Daily Defender NewsThis documentation-heavy period’s most consequential updates describe a combined Defender for Endpoint and Defender for Servers experience in the Microsoft Defender portal, clarify when disabling Defender for Servers automatically offboards eligible servers, and replace manual support-log analyzer steps with self-contained Live Response workflows. Sentinel normalization guidance also adds a unified process-event parser pattern, while most remaining edits are narrower reference, navigation, or release-entry maintenance.
Endpoint · Endpoint protectionThe Endpoint page now describes bringing Defender for Endpoint and Defender for Servers together in the Microsoft Defender portal for Azure and on-premises servers, covering server asset views, investigations, hunting, RBAC, and device groups. It states that existing Defender for Endpoint servers require no onboarding, reinstallation, or migration; administrators should still review capability requirements before changing configuration.
Defender for Cloud · Architecture and deploymentThe Defender for Cloud tutorial states that disabling Defender for Servers for Azure subscriptions in public preview automatically offboards eligible servers, while switching from Plan 2 to Plan 1 does not trigger automatic offboarding. Administrators should account for that distinction when changing coverage.
Endpoint · TroubleshootingThe updated Endpoint procedure replaces manual analyzer-download steps with self-contained binary or Python Live Response action pairs, adds package validation and workspace-ID handoff, and specifies prerequisites and HTTPS requirements. It also documents a local workflow for devices without Microsoft endpoint access; binary actions do not require Python, while Python actions do.
Sentinel · Developer and APIThe normalization schema page now documents imProcessEvent for querying all process event types while retaining specialized parsers. It also revises custom-parser naming guidance and the filtering example, giving parser owners updated names and query patterns to apply.
Exposure Management · Developer and APIThe Exposure Management guide directs administrators to Agentic code scanning management, select Add another beside Source code environment, and choose Azure DevOps to open the connector flow. Connector configuration should follow that updated navigation.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The page now describes bringing Defender for Endpoint and Defender for Servers together in the Microsoft Defender portal for Azure and on-premises servers. It covers server asset views, investigations, hunting, RBAC, and device groups.
The documentation explains that disabling Defender for Servers automatically offboards eligible servers. It also describes exclusions, processing times, verification, retry behavior, and what happens when the plan is re-enabled.
The release page now lists Android version 1.0.9330.0101, released September 30, 2026, with performance improvements and general bug fixes.
The guidance replaces manual analyzer download steps with self-contained binary or Python Live Response action pairs. It adds package validation, workspace-ID handoff, explicit prerequisites, HTTPS requirements, and a local-workflow alternative for devices without Microsoft endpoint access.
The instructions now state that the Source tab displays the message body as HTML with links disabled. The separate Plain text tab description was removed, and the metadata date was updated.
The experience combines Microsoft Defender for Endpoint and Defender for Servers data, enabling unified inventory, cross-service investigations, Go hunt, and access management through RBAC, device groups, and cloud scopes. Administrators can also offboard eligible servers from Defender for Endpoint by disabling Defender for Servers for a subscription.
The FAQ metadata date changed from June 9, 2026, to September 23, 2026.
The documentation now states that disabling Defender for Servers for Azure subscriptions in public preview automatically offboards eligible servers. Switching from Plan 2 to Plan 1 does not trigger automatic offboarding.
The documentation adds AgentEvent and AssetEntity entries, updates the ProcessEvent listing, and revises parser examples to show explicit parameter-to-column mappings. Several examples also include fields such as `pack` and `disabled`.
The parser-management documentation updates custom unifying-function examples to pass `disabled=disabled` where supported, including AgentEvent and DNS parser examples, and adds or updates parser entries.
The documentation now lists the `_Im_AgentEvent_AnthropicClaudeCompliance` parser, its BlueVoyant Codeless Connector Framework source, and that it uses the pack parameter. The page date was also updated.
The page adds an Email Event mapping to `_Im_EmailEvent`, updates the Process Event mapping to include `_Im_ProcessEvent`, and refreshes ontology links and the publication date.
The page now documents `imProcessEvent` for querying all process event types, retains specialized parsers, revises custom parser naming guidance, and updates the filtering example.
The instructions now direct administrators to Agentic code scanning management, select Add another beside Source code environment, and choose Azure DevOps to open the connector flow.
The guide now instructs administrators to select GitHub under Source code environment, rather than Azure DevOps, and proceed to the GitHub connector flow.
