Microsoft Makes WSL Containers Generally Available with Intune Controls for Image Registry Allow‑listing

Microsoft Makes WSL Containers Generally Available with Intune Controls for Image Registry Allow‑listing

What Happened – Microsoft announced the general availability of Windows Subsystem for Linux (WSL) containers, enabling Linux containers to run on Windows laptops. The release includes built‑in Intune settings that let administrators globally enable/disable the feature and restrict container image pulls to approved registries. Defender for Endpoint now surfaces container process, file, and network activity alongside host telemetry.

Why It Matters for Trust & Control Assurance

• The ability to disable WSL containers or enforce an allow‑list directly supports a continuous control‑assurance program by providing a documented, enforceable safeguard against unvetted container images.
• Defender for Endpoint’s unified visibility creates defensible audit evidence of container activity without a separate monitoring pipeline, simplifying evidence collection for compliance reviews.
• Mapping these new Intune policies to existing access‑control and software‑supply‑chain objectives helps demonstrate adherence to multiple frameworks (e.g., NIST CSF, ISO 27001) with a single control implementation.

Who Is Affected – Technology/SaaS developers, enterprise IT departments that provision Windows developer workstations, and any organization that permits Linux workloads on Windows endpoints.

Recommended Actions

• Review the two new Intune settings; set the default to “disabled” and define an allow‑list of trusted container registries.
• Integrate Defender for Endpoint container telemetry into your continuous monitoring dashboard to capture real‑time evidence.
• Document the configuration and monitoring process in your control‑evidence repository to support audit readiness. Source: Help Net Security

Technical Notes

• WSL containers run via the wslc.exe (alias container.exe) command‑line tool and expose an API for native Windows apps, targeting workloads such as local AI inference.
• No known vulnerabilities are disclosed; the release adds health‑check events, live streaming of container activity, and a new “consomme” network mode. Source: same as above