Tuesday, 29 September 2026

The page now documents inventory insights for new, highly privileged, risky, unused, overprivileged, externally unverified, and AI-agent-used identities. It also clarifies that Salesforce inventory includes Connected Apps and External Client Apps.

The page title, description, headings, tables, and references now use “Configuration protection” instead of “Controlled configuration.” The documented enforcement behavior and rules were correspondingly renamed.

The documented installer changes to version 2.26.921.1. The page also expands guidance for identifying Windows hosts, classic WSL devices, and WSL container devices in the Defender portal, and updates the screenshot and setup instructions.

The documentation now lists support for WSL containers (WSLc), extending Defender for Endpoint protection to WSLc workloads and providing visibility into their activity.

Eligible new Defender for Endpoint customers may receive automatic Defender for Identity sensor v3.x activation and Windows auditing. Existing Defender for Identity customers will see a portal notice before these settings are enabled; eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers are now covered. A sensor update with security improvements is also listed.

The troubleshooting documentation now states that migrating from sensor v2.x to v3.x is unsupported when the Defender for Identity workspace and Defender for Endpoint onboarding for the same server belong to different Microsoft tenants. The server may appear ready, but v3.x activation fails.

The guidance now says sensor v2.x deployments should configure a Directory Service Account for full security coverage. A DSA is required to access the DeletedObjects container and for certain cross-domain and non-domain-controller scenarios.

Automatic activation applies to eligible Defender for Endpoint-onboarded domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. It activates the existing capability, does not install a separate package, and excludes servers that already have a Defender for Identity sensor.

The documentation now explains that enabling both automatic sensor v3.x activation and automatic Windows auditing configures eligible onboarded servers automatically.

The documentation now specifies that a directory service account (DSA) is required for the listed features and functionality when using sensor v2.x.

Manual activation preview is limited to eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers without an existing sensor. A July 2026 or later Windows Server cumulative update is required before installing or upgrading to sensor version 3.0.8 or later for automatic RPC auditing on domain controllers.

The documentation now describes risk scores, last-used dates, and a Used by AI Agents (Preview) field. Salesforce inventory is also documented as including Connected Apps and External Client Apps.

Adds instructions for using Defender for Cloud Apps app governance to filter, investigate, and assess Microsoft Entra RBAC roles assigned directly to service principals, including role permissions, privilege levels, and risk signals.

The article now describes app risk scores, privilege levels, publisher information, and usage, clarifies SaaS insight definitions, and links to filtering and query guidance.

The documentation adds Risk management templates, including New high risk app and Risk score policies with customizable risk thresholds. It also updates monitoring guidance and the navigation path.

The page updates wording from app compliance to app security, renames the sharing section, and says administrators can review app details, aggregated data, and permission usage before viewing more information in Entra ID.

The app categories documentation now includes Risky apps—apps with a high risk score—and adds Risk score. Minor wording was also clarified.

The guide now describes itself as a quickstart and changes the step from assessing app compliance posture to assessing security posture, including an updated link. Author and publication metadata were also refreshed.

The article title, portal terminology, prose, list punctuation, emphasis, and screenshot formatting were revised.

The article was retitled and updated with a clearer introduction, revised formatting, refreshed links, and clarified descriptions and examples for CVE, image digest, OS version, severity, and fix-status exclusions.

The article reorganizes prerequisites and clarifies that enabling Defender CSPM or Defender for Storage automatically enables sensitive data discovery. It also documents sensitivity settings, the up-to-24-hour wait for initial results, and updated AWS S3 and RDS discovery steps.

The article updates its title, description, navigation steps, query instructions, and examples. It also removes the guidance about Azure Resource Graph findings and filtering by sensitivity labels and sensitive information types.

The documentation was edited for clearer wording, formatting, and navigation across Express/Classic configuration guidance, scan history, finding exclusions, Logic Apps notifications, API usage, and Resource Manager baseline examples.

The page replaces “blast radius” with “impact,” changes numbered lists to bullets, and revises wording for impacted-asset filtering, repository integration, exemptions, and Azure portal availability.

The article now expands Defender CSPM and CVE on first use, clarifies the dashboard’s purpose, standardizes severity labels and Kubernetes terminology, and improves wording and punctuation.

The article updates its title, prerequisites, navigation labels, instructions for existing Security Private Link resources, and descriptions of the containers sub-resource. Several sentences were also rewritten for clarity and consistency.

The article updates heading capitalization, link and emphasis formatting, and punctuation in the filtering option descriptions.

The page title and headings were simplified, portal navigation wording was updated, and “drop-down” was standardized to “dropdown.” Two authoring references were also added.

Updated capitalization and wording throughout the classic configuration article, including configuration checks, exemptions, Resource Manager templates, and Boolean baseline examples.

Updated the page title, wording, formatting, and the GitHub Advanced Security for Azure DevOps link. The page continues to state that MSDO CredScan secrets scanning is deprecated.

The article now uses updated Defender External Attack Surface Management naming, clearer prerequisite wording, and revised steps for opening Cloud security explorer and Attack path analysis.

The documentation now labels the procedure as updating the plan at the subscription level and directs administrators to select **Action required** instead of **Settings**.

The article’s wording, prerequisites, portal navigation, step numbering, and event-log instructions were revised. Guidance for regions, endpoints, platform types, and XPath filters was clarified, and a screenshot was removed.

The page updates terminology and UI steps, adds instructions for disabling all four Defender for Databases subplans, and clarifies autoprovisioning, Azure Policy assignments, and resource-level plan settings.

The article updates wording, formatting, and step instructions, including clearer prerequisites, assignment fields, and supported ticket types. The assignment screenshot was also repositioned.

The article now uses revised headings, wording, links, and step-by-step instructions. Prerequisites and details about supported Purview information types, labels, and sensitivity thresholds were clarified.

The enhanced agent for Defender for SQL Servers on Machines supports resource- and subscription-level enablement for SQL Server instances on Azure VMs and Azure Arc-enabled machines in Azure Government, without requiring Azure Monitor Agent deployment.

The article received wording, capitalization, punctuation, and formatting improvements. The validation steps remain the same, including sending a suspicious `User-Agent` value, and screenshots now support lightbox viewing.

The article’s title, introduction, prerequisites, navigation steps, ServiceNow selection instructions, and grace-period wording were revised for clarity and consistency.

The article now uses Microsoft Defender for Servers Plan 2 terminology and clearer wording for the 500 MB per-node daily allowance, subscription-wide calculation, and Log Analytics workspace application.

The documentation now presents the Azure, Defender CSPM, Endor Labs account, API key, and role prerequisites in clearer noun-phrase format. The portal instruction was also changed from “Navigate to” to “Go to.”

The article updates prerequisite wording, navigation text, capitalization, and makes the environment-settings screenshot expandable.

The procedure now uses revised wording for the outcome, Azure portal navigation, and Databases plan controls. It states that disabling the plan stops SQL alerts and recommendations for selected machines.

The article now applies to both Azure commercial and Azure Government clouds, replacing the separate Government-cloud article reference.

The article’s applicability changed from Azure commercial cloud only to both Azure commercial and Azure Government clouds.

The SQL machine protection documentation now links to instructions for verifying SQL machine protection in government cloud.

The article now uses clearer wording for deploying the Defender sensor and Azure Policy, verifying automatic provisioning, Azure Arc extensions, RBAC permissions, and GKE Autopilot resource limits. Step numbering and title capitalization were also updated.

The article updates its title and prerequisite section wording, and clarifies that the created access token grants Defender for Cloud read-only access.

The article now applies to both Azure commercial and Azure Government clouds instead of directing Government-cloud users to a separate article.

The feature-availability page was refreshed, including metadata and reference links. The Codeless Connectors Platform entry remains in public preview, while its final availability field changed from No to Yes.

The documentation now describes Airlock Digital SaaS polling, self-hosted polling, and push connectors, including supported data tables, prerequisites, setup, and connection behavior.

Microsoft added a guide covering prerequisites, Partner Center publishing, and Azure Government endpoint updates for Sentinel CCF data connector solutions.

The reference adds mappings for Fortra Agari, Airlock Digital, BloodHound Enterprise, and Cisco Meraki connectors, updates ASim and Armis entries, and removes several older mappings.

The publishing guidance now links to separate instructions for making published solutions that include a CCF data connector available in Azure Government.

The guide now states that, after publishing a CCF data connector solution to Azure public cloud, publishers must enable Azure Government for the plan in Partner Center.

The page clarifies that Standard deployments use each of the three models once, refers to required model deployments for the Foundry resource, and consolidates the guidance that disconnecting Foundry disables agentic code scanning unless another connection is provided.