Microsoft Defender for Cloud
Cloud and workloadsRelease Notes
In brief
The experience combines Microsoft Defender for Endpoint and Defender for Servers data, enabling unified inventory, cross-service investigations, Go hunt, and access management through RBAC, device groups, and cloud scopes. Administrators can also offboard eligible servers from Defender for Endpoint by disabling Defender for Servers for a subscription.
What Defender admins need to know
Administrators can evaluate the unified workflows and review access controls; no required configuration change is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Date | Category | Update |
|---|---|---|
| October 6, 2026 | Public preview | New Defender server security experience |
| October 5, 2026 | GA | KSPM misconfiguration recommendations moving to controller-level scope |
| October 5, 2026 | GA | On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares |
New Defender server security experience
October 6, 2026
The new Defender server security experience brings together cloud and endpoint data from Microsoft Defender for Endpoint and Defender for Servers.
In the Microsoft Defender portal, you can:
- Review unified server inventory and combined cloud and endpoint details.
- Investigate servers across alerts, incidents, and the attack graph.
- Use Go hunt to investigate related events.
- Manage access with role-based access control (RBAC), server device groups, and cloud scopes.
In Microsoft Defender for Cloud in the Azure portal, you can:
- Automatically offboard eligible servers from Defender for Endpoint by turning off Defender for Servers for the subscription.
KSPM misconfiguration recommendations moving to controller-level scope (GA)
October 5, 2026
@@ -61,9 +61,27 @@ Get notified when this page is updated by copying and pasting the following URL
| Date | Category | Update |
| --- | --- | --- |
+| October 6, 2026 | Public preview | New Defender server security experience |
| October 5, 2026 | GA | KSPM misconfiguration recommendations moving to controller-level scope |
| October 5, 2026 | GA | On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares |
+### New Defender server security experience
+
+October 6, 2026
+
+The new Defender server security experience brings together cloud and endpoint data from Microsoft Defender for Endpoint and Defender for Servers.
+
+In the Microsoft Defender portal, you can:
+
+- Review unified server inventory and combined cloud and endpoint details.
+- Investigate servers across alerts, incidents, and the attack graph.
+- Use **Go hunt** to investigate related events.
+- Manage access with role-based access control (RBAC), server device groups, and cloud scopes.
+
+In Microsoft Defender for Cloud in the Azure portal, you can:
+
+- Automatically offboard eligible servers from Defender for Endpoint by turning off Defender for Servers for the subscription.
+
### KSPM misconfiguration recommendations moving to controller-level scope (GA)
October 5, 2026