Azure Local Antivirus

Question

Azure Local Antivirus

Handian Sudianto 7,026

Can we install 3rd party antivirus tools under Azure Local Node?

0 comments

Answer accepted by question author

1 additional answer

Your answer

Answer 1

Jilakara Hemalatha 12,915 Microsoft External Staff Moderator

Hi Handian,

Thank you for your query.

While third-party antivirus solutions can technically be installed on Azure Local nodes (such as Azure Stack HCI), Microsoft recommends using Microsoft Defender Antivirus as the preferred solution. Defender is natively integrated with the platform and validated to work seamlessly with system updates and cluster operations.

Using third-party antivirus or malware protection tools may introduce risks such as performance impact or interference with OS updates and critical services, especially if not configured with the appropriate exclusions.

If you choose to proceed with a third-party solution, it is important to follow Microsoft’s guidance on antivirus exclusions and best practices to avoid any disruption to workloads or cluster stability.

User's image For more details, please refer to the following documentation:

Azure Local security and compliance guidance: https://learn.microsoft.com/en-us/azure/azure-local/assurance/azure-stack-iso27001-guidance?view=azloc-2603
Security features for Azure Local (Microsoft Defender Antivirus) https://learn.microsoft.com/azure/azure-local/concepts/security-features?view=azloc-2603#microsoft-defender-antivirus
Microsoft Defender Antivirus compatibility with other security products https://learn.microsoft.com/defender-endpoint/microsoft-defender-antivirus-compatibility
Microsoft Defender Antivirus and non-Microsoft antivirus solutions without Defender for Endpoint https://learn.microsoft.com/defender-endpoint/defender-antivirus-compatibility-without-mde

Hope this helps! If it helpful! Could you please accept the answer and upvote it. Please let me know if you have any queries in comments.

Handian Sudianto 7,026 Reputation points

2026-04-22T05:47:10.7233333+00:00

Is Defender Antivirus is strong to prevent from malware ativity or new kind of malwares?
Jilakara Hemalatha 12,915 Reputation points Microsoft External Staff Moderator

2026-04-22T05:58:23.53+00:00

Yes, Microsoft Defender Antivirus is a strong and enterprise-grade solution for protecting against malware, including new and emerging threats. It uses real-time protection, behavioral analysis, cloud-delivered intelligence, and machine learning to detect and block both known and previously unseen malware.

In Azure Local environments, Defender is enabled and optimized by default, providing features such as real-time protection, cloud-delivered protection, and automatic sample submission to enhance threat detection.
Handian Sudianto 7,026 Reputation points

2026-04-22T06:01:02.4233333+00:00

Where we can see the defender report, example when the last scanning run and maybe report if there some malicious was blocked or quarantine?
Jilakara Hemalatha 12,915 Reputation points Microsoft External Staff Moderator

2026-04-23T09:18:15.9066667+00:00
You can view Microsoft Defender Antivirus reports through the following options:

Windows Security Center – Go to Virus & threat protection > Protection history to see scan results, blocked, and quarantined items.

PowerShell – Run the commands below on each node:

Last scan time: Get-MpComputerStatus | Select-Object LastFullScanTime, LastQuickScanTime

Threat detections: Get-MpThreatDetection

Quarantined items: Get-MpThreat

Event Viewer – Navigate to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational to review detailed scan activity and detection events.
Handian Sudianto 7,026 Reputation points

2026-04-28T01:50:24.8433333+00:00

can we onboard the defender on azure local to security portal?
Jilakara Hemalatha 12,915 Reputation points Microsoft External Staff Moderator

2026-04-28T07:01:44.5766667+00:00

Yes, you can onboard your Azure Local nodes to the Microsoft Defender security portal as long as you're running Azure Stack HCI OS version 23H2 or later.

Minimum requirements for Defender for Endpoint

Answer 2

Yes, third-party antivirus tools can be installed on Azure Local nodes, but Microsoft strongly recommends using Microsoft Defender Antivirus, which is enabled and configured by default on Azure Local.

Key points from the guidance:

Microsoft Defender Antivirus is the default and recommended solution
- It provides real-time protection, cloud-delivered protection, automatic sample submission, and always-on content scanning and behavior monitoring.
- It is enabled by default on Azure Local and is used to protect both the platform and workloads.
If choosing a non-Microsoft antivirus
- It is advised to select a product that the Independent Software Vendor (ISV) has validated for Azure Local to minimize potential functionality issues.
- Microsoft explicitly recommends using Microsoft Defender Antivirus rather than third-party antivirus and malware detection software because third-party tools may impact the operating system’s ability to receive updates on Azure Local.
Exclusions if functionality issues occur
- If non-Microsoft antivirus causes issues with Azure Local, the following paths can be excluded from scanning:
  - C:\Agents\*
  - C:\CloudContent\*
  - C:\CloudDeployment\*
  - C:\ClusterStorage\*
  - C:\EceStore\*
  - C:\MASLogs\*
  - C:\NugetStore\*
  - C:\deploymentpackage\*
  - C:\ProgramData\GuestConfig\extension\_logs\*
Defender-related features integrated with Azure Local
- Microsoft Defender Antivirus (Windows Defender Antivirus) is referenced repeatedly as the built-in malware protection for Azure Local and is part of the platform’s security posture and compliance story (PCI DSS, ISO/IEC 27001, HIPAA).

In summary: third-party antivirus is technically possible on Azure Local nodes, but the supported and recommended configuration is to keep Microsoft Defender Antivirus enabled and, if a third-party product is used, ensure it is ISV-validated for Azure Local and configured with the recommended exclusions.

References:

Share via

Azure Local Antivirus

1 additional answer

Your answer