Onboard Isoc Workspace
Doc updateThe documentation now states that an ISOC workspace follows the same data residency and retention behavior as an Azure Log Analytics workspace and links to related Microsoft Sentinel and Log Analytics guidance.
Today in Microsoft Defender
Every tracked change across Microsoft Defender documentation, in plain English. Browse the archive from 1 January 2026 → About this project →
Day in brief
AKS Deny policies can block Defender for Cloud Security Gating provisioning
The most consequential update adds explicit Defender for Cloud guidance for AKS clusters: Deny policies can trigger RequestDisallowedByPolicy during Security Gating provisioning, even when clusters are compliant. The period also records an Endpoint Linux release, revised Sentinel residency guidance, Vulnerability Management detection and recommendation fixes, and four GA sensor entries.
- AKS Deny policies are documented as a Security Gating provisioning blocker
Defender for Cloud · Cloud and workloadsThe enablement guide now states that Deny policies targeting AKS managed clusters can cause RequestDisallowedByPolicy when Security Gating provisions resources, including on compliant clusters. It adds steps to identify the blocking assignment in the Activity Log and use Audit or a narrowly scoped exemption with the Azure Policy administrator.
- Endpoint Linux 101.26091.0004 adds Azure Linux 4 and socket-bind telemetry
Endpoint · Endpoint protectionThe October 2026 release notes list Linux version 101.26091.0004, Azure Linux 4 support, and TCP socket bind telemetry. After gradual rollout, the telemetry will be available in Advanced Hunting through the DeviceNetworkEvents table.
- Sentinel residency guidance maps data to onboarding or Defender XDR regions
Sentinel · Cloud and workloadsThe page now states that Sentinel processes and stores processed and configuration data in onboarding destination regions or applicable existing Defender XDR regions. It also expands the processed-data examples and removes the 21Vianet retirement notice.
- Vulnerability Management lists detection and recommendation fixes
Vulnerability Management · GeneralThe Fixed Reported Inaccuracies page now lists detection and recommendation fixes, revised Python end-of-support details, and MDVM support for Intel Endpoint Management Assistant and several Microsoft extensions, with entries dated September 7–23 and October 3–9, 2026. Reports and recommendations may change for affected products and vulnerabilities.
- Defender sensor changelog adds four October GA versions and CA trust removal
Defender for Cloud · Identity protectionThe changelog adds October 2026 GA entries for sensor versions 0.11.9, 0.10.12, 0.9.70, and 0.8.63. Their images remove trust in affected certificate authorities; review these releases when planning sensor updates.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
8 updates
Microsoft Defender XDR
2 updatesThe article title no longer includes “(Preview)”; its publication date and documentation metadata were also updated.
Microsoft Defender for Endpoint
1 updateMicrosoft Defender Endpoint Releases
Feature updateThe October 2026 Linux release notes now list version 101.26091.0004, support for Azure Linux 4, and TCP socket bind telemetry. After gradual rollout, the telemetry will be available in Advanced Hunting through the DeviceNetworkEvents table.
Microsoft Defender for Cloud
3 updatesEnablement Guide Runtime Gated
Feature updateAction requiredThe guide now explains that `Deny` policies targeting AKS managed clusters can prevent Security Gating provisioning with `RequestDisallowedByPolicy`, even for compliant clusters. It adds steps to identify the blocking assignment in the Activity Log and use `Audit` or a narrowly scoped exemption.
Defender Sensor Change Log
Feature updateThe changelog adds October 2026 GA entries for sensor versions 0.11.9, 0.10.12, 0.9.70, and 0.8.63. Their images remove trust in affected certificate authorities.
Defender For Containers Troubleshoot
Doc updateAction requiredThe page now explains missing admission-controller resources, how to diagnose failed AKS writes with RequestDisallowedByPolicy, which policies may conflict, and how to resolve the issue through narrowly scoped changes or Microsoft Support.
Microsoft Sentinel
1 updateGeographical Availability Data Residency
Feature updateThe page now states that Sentinel will process and store processed and configuration data in the onboarding destination regions or applicable existing Defender XDR regions. It also adds cases to the processed-data examples and removes the 21Vianet retirement notice.
Fixed Reported Inaccuracies
Feature updateThe page now lists detection and recommendation fixes, updated Python end-of-support details, and MDVM support for Intel Endpoint Management Assistant and several Microsoft extensions, dated September 7–23 and October 3–9, 2026.