Forum Discussion
Defender for Server without Internet access
Sankaperera
Defender Antivirus
Without internet access you can use Defender Antivirus, which is a traditional Antivirus solution available on windows servers 2016 and up.(note, the antivirus in 2016 does not have all the functionality that is available 2019 and up.
You have the option of distributing updates via a share folder, WSUS or MEC, which will not require direct internet access from the protected servers.
Defender Antivirus is integrated in the OS so it does not require Defender for Servers licensing.
Defender for Endpoint(Defender for Servers)
The EDR solution Defender for Endpoint runs all analytics in the cloud, and will require internet access, either direct or through a proxy.
For an offline environment, consider using Microsoft Defender Antivirus (Windows only) with on-premises management via Group Policy or MECM, but this won't provide full MDE capabilities. Linux servers would require a different solution.
You cannot deploy and manage Microsoft Defender for Endpoint on both Windows and Linux servers without internet access. Defender for Endpoint requires internet connectivity for management, updates, and threat intelligence. Microsoft Defender cannot manage Linux servers without internet access.
Consider using ClamAV or Symantec Endpoint Protection for offline antivirus management on Linux servers.