Daily Defender NewsEvery tracked change across Microsoft Defender documentation, in plain English. Browse the archive from 1 January 2026 → About this project →
The period was dominated by coordinated Office 365 Attack Simulation Training guidance updates. The pages now explain that training assignments and follow-up notification emails may take time to appear after a simulation interaction, with custom landing pages able to set that expectation. A separate Sentinel update revised wording for the MCP server triage collection’s run hunting query tool.
Office 365 · Email and collaborationThe simulations guidance now says new training assignments and the notification email following a simulation interaction may take time to appear. It also links to end-user notification details and suggests adding a custom landing-page message about the delay.
Sentinel · Cloud and workloadsThe Microsoft Sentinel MCP server triage collection entry was revised, including wording for the run hunting query tool. No administrator action is indicated.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The article now notes that new training assignments and the notification email following a simulation interaction may take time to appear. It also links to end-user notification details and suggests a custom landing-page message about the delay.
The FAQ now explains that training assignments and follow-up notification emails may take time to appear after a simulation interaction. It links to end-user notification details.
The page now states that training assignments may not appear immediately after a simulation interaction and that the follow-up notification email may also be delayed.
The page now notes that a new training assignment may take time to appear and suggests mentioning this timing on custom landing pages.
The Microsoft Sentinel MCP server triage collection entry was revised, including wording for the run hunting query tool.
