Threat Analytics
Doc updateThe documentation now directs users to check the Threat intelligence section when an emailed threat analytics report is missing from Threat analytics.
Today in Microsoft Defender
Every tracked change across Microsoft Defender documentation, in plain English. Browse the archive from 1 January 2026 → About this project →
Day in brief
Defender connectivity guidance adds Microsoft 365 Unified Domains allowlists
The period was dominated by documentation maintenance, with the most consequential update affecting Defender for Endpoint network configuration. Commercial connectivity guidance now says environments may also need Microsoft 365 Unified Domains URLs allowed, while separate guidance adds a clearer response path for automatic attack disruption that causes full isolation. Smaller updates correct an ABAP audit-log table name and explain where to find missing Threat Analytics reports.
- Endpoint connectivity allowlists now include Microsoft 365 Unified Domains guidance
Endpoint · Endpoint protectionBoth commercial connectivity topics now say that, beyond the URLs in their existing tables, some environments may also need URLs from the Microsoft 365 Unified Domains list. Administrators configuring or validating Defender for Endpoint access should review that linked list.
- Attack disruption guidance covers full isolation and selective-isolation exclusionsEndpoint · Endpoint protection
The machine-alert guidance now identifies automatic attack disruption triggering full isolation as a possible cause. It also points administrators to an isolation exclusion rule when selective isolation is preferred.
- Threat Analytics guidance points missing emailed reports to Threat intelligence
Defender XDR · Endpoint protectionIf an emailed threat analytics report is absent from the expected Threat analytics section, administrators are now directed to check the Threat intelligence section instead.
- Custom detection rules correct the ABAP audit-log table name
Defender XDR · Hunting and detectionThe supported-table list now spells the table as `ABAPAuditLog_CL`, restoring the missing final “L.” Detection authors using ABAP audit-log data should use this corrected name.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
7 updates
Microsoft Defender XDR
2 updatesCustom Detection Rules
Doc updateThe supported table list now spells `ABAPAuditLog_CL` correctly, fixing a missing “L.”
Microsoft Defender for Endpoint
5 updatesThe commercial device connectivity documentation now notes that, beyond the listed URLs, some environments might also need to allow URLs from the Microsoft 365 unified domains list.
The documentation now notes that access may also be needed for URLs listed under Microsoft 365 Unified Domains, in addition to the URLs in the existing table.
Run Analyzer Linux
Doc updateThe documentation fixes spelling errors in the descriptions for the minimum-requirement and external-dependency options.
Exploit Protection Reference
Doc updateThe documentation corrects “memory manger” to “memory manager” and adjusts spacing before an ellipsis in the mitigation description.
Respond Machine Alerts
Doc updateThe guidance now notes that the issue can occur when automatic attack disruption triggers full isolation. Administrators can define an isolation exclusion rule to use selective isolation instead.