Daily Defender NewsThe substantive 1 October updates are mostly documentation guidance, but several now pin down settings and behaviors relevant to administrators. Endpoint guidance covers centrally scheduled Linux antivirus scans and clarifies secure-configuration scope; Defender for Office 365 provides more precise Teams reporting setup; Sentinel references add connector and table support details. Most of the remaining Defender for Business changes refresh navigation, terminology, and procedures.
Endpoint · Endpoint protectionThe updated Endpoint guidance now includes Windows Server 2022 and Windows Server 2025 in the device requirement. It also states that local administrator-defined antivirus exclusions are not honored by default and can be enabled through Defender or Intune policy.
Endpoint · Endpoint protectionThe Microsoft Defender Endpoint Releases page now documents centrally scheduled Linux antivirus scans through managed JSON and Defender Portal policies. It also adds release information covering detection of critical Node.js, Python, and Java libraries, the libcurl 8.20.0 security update, and Windows Antivirus August 2026-2 fixes.
Office 365 · Email and collaborationThe updated Teams submissions guidance points administrators to the Teams user reported settings page and provides Exchange Online PowerShell commands for viewing and configuring report destinations: Microsoft, a reporting mailbox, or both.
Sentinel · Cloud and workloadsThe Cisco Meraki connector reference now documents File Scanned detections and the `CiscoMerakiFileScannedEvents_CL` table. It also marks the F5Telemetry LTM and RFI Playbook Alert Results tables as supported and documents workspace transform DCR support.
Business · Endpoint protectionThe revised policy-order guidance states that only the highest-priority applicable policy is applied. Default policy priority remains fixed; newly created policies receive a priority, and moving them changes the position of default policies.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now covers centrally scheduled Linux antivirus scans through managed JSON and Defender Portal policies, expanded detection of critical Node.js, Python, and Java libraries, a libcurl 8.20.0 security update, and Windows Antivirus August 2026-2 details and fixes.
The documented device requirement now includes Windows Server 2022 and Windows Server 2025. The local exclusion guidance also clarifies that local administrator-defined antivirus exclusions are not honored by default and can be enabled through Defender or Intune policy.
The article now points administrators to the Teams user reported settings page and documents Exchange Online PowerShell commands for viewing and configuring Teams report destinations: Microsoft, a reporting mailbox, or both.
The article’s metadata links and update date changed. Teams-specific explanatory text and several Teams-related parameters were removed from the reported-message policy examples.
The setup instructions now direct administrators to the Teams user reported settings page and its updated URL when verifying Microsoft Teams monitoring. The document date was also updated.
Customers in Worldwide environments with Defender for Office 365 Plan 1 or 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page from email settings.
The page date changed to September 28, 2026, and the reporting guidance now links directly to the Teams user reporting settings section.
The Cisco Meraki connector now documents File Scanned detections and the `CiscoMerakiFileScannedEvents_CL` table. F5Telemetry LTM and RFI Playbook Alert Results tables are marked supported, and workspace transform DCR support is documented.
The reference now lists CiscoMerakiFileScannedEvents_CL and changes F5Telemetry_LTM_CL and RFI_PlaybookAlertResults_V2_CL from No/No to Yes/Yes in the two status columns.
The article now uses clearer wording for device replacement and retirement, inactive-device status, data retention, and exposure-score treatment. It also standardizes platform labels, portal links, and package and script instructions.
The article title, description, wording, image text, lists, and portal links were updated. Guidance on reviewing and editing policies in the Defender portal or Intune remains central.
The page updates its title and wording, simplifies the introduction and license-review step, and links directly to the Microsoft Defender portal.
The page title and wording were updated, the introductory “What to do” section was removed, and guidance for alert, vulnerability, and user-assignment rules was simplified.
The page updates portal capitalization, links the first portal reference directly to security.microsoft.com, and clarifies wording and punctuation in navigation descriptions.
The page now frames prerequisites around subscriptions, user accounts, browsers, and client operating systems, with clearer wording and links for accounts, permissions, operating systems, Microsoft Entra ID, and Conditional Access.
The page updates portal links, changes “details flyout” to “details pane,” improves punctuation and phrasing, and revises antivirus mode descriptions and terminology.
The article updates wording, links, step references, and portal terminology such as “flyout pane.” Instructions continue to cover firewall policies, custom rules, profiles, and the 150-rule limit.
The page title and description were updated, and wording throughout the article was revised for clarity, including role guidance and steps for reviewing incidents and releasing contained devices.
The article’s title capitalization, punctuation, portal references, and settings-table wording were updated. Microsoft Defender portal references are now clickable links.
The article now clarifies when to use the Defender portal or Intune admin center, adds links to both portals, and improves wording, formatting, and policy-setting descriptions.
The article received clearer wording, corrected action-list formatting, updated Action Center links, and two related-concepts links.
The article was revised with clearer descriptions of device groups, updated terminology, and refreshed create/edit policy instructions and formatting.
The article updates wording, image text, punctuation, and navigation links, including direct links to the Microsoft 365 admin center and Purchase services page. Placeholder direct URLs for the Devices page were removed.
The overview now has revised introductory and capability descriptions, clearer image text, corrected grammar, and improved table and footnote formatting.
Updated capitalization, wording, links, punctuation, footnote formatting, and troubleshooting instructions on the Defender for Business mobile threat defense page.
The page now uses formatted links and more concise, consistent wording throughout its report descriptions and instructions.
The page title, description, and several guidance phrases were revised, including wording about videos, customer portal access, and Defender for Endpoint API integrations.
The documentation now more clearly explains policy priority, how to change the order of custom policies, and that only the highest-priority applicable policy is applied.
The page now states that administrators can add a user and purchase additional licenses, with a link to related Microsoft 365 guidance. Titles, punctuation, and image description text were also updated.
The FAQ title capitalization, sentence punctuation, and wording were updated, including a change from “via” to “by.”
The page now presents Microsoft 365 Lighthouse guidance for CSPs and MSPs, links directly to the Lighthouse portal, updates the screenshot text, and removes the separate “Learn more” section and links.
The page title was capitalized consistently, “Microsoft Defender portal” was shortened to “Defender portal,” and “flyout” was clarified as “flyout pane.”
The page received wording, formatting, capitalization, and punctuation updates, plus linked references to the Defender, Intune, and Azure portals. The introduction now notes that several device onboarding options are available.
The page title and heading now capitalize “Attack Surface Reduction.” The text also uses “cyberattack” and revises punctuation around configuration method examples.
