Microsoft Defender for Identity will auto-enable sensor v3.x activation and Windows event auditing for eligible tenants starting late October 2026, easing setup for security admins. A portal banner allows opt-out before rollout; manual control remains afterward. Review configurations and update guidance accordingly.
Day in brief
Foundational CSPM will default off for new Azure subscriptions October 27
The main operational change is a Defender for Cloud default-setting shift: Foundational CSPM will remain free but will no longer be enabled automatically for new Azure subscriptions from October 27, 2026. Related updates clarify Defender for Servers billing treatment, while Defender for Office 365 is adding email-submission data to Advanced Hunting. Office 365 guidance also tightens the documented format for Punycode URLs.
- Foundational CSPM default changes for new Azure subscriptions
Defender for Cloud · Cloud and workloadsStarting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. The plan remains free and can be enabled at any time; existing subscriptions and AWS or GCP environments are unaffected.
- Defender for Servers revises device classification and server countingDefender for Cloud · Cloud and workloads
Plan 1 will no longer bill desktop, workstation, and mobile devices as servers. For Plans 1 and 2, server identification will run more frequently and count deployed machines individually, which may change billed server totals.
- Starting-state VMs are included in Defender for Servers billing guidanceDefender for Cloud · Cloud and workloads
The Defender for Servers FAQ now states that virtual machines in the Starting power state are billed and links to upcoming billing updates. Administrators should include these VMs when estimating costs.
- Advanced Hunting adds email submission telemetry tables
Defender XDR · Hunting and detectionMicrosoft Defender for Office 365 will add the SubmissionEvents and SubmissionResults Advanced Hunting tables, rolling out worldwide in early October 2026. They provide enhanced visibility into email submissions and support tailored detection workflows; no immediate action or compliance change is required.
- Tenant Allow/Block List guidance limits Unicode and Punycode URL formats
Office 365 · Email and collaborationThe documentation now states that Unicode is unsupported and that Punycode is allowed only in hostname labels before a normal ASCII top-level domain. Configured Punycode URLs should follow that format.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
11 updates
Microsoft Defender XDR
1 updateTenant Allow Block List Urls Configure
Feature updateThe documentation now states that Unicode is unsupported and Punycode is allowed only in hostname labels before a normal ASCII TLD.
Microsoft Defender for Cloud
8 updatesCloud Security Posture Management
Doc updateThe page now only states that Foundational CSPM is free. It no longer includes the October 27, 2026 opt-in notice for new Azure subscriptions or the AWS and GCP scope note.
Release Notes
Feature updatePlan 1 will no longer bill desktop, workstation, and mobile devices as servers. For Plans 1 and 2, server identification will run more frequently and count deployed machines individually, which may change billed server totals.
Faq Defender For Servers
Feature updateThe documentation now states that VMs in the Starting power state are billed and links to upcoming billing updates.
Defender For Servers Overview
Doc updateThe overview clarifies that a server is a device running a server operating system and links to the common questions page.
Foundational Cspm Opt In
Feature updateAction requiredStarting October 27, 2026, new Azure subscriptions will have Foundational CSPM disabled by default. The plan remains free; existing subscriptions and AWS/GCP environments are unaffected.
Release Notes
Feature updateStarting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. It remains free and can be enabled at any time; existing subscriptions and AWS or GCP environments are unaffected.
Plan Defender For Servers Select Plan
Doc updateThe Plan 1 documentation now defines a server as a device running a server operating system and links to the Defender for Servers FAQ.
Tutorial Enable Cspm Plan
Feature updateStarting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. The free plan will remain available at no cost and can be enabled at any time.
Ai Code Security Overview
Doc updateThe AI code security overview now lists `aspm-data-externalapi-prd.security.aspm.microsoft.com`.