Updating MMA on Windows devices for Microsoft Defender for Endpoint

Important

If you've arrived on this page as a result of clicking on a notification at the Microsoft Defender portal (https://security.microsoft.com), you have devices in your environment with outdated agents, and you need to take action (described in this article) to avoid service disruption. For more details, please reference message center post MC598631 (requires access to Message Center).

If you're using the Microsoft Monitoring Agent (MMA) on Windows devices, it's important to keep this agent updated. Microsoft recommends upgrading to the latest version of Defender for Endpoint. This article describes how to:

• Update the MMA on your devices (for devices running Windows 8.1 Pro or Enterprise).

• Upgrade to the new agent for Defender for Endpoint (for devices running Windows 7 SP1 Enterprise, Windows 7 SP1 Pro, Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016).

Update MMA on your devices

This option applies to devices running Windows 8.1 Pro and Windows 8.1 Enterprise.

• To help you identify older versions of the MMA inside of your organization, you can use the "EOSDate" column in advanced hunting. Or, follow the instructions in Plan for end-of-support software and software versions to use the vulnerability management feature inside of Microsoft Defender for Endpoint to track remediation.

• See Manage and maintain the Log Analytics agent for Windows and Linux for instructions on how to upgrade the agent using Azure Automation or a command-line approach to use with various deployment tools and methods.

• Update MMA by using Microsoft Update, through Windows Server Update Services or Configuration Manager. Use the method that was configured when MMA was first installed on the device.

• Download the MMA setup file:

  • Windows 64-bit agent: https://go.microsoft.com/fwlink/?LinkId=828603
  • Windows 32-bit agent: https://go.microsoft.com/fwlink/?LinkId=828604

Upgrade to the new agent for Defender for Endpoint

This option applies to devices running Windows 7 SP1 Enterprise, Windows 7 SP1 Pro, Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016.

A new agent was released in April 2022 for Windows Server 2012 R2 and Windows Server 2016, and in May 2026 for Windows 7 SP1 and Windows Server 2008 R2 SP1. The new agent doesn't depend on MMA. There are significant benefits to moving to this new agent, such as a vastly extended feature set.

• Microsoft Defender Vulnerability Management provides an assessment (SCID-2030) titled "Update Microsoft Defender for Endpoint core components" that allows you to track which Windows Server 2012 R2 or Windows Server 2016 machines haven't been upgraded yet.

• Use the Defender deployment tool to perform the upgrade. See Deploy Microsoft Defender endpoint security to Windows devices using the Defender deployment tool.

• If you're using Microsoft Configuration Manager version 2107 (August 2021) or later to manage your servers running Windows Server 2012 R2 or Windows Server 2016, see Migrating servers from Microsoft Monitoring Agent to the unified solution to perform an orchestrated upgrade.

• If you're using Microsoft Configuration Manager 2207 (August 2022) or later to manage your servers running Windows Server 2012 R2 or Windows Server 2016, see Onboarding to Microsoft Defender for Endpoint with Configuration Manager 2207 and later versions to perform an automated upgrade.

• If you're using Microsoft Defender for Cloud with servers running Windows Server 2012 R2 or Windows Server 2016, you can automate the upgrade by selecting Enable unified solution. See Users with Defender for Servers enabled and Microsoft Defender for Endpoint deployed.

Important information about MMA

• If you've determined that you aren't using the MMA for Defender for Endpoint, or you've already updated your agent, no other steps are needed.

• If you are, however, still using MMA for other purposes (such as Log Analytics), MMA has been retired. See We're retiring the Log Analytics agent in Azure Monitor on 31 August 2024. Depending on your particular scenario, now might be a good time to upgrade to Azure Monitoring Agent, the successor of MMA.

Important

Defender for Endpoint devices running Windows 8.1 are still supported and remain dependent on MMA.

Azure Monitor Agent cannot be used as a substitute for Defender for Endpoint.

See also

• Make the switch from non-Microsoft endpoint protection to Microsoft Defender for Endpoint

• Microsoft Defender for Endpoint deployment overview

• Onboard to the Microsoft Defender for Endpoint service