Daily Defender NewsEvery tracked change across Microsoft Defender documentation, in plain English. Browse the archive from 1 January 2026 → About this project →
Microsoft Defender for Office 365 Plan 2 is scheduled to gain a remediation action that moves suspicious messages from user mailboxes into Defender quarantine. Defender for Cloud guidance also tightens the operational picture for Arc-enabled SQL Server: proxy support, extension versioning, manual updates, and resource exclusion procedures are now documented. Endpoint changes mainly improve Linux investigation guidance.
Defender XDR · Email and collaborationA Microsoft 365 Message Center notice says Plan 2 will add a remediation action that moves suspicious email from user mailboxes into Defender quarantine. Rollout begins in late November 2026; no action is required, but policy and role reviews are recommended.
Defender for Cloud · Cloud and workloadsDefender for Cloud release notes state that Azure Arc SQL Server instances with Arc proxy enabled are supported with Defender for SQL extension version 2.0.3585.403. The version is available for manual update, automatic rollout has not started, and Arc proxy can route outbound communication for organizations without direct internet access.
Defender for Cloud · Cloud and workloadsA new procedure page covers updating the Defender for SQL extension on Azure Arc-enabled servers and Azure VMs through the Azure portal, Azure CLI, scripts, or REST APIs. It also documents prerequisites, version verification, and the extensions in scope, excluding the SQL IaaS extension and Azure Connected Machine agent from this update workflow.
Defender for Cloud · Cloud and workloadsThe updated guidance provides separate procedures for Arc-enabled servers and Azure VMs, including Arc extension block or allow lists and an Azure Policy deny assignment. It states that these controls do not uninstall existing extensions or change subscription-level Defender settings; administrators excluding a resource should configure the applicable restriction before uninstalling the extension.
Endpoint · Endpoint protectionUpdated Endpoint guidance says Linux investigation packages include Microsoft Defender for Endpoint Client Analyzer diagnostics alongside system information, covering installation, configuration, service health, logs, and connectivity.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Microsoft Defender for Office 365 Plan 2 introduces a "Move to Quarantine" remediation action, allowing admins to move suspicious emails from user mailboxes to Defender quarantine for safer investigation and management. Rollout begins late November 2026, with no action required but policy and role reviews recommended.
The Android release documentation now lists version 1.0.9428.0102, released October 30, 2026. It includes general performance and bug fixes, including a rare initialization crash fix, and refreshes network protection notifications after qualifying network changes.
The page removes the AuditD rate-limiter and faulty-rule options, along with detailed Live Response scripts for running or installing the Client Analyzer. It retains links to the binary and Python analyzer versions.
The guidance now states that Linux investigation packages include Microsoft Defender for Endpoint Client Analyzer diagnostics alongside system information, covering installation, configuration, service health, logs, and connectivity.
The guide now lists three ways to collect diagnostics: locally from the command line, remotely through live response, or through an investigation package from the device page. On Linux, investigation packages include Client Analyzer diagnostics.
The guide updates its connectivity reference for commercial environments and explains that Defender for Identity-only servers may show as “Can be onboarded” in device inventory. It directs administrators to Sensor management to check v3.x sensor health.
The page now documents separate procedures for Arc-enabled servers and Azure VMs, including Arc extension block or allow lists and an Azure Policy deny assignment. It clarifies that these controls do not uninstall existing extensions or change subscription-level Defender settings.
A new page explains how to update the Defender for SQL extension on Azure Arc-enabled servers and Azure VMs using the Azure portal, Azure CLI, scripts, or REST APIs. It also covers prerequisites, version verification, and the extensions in scope.
The guidance now supports Azure Arc SQL Server instances with Arc proxy enabled when using Defender for SQL extension version 2.0.3585.403 or later. It documents proxy, direct, and Azure Monitor Agent communication fallback, required outbound access, and a discovery script.
The documentation now states that Azure Arc SQL Server instances with Arc proxy enabled are supported with Defender for SQL extension version 2.0.3585.403. The version is available for manual update; automatic rollout has not started.
