Microsoft Secure Score will add four new AI-readiness recommendations for device security in Microsoft Defender for Endpoint, focusing on TPM 2.0, VBS, HVCI, and LAPS. These will help identify and remediate devices lacking key protections, rolling out from early to late September 2026 with no action required to receive them.
Day in brief
Secure Score will add four AI-readiness checks for device security
The period’s main product-facing change is a Microsoft Secure Score rollout for Microsoft Defender for Endpoint. Four recommendations covering TPM 2.0, VBS, HVCI, and LAPS will roll out from early to late September 2026. Most other activity was documentation maintenance, with useful exceptions covering connectivity allowlists, missing Threat Analytics reports, and isolation behavior.
- Secure Score adds four device-security readiness recommendations
Defender XDR · Endpoint protectionMicrosoft Secure Score will add four AI-readiness recommendations in Microsoft Defender for Endpoint, covering TPM 2.0, VBS, HVCI, and LAPS. They will roll out from early to late September 2026 and help identify and remediate devices lacking those protections; no action is required to receive them.
- Device connectivity allowlists may require Microsoft 365 Unified Domains
Endpoint · Endpoint protectionThe commercial standard device-connectivity guidance now says that some environments may need to allow URLs from the Microsoft 365 unified domains list in addition to the URLs in the existing table. Review the linked list when configuring or validating network allowlists.
- Missing emailed Threat Analytics reports may be in Threat intelligenceDefender XDR · Endpoint protection
The Threat Analytics guidance now directs administrators to check the Threat intelligence section when an emailed threat analytics report is missing from Threat analytics.
- Automatic attack disruption can result in full isolationEndpoint · Endpoint protection
The response guidance now notes that the issue can occur when automatic attack disruption triggers full isolation. Administrators can define an isolation exclusion rule to use selective isolation instead.
- Custom detection rules correct the ABAP audit table name
Defender XDR · Hunting and detectionThe supported table list now spells `ABAPAuditLog_CL` correctly, fixing the missing “L.” Administrators referencing ABAP audit log data should use the corrected table name when creating custom detection rules.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
8 updates
Microsoft Defender XDR
3 updatesThreat Analytics
Doc updateThe documentation now directs users to check the Threat intelligence section when an emailed threat analytics report is missing from Threat analytics.
Custom Detection Rules
Doc updateThe supported table list now spells `ABAPAuditLog_CL` correctly, fixing a missing “L.”
Microsoft Defender for Endpoint
5 updatesThe commercial device connectivity documentation now notes that, beyond the listed URLs, some environments might also need to allow URLs from the Microsoft 365 unified domains list.
The documentation now notes that access may also be needed for URLs listed under Microsoft 365 Unified Domains, in addition to the URLs in the existing table.
Run Analyzer Linux
Doc updateThe documentation fixes spelling errors in the descriptions for the minimum-requirement and external-dependency options.
Exploit Protection Reference
Doc updateThe documentation corrects “memory manger” to “memory manager” and adjusts spacing before an ellipsis in the mitigation description.
Respond Machine Alerts
Doc updateThe guidance now notes that the issue can occur when automatic attack disruption triggers full isolation. Administrators can define an isolation exclusion rule to use selective isolation instead.