Monday, 26 October 2026

The article title no longer includes “(Preview)”; its publication date and documentation metadata were also updated.

Microsoft added public guidance describing five steps to strengthen threat defense: deploy relevant Defender workloads, configure automatic attack disruption, respond to incidents, prevent recurrence, and continuously optimize protection. It includes links to setup and attack-disruption configuration resources.

The permission details now state that Email & collaboration metadata Read access includes submitting email messages by Network message ID on the Submissions page. Documentation metadata and ontology links were also updated.

Microsoft is retiring the Microsoft Defender for Endpoint and Defender XDR Advanced Hunting APIs by February 1, 2027. Organizations must manually migrate workflows to the Microsoft Graph Security API by January 31, 2027, to ensure continued functionality and improved security integration.

Microsoft Defender for Office 365 introduces a new MessageContents table in Advanced Hunting for Teams messages, enabling authorized security analysts to query message snippets and metadata for threat investigations. Rollout is from late September to mid-November 2026. Access requires specific permissions and may impact security procedures.

The documentation now states that an ISOC workspace follows the same data residency and retention behavior as an Azure Log Analytics workspace and links to related Microsoft Sentinel and Log Analytics guidance.

The October 2026 Linux release notes now list version 101.26091.0004, support for Azure Linux 4, and TCP socket bind telemetry. After gradual rollout, the telemetry will be available in Advanced Hunting through the DeviceNetworkEvents table.

The page now documents using MpCmdRun.exe on Windows to roll back Microsoft Defender Antivirus platform updates to the previous version or the Windows inbox version. It also notes additional rollback support in platform version 4.18.26030.3011 or later.

The page updates its date and link ordering, renames an existing quarantine permission entry to “View and release emails and messages from quarantine,” and adds guidance for submitting quarantined messages to Microsoft, including read permissions for Security data basics and Email & collaboration metadata.

The page adds Proofpoint Core Email Protection API, updates related links, and directs readers to Get Started for the supported vendor list.

The page’s update date and several internal references changed, and its Microsoft Defender XDR unified RBAC guidance was refreshed.

The page no longer lists alerts including NEGOEX relay attack, suspicious Okta account enumeration, OAuth app created a user, suspicious Entra role addition, and seven other entries.

The guide now explains that `Deny` policies targeting AKS managed clusters can prevent Security Gating provisioning with `RequestDisallowedByPolicy`, even for compliant clusters. It adds steps to identify the blocking assignment in the Activity Log and use `Audit` or a narrowly scoped exemption.

The changelog adds October 2026 GA entries for sensor versions 0.11.9, 0.10.12, 0.9.70, and 0.8.63. Their images remove trust in affected certificate authorities.

The page now explains missing admission-controller resources, how to diagnose failed AKS writes with RequestDisallowedByPolicy, which policies may conflict, and how to resolve the issue through narrowly scoped changes or Microsoft Support.

The page now states that Sentinel will process and store processed and configuration data in the onboarding destination regions or applicable existing Defender XDR regions. It also adds cases to the processed-data examples and removes the 21Vianet retirement notice.

The documentation now explains retry and backoff behavior, checkpoint handling, continued processing of later windows, the seven-day recovery limit, and manual recovery using the Data Collector iFlow. Timeout troubleshooting guidance was also updated.

The page now lists detection and recommendation fixes, updated Python end-of-support details, and MDVM support for Intel Endpoint Management Assistant and several Microsoft extensions, dated September 7–23 and October 3–9, 2026.