Microsoft Intune
GeneralIn development - Microsoft Intune
In brief
The page date changed from July 27 to August 21, 2026, and the section describing a planned Audit value for the Microsoft Defender Antivirus template for Linux was removed.
What Intune admins need to know
Administrators tracking this planned capability will no longer find the entry on the in-development page. No action is specified.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
title: In development - Microsoft Intune
description: This article describes Microsoft Intune features that are in development.
ms.date: 07/27/08/21/2026
ms.topic: whats-new
ai-usage: ai-assisted
ms.reviewer: intuner
Linux
Audit mode for the Microsoft Defender Antivirus template for Linux
We'll soon add a new Audit value to the Enforcement level setting in the Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy. When you set Enforcement level to Audit, the antivirus engine detects threats in real time but doesn't automatically remediate them. Malware detections are reported as alerts in the Microsoft Defender portal through real-time scanning, without quarantining the malicious files. This gives you visibility into the threat landscape before you turn on full protection.
The Microsoft Defender Antivirus template for Linux is supported for devices managed by Intune, and for devices managed only by Defender through the Microsoft Defender for Endpoint security settings management scenario (MDE attach).
[!div class="checklist"] Applies to:
- Linux
Mark Windows devices noncompliant when prohibited AI agents are discovered
Automatically mark Windows devices as noncompliant when prohibited local AI agents, such as OpenClaw, are discovered on the device. As an admin, you'll be able to configure a list of prohibited agents in a Windows compliance policy. When a prohibited agent is detected, the device reports as noncompliant and Conditional Access takes effect. The device returns to a compliant state once the agent is removed.
@@ -1,7 +1,7 @@ --- title: In development - Microsoft Intune description: This article describes Microsoft Intune features that are in development.-ms.date: 07/27/2026+ms.date: 08/21/2026 ms.topic: whats-new ai-usage: ai-assisted ms.reviewer: intuner@@ -133,17 +133,6 @@ We're adding a new Microsoft Defender Updates template for Linux endpoint securi > > - Linux -### Audit mode for the Microsoft Defender Antivirus template for Linux<!-- 37284585 -->--We'll soon add a new **Audit** value to the **Enforcement level** setting in the Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy. When you set **Enforcement level** to **Audit**, the antivirus engine detects threats in real time but doesn't automatically remediate them. Malware detections are reported as alerts in the Microsoft Defender portal through real-time scanning, without quarantining the malicious files. This gives you visibility into the threat landscape before you turn on full protection.--The Microsoft Defender Antivirus template for Linux is supported for devices [managed by Intune](../device-configuration/endpoint-security/antivirus.md), and for devices managed only by Defender through the [Microsoft Defender for Endpoint security settings management](../device-security/microsoft-defender/security-settings-management.md) scenario (MDE attach).--> [!div class="checklist"]-> Applies to:->-> - Linux - ### Mark Windows devices noncompliant when prohibited AI agents are discovered<!-- 37387056 --> Automatically mark Windows devices as noncompliant when prohibited local AI agents, such as OpenClaw, are discovered on the device. As an admin, you'll be able to configure a list of prohibited agents in a Windows compliance policy. When a prohibited agent is detected, the device reports as noncompliant and Conditional Access takes effect. The device returns to a compliant state once the agent is removed.