Configure Microsoft Defender for Endpoint on Linux for static proxy discovery

Installation time configuration

During installation, the HTTPS_PROXY environment variable must be passed to the package manager. The package manager can read this variable in any of the following ways:

• The HTTPS_PROXY variable is defined in /etc/environment with the following line:
  BashCopy

  HTTPS_PROXY="http://proxy.server:port/"
  

• The HTTPS_PROXY variable is defined in the package manager global configuration. For example, in Ubuntu 18.04, you can add the following line to /etc/apt/apt.conf.d/proxy.conf:
  BashCopy

  Acquire::https::Proxy "http://proxy.server:port/";
  

   Caution

  Note that above two methods could define the proxy to use for other applications on your system. Use this method with caution, or only if this is meant to be a generally global configuration.

• The HTTPS_PROXY variable is prepended to the installation or uninstallation commands. For example, with the APT package manager, prepend the variable as follows when installing Microsoft Defender for Endpoint:
  BashCopy

  HTTPS_PROXY="http://proxy.server:port/" apt install mdatp
  

   Note

  Do not add sudo between the environment variable definition and apt, otherwise the variable will not be propagated.

The HTTPS_PROXY environment variable may similarly be defined during uninstallation.

Note that installation and uninstallation will not necessarily fail if a proxy is required but not configured. However, telemetry will not be submitted, and the operation could take much longer due to network timeouts.

Post installation configuration

After installation, the HTTPS_PROXY environment variable must be defined in the Defender for Endpoint service file. To do this, run sudo systemctl edit --full mdatp.service. You can then propagate the variable to the service in one of two ways:

• Uncomment the line #Environment="HTTPS_PROXY=http://address:port" and specify your static proxy address.
• Add a line EnvironmentFile=/path/to/env/file. This path can point to /etc/environment or a custom file, either of which needs to add the following line:
  BashCopy

  HTTPS_PROXY="http://proxy.server:port/"
  

After modifying mdatp.service, save the file and restart the service so the changes can be applied using the following commands:

sudo systemctl daemon-reload; sudo systemctl restart mdatp