Updating MMA on Windows devices for Microsoft Defender for Endpoint

Important

If you've arrived on this page as a result of clicking on a notification at the Microsoft Defender portal (https://security.microsoft.com), you have devices in your environment with outdated agents, and you need to take action (described in this article) to avoid service disruption. For more details, please reference message center post MC598631 (requires access to Message Center).

Applies to:

If you're using the Microsoft Monitoring Agent (MMA) on Windows devices, it's important to keep this agent updated. For Windows Server 2012 R2 and Windows Server 2016, Microsoft recommends upgrading to the new, unified agent for Defender for Endpoint. This article describes how to:

Update MMA on your devices

This option applies to devices running Windows 7 SP1 Enterprise, Windows 7 SP1 Pro, Windows 8.1 Pro, Windows 8.1 Enterprise, and Windows Server 2008 R2 SP1.

Upgrade to the new, unified agent for Defender for Endpoint

This option applies to servers running Windows Server 2012 R2 and Windows Server 2016.

A new agent was released in April 2022 for Windows Server 2012 R2 and Windows Server 2016. The new agent doesn't depend on MMA. There are significant benefits to moving to this new agent, such as a vastly extended feature set. To learn more, see Tech Community Blog: Defending Windows Server 2012 R2 and 2016.

Important information about MMA

Important

Defender for Endpoint devices running Windows 7 SP1, Windows 8.1, or Windows Server 2008 R2 are still supported and remain dependent on MMA.

Devices running Windows Server 2012 R2 or Windows Server 2016 should be upgraded to the new, unified solution so that they no longer require the use of MMA.

AMA cannot be used as a substitute for Defender for Endpoint.

See also

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.