Microsoft Defender Antivirus is rolling out an update to the support plan for the anti-malware scan “engine update” (MpEngine.dll). To align with the current Defender Antivirus platform update, only N-2 versions will be supported.
Reasons:
- New security intelligence update logic is dependent on newer scan engine logic. Many new detections won’t trigger for customers running an older engine version (such as from 6 months to 2+ years ago).
- Newer Defender Antivirus platform updates might crash due to an older engine logic that does not comprehend new functionalities [such as newer code in a Defender Antivirus platform update that works in unison with the engine update or newer endpoint data loss prevention (DLP) service, and so on].
- We want to ensure you are not running an older scan engine version with a known vulnerability.
[When this will happen:]
General Availability (Worldwide, GCC, GCC High, DoD, USNat, and USSec): The changes will take effect May 1, 2024.
[How this will affect your organization:]
To be fully supported, keep current with the latest engine updates. Our support structure is dynamic, evolving into two phases depending on the availability of the latest engine version:
- Security and critical updates servicing phase: When running the latest engine version, you’re eligible to receive security and critical updates to the anti-malware engine.
- Technical support (only) phase: After a new engine version is released, support for older versions (N-2) reduces to technical support only. Engine versions older than N-2 are no longer supported. Technical support continues to be provided for upgrades from an older engine version to the latest engine version.
- During the technical support (only) phase, commercially reasonable support incidents are handled through Microsoft Customer Service and Support and Microsoft’s managed support plans (such as Premier Support). If a support incident requires escalation to development teams for further guidance, requires a non-security update, or requires a security update, customers are asked to upgrade to the latest engine version.
[What you need to do to prepare:]
Please make sure that you have a supported mpengine.dll version installed. Minimum requirements are version 1.1.23110.2, version 1.1.24010.10, or newer.
To check your engine updates version in your environment:
1. In Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Endpoint Plan 1, and Microsoft Defender for Business, go to:
2. In Microsoft Defender for Endpoint Plan 2 and Microsoft Defender for Business, you can run an Advanced Hunting query and review the results of AVEngineVersion.
Learn more: Microsoft Defender Antivirus security intelligence and product updates | Microsoft Learn
