Thursday, 29 October 2026

The documentation now lists the CloudKeyVaultEvents table, marked Preview, for operations performed against Azure Key Vault resources.

The table now documents fields for call type, activity details and status, initiators, recipients, tenants, account types, and client platforms. The page also removes a note about planned event streaming API, Microsoft Sentinel integration, and additional attributes.

The EmailEvents table documentation now states that IsFirstContact applies only to inbound email. The Topics column entry was removed, and related metadata links were updated.

The five-step guidance was reformatted from separate sections into a compact table, with minor wording edits and inline resource links.

The page now lists Windows Antivirus platform 4.18.26100.4, engine 1.1.26100.4, and security intelligence 1.463.1.0, released October 27, 2026. It documents lower CPU usage after full scans, recognition of security-settings-managed devices, and completed Clipboard Protection rollout.

The Linux preferences page now links to a different ontology entry, and the Audit table label no longer includes “Preview.” The Audit description is unchanged.

The page now documents the Defender XDR CallActivityEvents table, which contains details about activities performed during Microsoft Teams calls and meetings. Page metadata and taxonomy links were also updated.

The page now documents hunting across Microsoft Teams call and meeting activities with the CallActivityEvents advanced hunting table and marks the capability as supported.

The Safe Links documentation now includes Outlook for iOS and Android among the clients where API-based URL checks apply when URL wrapping is disabled.

The guide now links to the CallActivityEvents table, which contains raw data about activities during Microsoft Teams calls and meetings. The documentation date was also updated.

The article now covers posture policies in the Defender portal, including prerequisites, eligible plans, RBAC permissions, policy types, scopes, and management actions.

The article now explains exemption use cases, compares exemptions with removing recommendation policy rules, and describes how to verify that an environment is managed in Defender. Screenshot descriptions and page metadata were also updated.

The documentation adds steps for creating and managing exemptions through Exposure Management > Policies > Exemption, including scope, conditions, justification, duration, and review. Only Defender-managed environments and assets can be selected, and updates to findings and posture metrics may be delayed.

The page now states that Defender for Cloud charges continue while scans are suspended and adds two reference links.

The page now states that Defender for Cloud charges continue while agentless VM scans are suspended. It also reiterates that existing snapshots incur storage charges until deleted and that the 250-snapshot safeguard is not a guarantee.

A new Microsoft Learn page explains how to create and manage recommendation exemptions, including scope, permissions, lifecycle, governance, and limitations. It also documents alternatives for devices, SaaS apps, identities, and data.

A new page explains posture policies, including their cloud-resource scope, Defender environment requirements, eligible-plan prerequisites, and RBAC permissions.