Security teams rely on scheduled scans to ensure consistent coverage across devices, detect dormant or missed threats, and meet compliance requirements. However, managing scans on Linux has traditionally required custom scripts and cron-based setups, which can be hard to scale and maintain. That’s why we’re excited to introduce centrally managed scheduled antivirus scans for Linux in Microsoft Defender. With this release, we are bringing built-in, flexible scheduling capabilities directly into Defender - making it easier to manage and standardize scan behavior across Linux environments.
What’s new
With this capability, customers can now configure scheduled antivirus scans on Linux using security settings management policies in the Microsoft Defender portal for centralized policy enforcement or local Managed JSON configuration that can be deployed via configuration management tools like ansible, puppet and chef.
The feature supports a flexible set of scheduling options, including hourly quick scans (interval-based scheduling), daily quick scans at a defined time, and weekly scans with configurable scan type (quick or full). In addition, customers can control how scans run with advanced options such as:
- Running scans only when the device is idle
- Reducing CPU impact using low CPU priority
- Checking for definition updates before scanning
- Randomizing scans start times
- Ignoring exclusions during scheduled scans
These capabilities allow security teams to balance coverage, performance, and operational needs across large Linux environments.
Why this matters
From a security perspective, scheduled scans play a critical role in detecting dormant threats, missed detections, and malicious artifacts that may not be caught through real-time protection alone. Without consistent and centrally enforced scheduling, these gaps can increase risk across the environment.
With this release, scheduled scans are now:
- Centrally managed through Defender policies
- Consistently enforced across devices
- Aligned with security best practices for regular scanning
- Integrated into the broader Defender security posture
This helps organizations strengthen their overall security posture while reducing operational complexity.
Get started
To get started, ensure devices are running agent version 101.26032.0000 or later (production ring), and configure scheduled scans using managed JSON or Defender portal policies.
Learn more
- Learn more about how to schedule antivirus scans on Linux
- To learn more about endpoint protection with Microsoft Defender, check out our website.
- To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.
Microsoft