Daily Defender NewsEvery tracked change across Microsoft Defender documentation, in plain English. Browse the archive from 1 January 2026 → About this project →
The substantive change this period is a Sentinel SAP BTP solution expansion in preview: guidance now covers Application Vulnerability Report Service findings, companion analytics, and workbook content. Defender XDR also records a time-limited Advanced Hunting schema transition, while Defender for Endpoint updates macOS release guidance and clarifies offboarding behavior. Other edits mainly correct access instructions, links, naming, metadata, and notification-language references.
Sentinel · Cloud and workloadsThe solution overview now separates SAP BTP Application Vulnerability Report Service findings into a preview connector and adds a preview analytics rule plus an Application Vulnerabilities workbook tab with a vulnerability-posture KPI. The documented use case is to combine these findings with BTP audit activity when investigating vulnerable custom applications.
Defender XDR · Hunting and detectionThe schema-change notice says `AadDeviceId` is being replaced by `EntraIdDeviceId`; the old column remains available for 30 days so administrators can update hunting queries.
Defender XDR · GeneralThe updated procedure covers required permissions, role assignment, and workspace selection for delegated remote tenant groups, while retaining resource-group assignment as an option. It also separates management-plane permissions from any additional data-plane access required.
Endpoint · Endpoint protectionThe updated page covers Windows, Linux client and server, macOS, Android, and iOS. It distinguishes subscription-wide Azure server offboarding when Defender for Servers is turned off from manual individual-server offboarding, and states that offboarding does not uninstall the software.
Endpoint · Endpoint protectionRelease 101.26082.0012 is documented with EDR support for configuring AI agent runtime protection, alongside Bluetooth permission and antivirus-health reporting improvements plus accessibility, reliability, and performance fixes.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now explains how to grant Microsoft Sentinel permissions to delegated remote tenant groups through Defender URBAC, including required permissions, role assignment, and workspace selection. It also retains the resource-group assignment option and clarifies management-plane versus data-plane access.
The user investigation documentation revises its authoring reference links and changes `GraphApiAuditEvents` to `GraphAPIAuditEvents`.
The `AadDeviceId` column is being replaced by `EntraIdDeviceId`. `AadDeviceId` will remain available for 30 days to support query updates.
The what's new documentation now uses the table name `GraphAPIAuditEvents` when describing Microsoft Entra ID API requests to Microsoft Graph API.
The Defender for Endpoint What's New page now lists macOS release version 20.126082.12.0 as GA and links to its enhancements and features.
The documentation now covers Windows, Linux client and server, macOS, Android, and iOS offboarding. It also distinguishes subscription-wide Azure server offboarding from manual individual-server offboarding and clarifies that offboarding does not uninstall software.
The macOS 101.26082.0012 release adds EDR support for configuring AI agent runtime protection, plus Bluetooth permission and antivirus health reporting improvements, accessibility updates, reliability fixes, and performance fixes.
The Windows Defender Antivirus documentation now lists `DefenderSessionHelper.exe` in the Details tab for Microsoft Defender Clipboard Protection, with Processes and Services marked N/A. The page date and reviewer metadata were also updated.
The server onboarding page now links to `offboard-machines` instead of the `#offboard-servers` fragment.
The page author metadata changed from paulinbar/painbar to limwainstein. The uninstall guidance continues to direct administrators to the Offboard Mac devices documentation for cleanup requirements.
The documentation now lists the languages supported by localized default notification templates, including English, Japanese, Spanish, Chinese, Korean, Portuguese, and others.
The page updates the Hybrid identity description, corrects the Risk score link, and points investigation guidance to non-human identities.
The article now points to two different authoring references.
The documentation adds a separate preview connector for SAP BTP Application Vulnerability Report Service findings, plus a preview analytics rule and an Application Vulnerabilities workbook tab with a vulnerability posture KPI.
The documentation now describes an optional Application Vulnerabilities workbook tab and an analytics rule correlating SAP Application Vulnerability Report Service findings with BTP audit events. The rule detects custom apps with open high or critical vulnerabilities, using a default CVSS threshold of 7.0 and a 14-day evaluation window.
The October 2026 documentation adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect interactive XSUAA logins involving custom apps with open high or critical vulnerabilities.
The article now documents a connector that ingests SAP Application Vulnerability Report Service findings into Microsoft Sentinel, including setup prerequisites, credentials, polling and ingestion-delay settings, verification, and related analytics content.
