Microsoft Defender version history: where to check it

Microsoft Defender version history is not one single record. The version history you need depends on which Defender component you mean: the Defender app, the antivirus platform, the security intelligence, or Defender for Endpoint. That matters because the version you see on a Windows device, in Microsoft 365 Defender, or on a managed endpoint can come from different update streams and may not match exactly.

What Microsoft Defender version history actually refers to

“Version history” means the update record for the specific Defender component you are checking. If you are checking the app itself, you want the app version. If you are checking malware protection, you usually care about the antivirus platform version or the security intelligence version. If you are working in an organization, Defender for Endpoint may show its own device and service data.

For example, if you are troubleshooting a scan problem on one PC, the app version alone may not explain it if the antivirus platform or security intelligence is older than expected. The key question is not just “What version is Defender?” but “Which Defender component changed?”

The version numbers people usually mix up

These are the main ones to separate:

• Defender app version: the application build you see in the UI or app listing.
• Antivirus platform version: the protection engine and related platform files that handle scanning and protection behavior.
• Security intelligence version: the malware definition or intelligence update that changes very often.

For example, two devices can show the same Defender app version and still have different security intelligence if one has already pulled the latest malware definitions. That is why two devices can look out of date for different reasons, even when the product name is the same.

Where to check the current installed version and update history

On a Windows device, start with the Windows Security app for the installed Defender details on that device. If the device is managed, compare that with the Microsoft security console or Microsoft 365 Defender record for the same endpoint.

Use the screen that matches the component you are checking. The local device view is best for the installed version on that machine. The console is better for organization-level update history, policy, and telemetry. If the device is managed, the console and the local device can disagree for a short time while they sync, so compare both before you draw a conclusion.

For example, if you are reporting a protection issue, capture the local installed version, the console record, and the component name you were checking. That gives support a usable starting point instead of a version number with no context.

Why version history can look different across Windows builds and consoles

Version history can look different across Windows builds, Microsoft 365 Defender, and managed devices because each screen may present the same data differently. A consumer Windows device may show version details in the Windows Security app, while an organization-managed device may surface more history in the Microsoft security console.

Some builds also label or group the same information differently, so the history may not line up one-for-one between screens. The console can show management or telemetry data that the local UI does not show, and the local UI can show the installed version even when the console has not finished syncing yet. That is the most common reason people compare the wrong screen to the wrong record.

This also means the answer can change by device type. A personal Windows PC, a server, and a managed endpoint may expose different fields and different labels, even when they all say Microsoft Defender.

What to check before troubleshooting or reporting an issue

Before you use a version number, confirm all three of these:

• Which Defender component you are checking: app, platform, security intelligence, or Defender for Endpoint.
• Which device context you are in: local Windows UI, Microsoft 365 Defender, or another managed console.
• Which release notes or update history apply to that exact component and product edition.

If the number comes from a console, compare it with the device’s local installed version too. If they disagree, that may point to a sync delay, a management difference, or simply the wrong component being checked. For reporting, include the exact component name and the screen or console where you found it, not just the number alone.

Frequently Asked Questions

Where do I check the current Microsoft Defender version on Windows?

Check the Windows Security app for the installed Defender details on the device, then compare that with any Microsoft security console if the device is managed. The exact screen depends on which Defender component you need.

Why does Microsoft Defender version history look different in the console than on the PC?

The console may show management or telemetry data, while the PC shows what is installed locally. They can differ because of Windows build, product edition, or sync timing.