Daily Defender NewsDefender for Identity guidance now documents two deployment constraints: v3.x sensor activation without Microsoft Defender for Endpoint is temporarily unsupported in government clouds, while v2.x sensor installation in new workspaces created from October 2026 is restricted in preview. The period also adds the CloudKeyVaultEvents advanced-hunting table for Azure Key Vault activity, revises Sentinel connector status references, and expands Defender XDR role-permission guidance.
Identity · Identity protectionThe Defender for Identity What's New guidance states that activating the v3.x sensor without Microsoft Defender for Endpoint is temporarily unsupported in government cloud environments.
Identity · Identity protectionInstall Sensor guidance marks the v2.x sensor restriction for new workspaces as preview. For workspaces created from October 2026, eligible Windows Server 2019 or later domain controllers are directed to the v3.x deployment guidance and onboarding package.
Defender XDR · Hunting and detectionThe new Defender XDR table documents Azure Key Vault operations, access identities, request details, and operation results, with schema fields and sample queries. Queries require Microsoft Defender for Cloud.
Sentinel · Cloud and workloadsThe Sentinel Tables Connectors Reference marks the Atlassian Jira Audit and SecurityScorecard Factor connectors as deprecated. It also updates connector names and links, removes GoogleCloudSCC, adds entries, and changes availability indicators for multiple connectors.
Defender XDR · GeneralThe role comparison page now lists Management permissions for reading or managing environment connections, plan enablement, and policy configuration.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Microsoft added documentation for the CloudKeyVaultEvents table, which contains Azure Key Vault operations, access identities, request details, and operation results. The page includes schema fields and sample queries.
Microsoft Defender for Office 365 will add two new Advanced Hunting tables—SubmissionEvents and SubmissionResults—providing enhanced visibility into email submission activity. Public Preview starts mid-November 2026; General Availability begins late November 2026. No immediate action or compliance concerns are required.
The page now lists Management permissions for reading or managing core cloud security settings, including environment connections, plan enablement, and policy configuration.
The release notes now list iOS platform version 1.1.82230103, released October 24, 2026, with performance improvements and general bug fixes.
The documentation now states that v3.x sensor activation without Defender for Endpoint is temporarily unsupported in government clouds. It also documents a preview restriction on installing v2.x sensors in new workspaces starting October 2026.
The installation guidance now states that the v2.x sensor restriction for new workspaces is in preview. For workspaces created from October 2026, eligible Windows Server 2019 or later domain controllers are directed to the v3.x deployment guidance and onboarding package.
The documentation now states that activating the Defender for Identity v3.x sensor on servers without Microsoft Defender for Endpoint deployment is temporarily unsupported in government cloud environments.
Updated policy links and descriptions, removed preview labels from several VM security policies, and removed the displayed App Service and Function client-certificate entries.
The reference now labels Atlassian Jira Audit and SecurityScorecard Factor connectors as deprecated. It also updates connector names and links, adds several connector entries, removes GoogleCloudSCC, and changes availability indicators for multiple connectors.
The documentation now lists SAPBTPAVL_CL as supporting data collection rules and lake-only ingestion, with workspace transform DCR guidance. The Atlassian Jira Audit connector setup section was removed, and related links and URL examples were updated.
