Governance Relationships
Doc updateThe page updates its DevRel reference links and removes the “Important” callout stating that the feature is currently in preview.
Day in brief
App Governance retires two EWS-based detections effective October 15
The period's most consequential change is an App Governance retirement: two EWS-based detections are now retired and no longer generate alerts. Other substantive updates refine the documented scope of Microsoft Store vulnerability assessment, add Defender for Identity GPO risk-assessment guidance, expand the Cloud Apps migration support list, and announce localized default Mark and notify messages in Defender for Office 365.
- Two EWS-based App Governance detections are now retired
Cloud Apps · Cloud and workloadsAs of October 15, 2026, two EWS-based detections are marked Retired and no longer generate alerts. Cloud Apps administrators should not rely on them for detection coverage after that date.
- Defender for Identity guidance adds two GPO assessment scenarios
Identity · Identity protectionThe updated guidance now covers excessive local-group privileges granted by Group Policy Objects and reversible passwords stored in Group Policy Preferences. It includes the associated risks, user impact, remediation steps, and dependencies to check before making changes.
- TVM now describes limited Store-app vulnerability coverage
Vulnerability Management · GeneralThe Software Inventory page no longer labels Microsoft Store applications as Preview or lists individual supported apps. It now states that vulnerability assessment is available for a limited set of commonly used Microsoft Store applications.
- Cloud Apps migration guidance adds auto-labeling and four DLP sourcesCloud Apps · Cloud and workloads
The guide now lists auto-labeling migration for SharePoint and OneDrive, plus DLP file-policy migration for Google Workspace, Box, Dropbox, and Salesforce. The previous list contained only SharePoint and OneDrive DLP migration, so administrators should use the revised support list when planning migrations.
- Defender for Office 365 will localize the default notification template
Defender XDR · GeneralThe default “Mark and notify” email template will be localized according to each user's Outlook language settings, with global rollout starting in June 2026. Message classification and custom templates remain unchanged, and no administrator action is required.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
17 updates
Microsoft Defender XDR
2 updatesMicrosoft Defender for Office 365 will localize the default "Mark and notify" email template based on users' Outlook language settings, improving clarity in user-reported message notifications. Rollout starts June 2026 globally, with no changes to message classification or custom templates. No action is required.
Microsoft Defender for Endpoint
6 updates
Whats New In Microsoft Defender Endpoint
Generally availableThe October 2026 entry replaces the previous Preview listing for vulnerability assessment of applications installed via the Microsoft Store, including Microsoft Teams.
The page updates headings, links, portal navigation wording, and instructions for connecting Defender for Endpoint to Intune and creating Android app protection policies.
The article title, metadata links, and wording were updated. Examples of fileless-malware techniques were rephrased, and the PowerShell guidance paragraph was removed.
The page received wording, formatting, and accessibility edits. It clarifies when automated investigation and remediation can start, links to its overview, refines alert-severity descriptions, and updates the screenshot text.
Understand the Client Analyzer HTML Report - Microsoft Defender for Endpoint | Microsoft Learn
Doc updateThe page title and description were refined, screenshot captions now describe each image, and wording and punctuation were clarified throughout the report guidance.
The Client Analyzer feedback page now uses direct links to the Microsoft Defender portal and centralized feedback platform, with minor title and wording updates.
Microsoft Defender for Office 365
3 updates
Anti Spam Bulk Complaint Level Bcl About
Doc updateThe page now explains that `X-MS-Exchange-Organization-BulkStamping` is used only during message transport and removed before delivery to the mailbox, so recipients cannot see it in message headers.
Defender For Office 365 Whats New
Feature updateThe EmailPostDeliveryEvents table documentation now includes the ApproverUpn field, which identifies the approving user or administrator.
Safe Links About
Doc updateThe Safe Links documentation date was updated, and its explanation of URL scanning before delivery, at click time, and through the client-side API was revised.
Microsoft Defender for Identity
1 updateThe page now documents assessments for excessive local-group privileges granted by GPOs and reversible passwords stored in Group Policy Preferences, including risks, user impact, and remediation steps.
Microsoft Defender for Cloud Apps
3 updatesApp Governance Anomaly Detection Alerts
RetirementThe article now states that, as of October 15, 2026, two EWS-based detections are marked Retired and no longer generate alerts.
Migrate File Policies To Purview
Feature updateThe guide now lists auto-labeling migration for SharePoint and OneDrive, plus DLP file-policy migration for Google Workspace, Box, Dropbox, and Salesforce. Previously, it listed only SharePoint and OneDrive DLP migration as supported.
Caac Known Issues
Doc updateThe documentation now explains that protection applies across tenants within the same Microsoft Edge work-profile session. Separate Edge work profiles provide separate session enforcement between tenants.
Microsoft Sentinel
1 updateData Connectors Reference
Doc updateThe connector reference now uses a relative setup-guide link, an anonymized server URL example, and reformatted CrowdStrike region mapping table.
Tvm Software Inventory
Doc updateThe page no longer labels Microsoft Store applications as Preview or lists individual supported apps. It now states that vulnerability assessment is available for a limited set of commonly used Microsoft Store applications.