Wednesday, 14 October 2026

The schema page no longer labels AgentsInfo as Preview and no longer lists AIAgentsInfo.

The documentation now describes the transition from `AIAgentsInfo` to the unified `AgentsInfo` table, which expands beyond Copilot Studio-specific columns.

The page no longer includes the notice that some information concerns prereleased products subject to substantial change before commercial release.

The AIAgentsInfo advanced hunting table is transitioning to AgentsInfo. AIAgentsInfo remains accessible until July 1, 2026, and its reference documentation was removed.

The What's new entries for the preview AgentsInfo and AIAgentsInfo advanced hunting tables now show table names as inline code instead of linked text.

The documentation adds steps for disabling a built-in alert tuning rule and states that each alert tuning rule supports up to 200 conditions.

The documentation now states that the built-in rule took effect in early October 2026. DLP signals are treated as behaviors, so they do not generate alerts or appear in the incident queue, but remain available in advanced hunting.

The FAQ now explains that security tools can generate click telemetry during content inspection, recommends built-in simulation reports, and notes that Safe Links and UrlClickEvents may not capture all simulation activity.

The documentation now explains how to select a built-in rule on the Alert tuning page and disable it from the rule details pane, with a screenshot.

The documentation now refers to automated inspection of the simulation payload in the Clicked Message Link entry, replacing wording about non-Microsoft filtering services.

The article now explains how to select a built-in rule on the Alert tuning page and choose Disable, with a supporting screenshot.

The prerequisite changed from the July 2026 to the September 2026 or later Windows Server cumulative update. Post-migration guidance now covers manually removing workspace DSA or gMSA configuration and retiring unused gMSA accounts after verifying they have no other users.

The FAQ now states that offboarding a server from Defender for Endpoint stops Defender for Identity v3.x sensor reporting, including sensors migrated from v2.x, and does not automatically enable identity-only mode.

The alert catalog now includes updated descriptions and fields, plus entries for several OAuth, Okta, Kerberos, AD CS, and DPAPI-related alerts. The malicious MFA device registration severity is shown as High.

The October announcement adds 19 alerts covering Entra ID, Active Directory, and other identity providers, including Okta, with links to detailed alert information.

The health alerts page revises the entry describing a missing or incorrectly applied Unified Sensor RPC Audit configuration tag and its resolution steps.

The documented prerequisite changed from the July 2026 or later cumulative update to the September 2026 or later cumulative update.

The archive entry for “Suspicious network connection over Encrypting File System Remote Protocol” now links to the “Suspected PetitPotam coercion attack” section.

The prerequisite changed from the July 2026 to the September 2026 Windows Server cumulative update for sensor version 3.0.10 or later. The guidance also clarifies v2 migration account settings and that migration does not automatically remove workspace DSA or gMSA configuration.

The documented prerequisite for Windows Server 2019 or later changed from the July 2026 cumulative update to the September 2026 cumulative update.

The documentation now states that deletion authorization failures involving 250 or more Defender-tagged snapshots suspend new scans for the affected AWS scope. Snapshots continue accruing storage charges until deleted.

When 250 or more Defender-tagged snapshots accumulate because deletion authorization fails, new scans are suspended for the affected AWS scanning scope to limit additional storage charges.

The instructions now use Create > Logic App playbook and distinguish Consumption triggers—including alert, case, and legacy options—from Standard playbooks, which start with Blank playbook. The page also explains case-versus-incident terminology and adds supporting links.