Friday, 16 October 2026

Endpoint release notes add Platform 4.18.26090.9 and ASR path-handling details

The most consequential update adds Endpoint platform, engine, and security intelligence release details alongside protection-engine, update-reliability, ASR, and policy-exclusion notes. Defender for Cloud also materially changes a SQL Server coverage query, while Defender XDR updates expand AI-agent blocking guidance and remove preview labels from several custom-role headings.

• Endpoint · Endpoint protection

  Endpoint release documentation adds platform, engine, and intelligence versions

  The page now lists Platform 4.18.26090.9, Engine 1.1.26090.9, and security intelligence 1.461.1.0. It also documents automatic protection-engine refresh, improved update reliability, ASR path handling, policy-exclusion retention, and the renamed PowerShell property ConfigurationProtection.

• Defender for Cloud · Cloud and workloads

  SQL Server coverage KQL now filters through Log Analytics workspaces

  The example now queries SQL Vulnerability Assessment records, filters resources by Log Analytics workspace IDs, and returns workspace ID, machine name, and machine UUID. The previous subassessment, OnPremiseSql, and 30-day scan-time filters were removed, so saved queries should be reviewed.

• Defender XDR · General

  AI-agent protection guidance maps blocks across requests and responses

  The guidance now covers malicious content propagation, secret exfiltration, evasion techniques, and unsafe email domains. It explains how enabled blocking rules affect user requests, model responses, tool requests, and tool responses.

• Defender XDR · General

  Custom RBAC role headings remove preview labels

  The MTO URBAC page no longer includes “(Preview)” in headings for creating or editing custom roles, deleting roles, and importing roles. Reference links were also updated.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.