as soon as the threat has been mitigated using the “Release from isolation” button on the device page or an ‘unisolate’ HTTP API request.

This new feature is supported on all MDE Linux-supported distros listed on the page.

​On Linux endpoints, Microsoft Defender for Endpoint is a command-line product with antimalware and EDR (endpoint detection and response) capabilities designed to send all threat info it detects to the Microsoft 365 Defender portal.

Admins with MDE subscriptions can deploy and configure it on Linux devices or with the help of Puppet, Ansible, and the Chef configuration management tools.

The enterprise endpoint security solution was in June 2020 after , with support for several Linux server distributed versions.

Two years ago, Microsoft also announced the addition of for Linux devices in Microsoft Defender for Endpoint and included support for identifying and on enterprise networks.

The same year, MDE’s were also made generally available on Linux servers following a public preview stage that .