Tuesday, 20 October 2026

The document’s listed author changed from monaberdugo to kschwabacher.

Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.

The page now lists Crystal Typhoon and Storm-2380, Storm-2570, Storm-2634, Storm-2990, Storm-2992, Storm-3069, Storm-3119, Storm-3168, and Storm-3189, including available aliases, classifications, and reference links. The page date was also updated and two internal authoring links were removed.

The documentation now states that block events from Microsoft Prompt Shields for Foundry, Copilot Studio, and Copilot Agent Builder are recorded as behaviors.

The page’s author metadata changed from EdB-MSFT (edbaynash) to Karinschwabacher13 (kschwabacher).

The document’s `ms.author` value changed from `pauloliveria` to `kschwabacher`.

The article now distinguishes automatic Azure offboarding, Defender for Servers coverage changes, manual endpoint offboarding, and endpoint software removal. It adds preparation steps, verification guidance, package-handling details, and method-specific procedures for Linux and Windows.

The documentation now lists Linux release 101.26091.0003, including updated release, engine, and signature versions. It also documents a libcurl 8.22.0 upgrade addressing CVE-2026-9546 and stronger quarantine authorization and path protections.

The page now links new deployments to server onboarding guidance and on-premises server connections to Defender for Servers, including automatic or manual deployment options and onboarding verification.

The guide now distinguishes automatic onboarding, manual deployment, and servers already reporting to Defender for Endpoint. It adds prerequisites, rollout preparation guidance, antivirus coexistence considerations, and a warning that Direct onboarding has tenant-wide scope.

The documentation now describes Defender for Identity sensor v3.x onboarding without Defender for Endpoint for eligible servers, including domain controllers, AD FS, AD CS, and Microsoft Entra Connect.

The page now links to entries covering malicious or suspicious MFA-device and method registration, organization branding changes by newly created users, and potential Certighost (CVE-2026-54121) AD CS abuse.

The guidance now applies to servers, specifically v3.x sensors deployed without Defender for Endpoint. Administrators must run the offboarding package on the server before deleting its portal entry; deleting the entry alone may leave the sensor active, sending data, and able to reactivate.

The page’s DevRel metadata links were updated, and the “AADInternals private key extraction attempt” alert entry was removed.

The documentation expands support for Defender for Identity sensor v3.x activation without Defender for Endpoint to eligible AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later, in addition to eligible domain controllers.

Windows Server 2019 or later AD FS, AD CS, and Microsoft Entra Connect servers are now documented as supporting sensor v3.x onboarding with or without Microsoft Defender for Endpoint.

The documentation now states that eligible servers can use sensor v3.x onboarding without Defender for Endpoint deployment, replacing the previous domain-controller-specific wording.

The new guidance covers global or scoped plan configuration across connected Azure commercial environments, required permissions, migration behavior, and the loss of resource-level configurations after migration. The capability is in preview.

The comparison now documents Defender portal preview support for environment onboarding, plan management, and cloud security cost reporting. It also clarifies that data export remains available in the Azure portal.

The documentation introduces Defender Workload Units (DWUs), a Cloud Security Cost Estimator, and a Cloud security cost report. It also describes updated workload measurements, plan consolidations, and DNS billing treatment.

A new page explains that moving plan management from the Azure portal to the Defender portal changes billing to Defender Workload Units, shifts configuration to tenant, management-group, or subscription scope, and may replace, consolidate, or measure plans differently. Resource-level configurations are not preserved, and migrated settings become view-only in Azure portal.

The documentation now states that cloud security data supports Azure, AWS, and GCP, while onboarding and plan management currently support Azure commercial environments only. After migration, plan settings become view-only in the Azure portal, resource-level configurations are not preserved, and billing uses Defender Workload Units.

On October 20, 2026, the expanded server security experience will support automated and manual onboarding for Azure, Azure Arc-enabled, Windows, Linux, and on-premises servers. Cloud security plan management will also become available in the Defender portal, including DWU cost tracking and eligible 30-day trials.

The page now documents supported environments, scope-level-only plan configuration, replacement of resource-level settings during migration, remaining Azure portal capabilities, and daily cost fluctuations.

New documentation describes connecting Azure subscriptions and management groups to Microsoft Defender for Cloud, including prerequisites, tenant preparation, and connector setup. The capability is in preview.

The Microsoft Learn page describing eligibility, required roles, enablement steps, and expected results for Defender for Cloud preview features in the Defender portal was deleted.

The procedure now states that direct onboarding affects all eligible existing and future non-Azure servers in the same Microsoft Entra tenant. Individual-server or pilot-group selection isn't supported, and prerequisites include healthy Defender for Endpoint telemetry, a matching tenant, and specific roles.

The documentation now describes connecting Azure commercial environments at subscription or management-group level and configuring Defender for Cloud plans for selected or all connected environments. AWS, GCP, and unsupported Azure environments must still be onboarded through the Azure portal.

The FAQ now explains that existing Defender for Endpoint servers need no changes, how to onboard new servers, Direct onboarding scope, offboarding options, and why historical records may remain visible. The offboarding link was also updated.

The documentation now states that updates to cloud scopes, including subscription changes, may take about 8–10 hours to appear in portal filters and scoped data views. During the refresh, results may be incomplete or empty even when the configuration was saved.

The article now states that the calculator covers the existing plan-pricing model and links to separate guidance for estimating costs with the Defender Workload Unit (DWU) pricing model.

The article now specifies that it covers enabling Defender for Cloud on an Azure subscription in the Azure portal and links to separate instructions for connecting Azure commercial subscriptions or management groups in the Microsoft Defender portal.

The documentation now maps legacy plans to new plans, including default serverless protection in Defender CSPM, revised billing units, consolidated Databases and API plans, and discontinued DNS coverage. DNS protection can be maintained by manually enabling Defender for Servers Plan 2, with possible additional charges.

The article now clarifies that it covers using Azure Policy to enable Defender for Cloud across subscriptions in a management group, and links to separate guidance for connecting Azure environments in the Defender portal.

The documentation now lists sensor versions 0.11.8, 0.10.11, 0.9.69, and 0.8.62, all released in October 2026 with security updates to sensor components and dependencies.