Microsoft 365 Alert – Service Degradation – Microsoft Defender XDR – Users can’t access the Microsoft Defender for Endpoint on Linux service upon rebooting after a version upgrade – NEW

Announcements Shagufta Naaz

01/07/2026 08:56:00 AM

NHSmail Reference: INC46866425

Microsoft Reference: DZ1410811

Issue Status: OPEN

Issue Description: Users can’t access the Microsoft Defender for Endpoint on Linux service upon rebooting after a version upgrade.

More info: Specifically, rebooting after upgrading to version builds 101.26042.0009 and 101.26052.0007 is causing impact to active protection on devices across supported Linux platforms, leading to the Microsoft Defender for Endpoint on Linux service being disabled.

While we work to resolve this issue, we recommend users don’t upgrade to the latest version and wait until the next version is released or this impact is remediated.

If users have already upgraded, users can either downgrade to a previous version or manually start the Defender service (mdatp) to restore protection on affected devices.

Current Update: 01/07/2026 08:56:00 AM – : Microsoft has received customer reports indicating that Microsoft Defender for Endpoint on Linux service becomes disabled on some users’ devices after a version upgrade and is rebooted. They have identified that some version upgrades to 101.26042.0009 and 101.26052.0007 builds and reinstalling scenarios aren’t remaining configured to start automatically after a system reboot. They have developed a fix to address the startup configuration issue and re-enable the affected Linux service, and they are preparing to initiate deployment of this fix to the affected organisations.

Scope of impact: Your organisation is affected by this event, and users expecting their endpoint agent to start automatically after rebooting following an upgrade to version builds 101.26042.0009 and 101.26052.0007 are impacted. This section may be updated as our investigation continues.

Root cause: Some version upgrades to 101.26042.0009 and 101.26052.0007 builds and reinstalling scenarios aren’t remaining configured to start automatically after a system reboot.

Next update by: Thursday, July 2, 2026, at 5:00 AM UTC