title: Supported Microsoft Defender for Endpoint capabilities by platform description: Get to know the Microsoft Defender for Endpoint capabilities supported for Windows 10 devices, servers, and non-Windows devices. ms.service: defender-endpoint ms.author: painbar author: paulinbar ms.reviewer: pahuijbr ms.localizationpriority: medium manager: bagol audience: ITPro ms.collection:
- m365-security
- tier2
ms.topic: article
ms.subservice: onboard
search.appverid: met150
ms.date: 11/17/2025
appliesto:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
Learn how to Onboard devices and configure Microsoft Defender for Endpoint capabilities.
The following table gives information about the supported Microsoft Defender for Endpoint capabilities by platform.
| Operating System | Windows 10 & 11 | Windows Server | macOS | Linux |
|---|---|---|---|---|
| Prevention | ||||
| Attack Surface Reduction |  |
|
 |
|
| Device Control | |
|
|
|
| Firewall | |
|
|
|
| Network Protection | |
|
|
(preview) |
| Next-generation protection | |
|
|
|
| Tamper Protection | |
|
|
|
| Web Protection | |
|
|
(preview) |
| Detection | ||||
| Advanced Hunting | |
|
|
|
| Custom file indicators | |
|
|
|
| Custom network indicators | |
|
|
(preview) |
| EDR Block | |
|
|
|
| Passive Mode | |
|
|
|
| Sense detection sensor | |
|
|
|
| Endpoint & network device discovery | |
(See note below) |
|
|
| Vulnerability management | |
|
|
|
| Response | ||||
| Automated Investigation & Response (AIR) | |
|
|
|
| Device response capabilities: collect investigation package | |
|
|
|
| Device response capabilities: run antivirus scan | |
|
|
|
| Device isolation | |
|
|
|
| File response capabilities: collect file, deep analysis | |
|
|
|
| File response capabilities: block file, stop, and quarantine processes | |
|
|
|
| Live Response | |
|
|
|
Note
- For Windows Server 2012 R2 and Windows Server 2016, use the modern, unified solution. See Onboard Windows Servers to the Defender for Endpoint service.
- On Linux Server, network protection, web protection, and custom network indicators are currently in preview.
- On Linux, network protection, web protection, and custom network indicators are currently in preview.
- Endpoint & network device discovery is supported on Windows Server 2019 or later, and on Windows 10 and Windows 11.
- For Windows 7, Windows 8.1, and Windows Server 2008 R2, use MMA for the EDR sensor and System Center Endpoint Protection (SCEP) for antivirus protection.
- For Windows 7 SP1 and Windows Server 2008 R2 SP1, you can also use Microsoft Defender endpoint security solution (preview) supplied by the Defender deployment tool (preview).