Audit mode for the Microsoft Defender Antivirus template for Linux

What changed

When you set Enforcement level to Audit , the antivirus engine detects threats in real time but doesn't automatically remediate them. Malware detections are reported as alerts in the Microsoft Defender portal through real-time scanning, without quarantining the malicious files.

Why it matters

The change can alter security posture, authentication, exposure or compatibility and therefore needs an owned validation path.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Map the announced change to affected Intune workloads and supported platforms
• Pilot the exact profile, app or device action named by Microsoft
• Review policy, app, enrollment and support reports before rollout