Wednesday, 4 November 2026

GCC AI-agent scope and incident similarity sharpen Defender admin guidance

This was a guidance-heavy period rather than a broad rollout: Defender XDR updates spell out GCC AI-agent coverage and add investigation context around similar cases, similar incidents, and recommended correlations. Office 365 Attack Simulation Training guidance now sets expectations for delayed training assignments and follow-up email, while Endpoint release notes identify macOS 101.26092.0012 and its documented fixes. A Sentinel MCP server entry only revises wording for the run hunting query tool, with no administrator action indicated.

• Defender XDR · General

  GCC support boundaries are explicit for AI agent inventory

  The Defender XDR AI Agent Inventory article now says GCC supports agent discovery and inventory, but not agent risk assessment, security recommendations, or the attack surface graph. GCC administrators can use this scope to determine which AI-agent security capabilities are available.

• Defender XDR · Incidents and response

  Similar cases guidance adds shared-alert and entity context

  Investigate Incident Cases now documents opening the Similar cases page, reviewing similarity reasons, and viewing shared alerts and entities. Investigators can use that context to compare handling and identify recurring patterns.

• Defender XDR · General

  Recommended correlations broaden the attack view without merging incidents

  The Recommended correlations filter includes incidents that are not correlated into the current incident, while a Summary-tab card explains potential attack relationships. Related incidents retain their own ownership, status, and lifecycle until merged.

• Office 365 · Email and collaboration

  Attack Simulation Training guidance flags delays after interactions

  The simulations guidance says new training assignments and the follow-up notification email may take time to appear after a simulation interaction. It links to end-user notification details and suggests adding a custom landing-page message about the delay.

• Endpoint · Endpoint protection

  macOS 101.26092.0012 release notes document package-scanning improvements

  Microsoft Defender for Endpoint release notes list macOS version 101.26092.0012 with its release, engine, and signature versions, plus bug and performance fixes and optimized memory usage during package scanning. No administrator action is stated.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.