The documentation now explains how to grant Microsoft Sentinel permissions to delegated remote tenant groups through Defender URBAC, including required permissions, role assignment, and workspace selection. It also retains the resource-group assignment option and clarifies management-plane versus data-plane access.

The user investigation documentation revises its authoring reference links and changes `GraphApiAuditEvents` to `GraphAPIAuditEvents`.

The document’s listed author changed from monaberdugo to kschwabacher.

Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.

The page now lists Crystal Typhoon and Storm-2380, Storm-2570, Storm-2634, Storm-2990, Storm-2992, Storm-3069, Storm-3119, Storm-3168, and Storm-3189, including available aliases, classifications, and reference links. The page date was also updated and two internal authoring links were removed.

The documentation now states that block events from Microsoft Prompt Shields for Foundry, Copilot Studio, and Copilot Agent Builder are recorded as behaviors.

Administrators can select specific detection sources within service sources when creating or editing alert tuning rules, including include/exclude choices for existing rules.

Updated reference links and removed “(Preview)” from the headings for creating or editing custom roles, deleting roles, and importing roles.

The documentation now describes malicious content propagation, secret exfiltration, evasion techniques, and unsafe email domains, including how blocking affects user requests, model responses, tool requests, and tool responses.

The page adds two reference links, refreshes the Microsoft Sentinel table entry, and adds a sample two-column table.

The page updates its DevRel reference links and removes the “Important” callout stating that the feature is currently in preview.

Microsoft Defender for Office 365 will localize the default "Mark and notify" email template based on users' Outlook language settings, improving clarity in user-reported message notifications. Rollout starts June 2026 globally, with no changes to message classification or custom templates. No action is required.

The What's new entries for the preview AgentsInfo and AIAgentsInfo advanced hunting tables now show table names as inline code instead of linked text.

The documentation adds steps for disabling a built-in alert tuning rule and states that each alert tuning rule supports up to 200 conditions.

The documentation now states that the built-in rule took effect in early October 2026. DLP signals are treated as behaviors, so they do not generate alerts or appear in the incident queue, but remain available in advanced hunting.

The page now states that detection rules involved in creating a source incident are added to the target incident. It also explains that correlation settings control alerts from analytics rules or custom detections.

Microsoft Defender for Office 365 extends Teams URL protection to detect malicious URLs in QR codes post-delivery, warning users and enabling security teams to investigate via Advanced Hunting. Rolling out worldwide from October to November 2026, no user action is required, but admins should review related settings and processes.

The virus initiative criteria page updates its VB100 entry from Grade C or higher to Grade B or higher for a 95% detection rate. Its platform identifier was also updated.

The documentation now explains that identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. It clarifies Unified RBAC permissions for both products’ data sources and adds guidance on role assignments and data-source scope.

The `AadDeviceId` column is being replaced by `EntraIdDeviceId`. `AadDeviceId` will remain available for 30 days to support query updates.

The page’s author metadata changed from EdB-MSFT (edbaynash) to Karinschwabacher13 (kschwabacher).

The document’s `ms.author` value changed from `pauloliveria` to `kschwabacher`.

The table reference replaces DnsEventType and DnsEventSubType with EventType and EventSubType, and updates the request-filter example accordingly.

The schema page no longer labels AgentsInfo as Preview and no longer lists AIAgentsInfo.

The documentation now describes the transition from `AIAgentsInfo` to the unified `AgentsInfo` table, which expands beyond Copilot Studio-specific columns.

The page no longer includes the notice that some information concerns prereleased products subject to substantial change before commercial release.

The AIAgentsInfo advanced hunting table is transitioning to AgentsInfo. AIAgentsInfo remains accessible until July 1, 2026, and its reference documentation was removed.

The documentation now covers including or excluding custom detections from Microsoft Defender XDR correlation on a per-rule basis. Custom detections are included by default; exclusions create predictable single-alert incidents when no matching grouping rule applies.

The documentation now states that custom detections are included in correlation by default and have a per-rule option to include or exclude them.

Microsoft Defender for Office 365 is adding two new Advanced Hunting tables, SubmissionEvents and SubmissionResults, to enhance email submission visibility and detection workflows. Public Preview starts early October 2026; General Availability begins late October 2026. No immediate action or compliance concerns are required.

The Hunts overview documents an experience for viewing in-progress and completed expert-led hunts, including hunt types, statuses, outcomes, and supporting details in the Defender portal.

The Edit description no longer mentions flexible frequency and lookback being in public preview or links to related guidance. Author and date metadata also changed.

Custom frequency from 5 minutes to 14 days is available only for rules based exclusively on Microsoft Sentinel data. Rules using Defender XDR data now use fixed lookback periods based on their run frequency, ranging from 4 hours to 30 days.

The documentation now describes independently configuring detection frequency from 5 minutes to 14 days and lookback from 5 minutes to 30 days across supported data sources. Lookback must be at least as long as the frequency to avoid coverage gaps.

The Edit option description now notes flexible frequency and lookback for all supported data sources and links to further guidance.

Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.

Microsoft Defender for Office 365 will tag promotional emails as “promotions” and can auto-move them to a Promotions folder, learning from user actions. Public preview starts mid-April 2026; general rollout completes by late 2026. Admins control settings; users can customize via message moves.

Updated October 19, 2026: We have identified that this message did not reach it's intended audience. You can safely disregard this message, and we apologize any confusion this may have caused.

The what's new documentation now uses the table name `GraphAPIAuditEvents` when describing Microsoft Entra ID API requests to Microsoft Graph API.

Microsoft Defender Vulnerability Management is privately previewing expanded vulnerability coverage for selected Node.js, Python, and Java packages on Windows devices. It integrates with existing workflows, APIs, and exports, with rollout planned from September to December 2026. Organizations should prepare for increased data volume and validate integrations before enabling.

The Defender for Endpoint What's New page now lists macOS release version 20.126082.12.0 as GA and links to its enhancements and features.

The documentation now covers Windows, Linux client and server, macOS, Android, and iOS offboarding. It also distinguishes subscription-wide Azure server offboarding from manual individual-server offboarding and clarifies that offboarding does not uninstall software.

The macOS 101.26082.0012 release adds EDR support for configuring AI agent runtime protection, plus Bluetooth permission and antivirus health reporting improvements, accessibility updates, reliability fixes, and performance fixes.

The Windows Defender Antivirus documentation now lists `DefenderSessionHelper.exe` in the Details tab for Microsoft Defender Clipboard Protection, with Processes and Services marked N/A. The page date and reviewer metadata were also updated.

The article now distinguishes automatic Azure offboarding, Defender for Servers coverage changes, manual endpoint offboarding, and endpoint software removal. It adds preparation steps, verification guidance, package-handling details, and method-specific procedures for Linux and Windows.

The documentation now lists Linux release 101.26091.0003, including updated release, engine, and signature versions. It also documents a libcurl 8.22.0 upgrade addressing CVE-2026-9546 and stronger quarantine authorization and path protections.

The page now links new deployments to server onboarding guidance and on-premises server connections to Defender for Servers, including automatic or manual deployment options and onboarding verification.

The documentation now clarifies that the mobile threat defense connector is the Defender for Endpoint–Intune integration, separates assignment steps, and refers to the automatic-launch control as a switch.

The page now lists supported Defender configuration areas, clarifies the onboarding and Managed Google Play prerequisites, and updates the Intune policy creation link and wording.

The page revises privacy wording, terminology, punctuation, and descriptions of collected data. The required-data list no longer includes basic browser information.

The page now describes the refreshed Android interface, including dashboards, feature tiles, alert cards, and the Device Protection feature card. It also clarifies the separate feedback and log-submission flows and updates screenshot descriptions, wording, and formatting.

The documentation adds Platform 4.18.26090.9, Engine 1.1.26090.9, and security intelligence 1.461.1.0 release details, including automatic protection-engine refresh, improved update reliability, ASR path handling, and policy-exclusion retention.

The October 2026 entry replaces the previous Preview listing for vulnerability assessment of applications installed via the Microsoft Store, including Microsoft Teams.

The page updates headings, links, portal navigation wording, and instructions for connecting Defender for Endpoint to Intune and creating Android app protection policies.

The article title, metadata links, and wording were updated. Examples of fileless-malware techniques were rephrased, and the PowerShell guidance paragraph was removed.

The page received wording, formatting, and accessibility edits. It clarifies when automated investigation and remediation can start, links to its overview, refines alert-severity descriptions, and updates the screenshot text.

The page title and description were refined, screenshot captions now describe each image, and wording and punctuation were clarified throughout the report guidance.

The Client Analyzer feedback page now uses direct links to the Microsoft Defender portal and centralized feedback platform, with minor title and wording updates.

The page updates capitalization, expands MSSP to “Managed Security Service Provider,” refines wording, and adds metadata links. The tenant-specific portal URL and access instructions remain documented.

The page title was capitalized consistently, explanatory text was split for readability, and the two inspection approaches—Agent-native event inspection and Network inspection—are now named explicitly.

The article refreshes terminology, links, permission formatting, navigation instructions, and screenshots for submitting files and file hashes through the Defender portal.

The page was updated with revised metadata, clearer On/Off selection steps, an endpoint screenshot, and added guidance explaining that scoped device group correlation can produce separate incidents for Global SOC users.

The article received clearer wording, standardized terminology and formatting, revised examples, and updated link text.

The page updates heading capitalization, formats navigation paths and code blocks, and restructures the supported operating systems section for clearer presentation.

The page title and description were refined, and explanations of real-time protection, hybrid detection, cloud protection, and detection engines were reworded for clarity. The description now highlights client and cloud engines, machine learning, and behavior monitoring.

The page title capitalization changed, its description now covers viewing, organizing, and managing alerts and investigating threats involving devices, files, and users, and its metadata links were updated.

The documentation now lists onboarding, security reporting, and iOS TVM as Mobile TVM service uses. It also warns that restrictive Conditional Access policies can disrupt these flows and recommends excluding the service from those policies.

The article now lists firewall and proxy URLs needed to onboard and maintain Microsoft Defender for Endpoint devices on Android and iOS, covering commercial and US Government cloud environments.

The documentation now clarifies that the DeviceTagging registry key supports only one tag in the Group value. Tags assigned through other methods aren't written there, so the registry value may not show all tags on a device.

A new Learn article documents supported local AI agents, MCP server discovery, and runtime protection scenarios, with support listed separately by operating system and configuration. It also explains that discovery depends on observed agent activity.

The article now uses broader descriptions of inspection points, streamlines explanations of agent-native and network inspection, updates discovery terminology, and removes the explicit event-point list and vendor links.

The documentation now states that Defender lists a local AI agent after observing activity on an onboarded device; installation alone does not guarantee discovery. It also clarifies that the inventory is not a complete software inventory and references the support matrix for coverage details.

The documentation states that Defender surfaces supported AI agents and MCP servers after observing activity on onboarded devices. An installed agent may not appear until it becomes active; the guidance also adds comparing query results with the discovery support matrix.

The page now describes bringing Defender for Endpoint and Defender for Servers together in the Microsoft Defender portal for Azure and on-premises servers. It covers server asset views, investigations, hunting, RBAC, and device groups.

The documentation explains that disabling Defender for Servers automatically offboards eligible servers. It also describes exclusions, processing times, verification, retry behavior, and what happens when the plan is re-enabled.

The release page now lists Android version 1.0.9330.0101, released September 30, 2026, with performance improvements and general bug fixes.

The Linux deployment article now explains how to embed the tenant-specific onboarding file in a golden image, keep `mdatp` stopped during image creation, and start Defender on clones only after their final hostname is set. It also adds onboarding and health verification steps.

The Defender Endpoint What's New entry now links to the preview-specific Microsoft Store applications section.

The documentation now covers centrally scheduled Linux antivirus scans through managed JSON and Defender Portal policies, expanded detection of critical Node.js, Python, and Java libraries, a libcurl 8.20.0 security update, and Windows Antivirus August 2026-2 details and fixes.

The documented device requirement now includes Windows Server 2022 and Windows Server 2025. The local exclusion guidance also clarifies that local administrator-defined antivirus exclusions are not honored by default and can be enabled through Defender or Intune policy.

The server onboarding page now links to `offboard-machines` instead of the `#offboard-servers` fragment.

The guide now distinguishes automatic onboarding, manual deployment, and servers already reporting to Defender for Endpoint. It adds prerequisites, rollout preparation guidance, antivirus coexistence considerations, and a warning that Direct onboarding has tenant-wide scope.

The page now more clearly highlights Android onboarding and Xiaomi Permanent Protection issues, and refines instructions for updating Microsoft Authenticator. Wording, screenshots, links, and formatting were also refreshed.

The guidance replaces manual analyzer download steps with self-contained binary or Python Live Response action pairs. It adds package validation, workspace-ID handoff, explicit prerequisites, HTTPS requirements, and a local-workflow alternative for devices without Microsoft endpoint access.

The page author metadata changed from paulinbar/painbar to limwainstein. The uninstall guidance continues to direct administrators to the Offboard Mac devices documentation for cleanup requirements.

The documentation now lists the languages supported by localized default notification templates, including English, Japanese, Spanish, Chinese, Korean, Portuguese, and others.

The documentation now says the features, including SOC experiences, should be available in all organizations by the end of October instead of mid-September.

The page now explains that `X-MS-Exchange-Organization-BulkStamping` is used only during message transport and removed before delivery to the mailbox, so recipients cannot see it in message headers.

The EmailPostDeliveryEvents table documentation now includes the ApproverUpn field, which identifies the approving user or administrator.

The Safe Links documentation date was updated, and its explanation of URL scanning before delivery, at click time, and through the client-side API was revised.

The FAQ now explains that security tools can generate click telemetry during content inspection, recommends built-in simulation reports, and notes that Safe Links and UrlClickEvents may not capture all simulation activity.

The documentation now explains how to select a built-in rule on the Alert tuning page and disable it from the rule details pane, with a screenshot.

The documentation now refers to automated inspection of the simulation payload in the Clicked Message Link entry, replacing wording about non-Microsoft filtering services.

As of July 2026, messages identified as bulk receive the Promotions tag and, when Bulk moves enabled is turned on, are moved from the Inbox to the Promotions folder only when they are promotional in nature, regardless of BCL value.

The instructions now state that the Source tab displays the message body as HTML with links disabled. The separate Plain text tab description was removed, and the metadata date was updated.

Users can report scheduled or Meet now Microsoft Teams meetings, or individual meeting participants, as security concerns during or after the meeting.

The documentation now covers reporting Teams meetings and meeting participants, including related metadata, the meeting reporting policy, and updated government-cloud limitations.

The guide now covers reported Teams meetings and meeting participants, including alert generation and Defender portal review locations. It also corrects alert wording and terminology.

The article now covers malicious activity in Teams messages, calls, and meetings, and lists messages, calls, meetings, and meeting participants as reportable items. It also links to Teams user reporting settings.

The guide now directs administrators to configure the Allow users to report meetings policy in the Teams admin center. The Defender portal step to verify Monitor reported items in Microsoft Teams remains.

The documentation now describes Data Security AI Admins and the Data Security AI Admin role as editing Data Loss Prevention policies without the previous “related to Copilot” qualifier. Access to view AI content remains documented, while prompt and response access remains excluded.

The article now points administrators to the Teams user reported settings page and documents Exchange Online PowerShell commands for viewing and configuring Teams report destinations: Microsoft, a reporting mailbox, or both.

The article’s metadata links and update date changed. Teams-specific explanatory text and several Teams-related parameters were removed from the reported-message policy examples.

The setup instructions now direct administrators to the Teams user reported settings page and its updated URL when verifying Microsoft Teams monitoring. The document date was also updated.

Customers in Worldwide environments with Defender for Office 365 Plan 1 or 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page from email settings.

The page date changed to September 28, 2026, and the reporting guidance now links directly to the Teams user reporting settings section.

The article now explains how to select a built-in rule on the Alert tuning page and choose Disable, with a supporting screenshot.

The page updates the Hybrid identity description, corrects the Risk score link, and points investigation guidance to non-human identities.

The article now points to two different authoring references.

The documentation now describes Defender for Identity sensor v3.x onboarding without Defender for Endpoint for eligible servers, including domain controllers, AD FS, AD CS, and Microsoft Entra Connect.

The page now links to entries covering malicious or suspicious MFA-device and method registration, organization branding changes by newly created users, and potential Certighost (CVE-2026-54121) AD CS abuse.

The guidance now applies to servers, specifically v3.x sensors deployed without Defender for Endpoint. Administrators must run the offboarding package on the server before deleting its portal entry; deleting the entry alone may leave the sensor active, sending data, and able to reactivate.

The page’s DevRel metadata links were updated, and the “AADInternals private key extraction attempt” alert entry was removed.

The documentation expands support for Defender for Identity sensor v3.x activation without Defender for Endpoint to eligible AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later, in addition to eligible domain controllers.

Eligible organizations with an active Defender for Identity workspace receive a 30-day banner before sensor v3.x activation and Windows auditing are enabled by default, including settings currently set to Off. Windows Server 2025 sensor migration support is also documented as resolved.

The guide now says to select “Automatically use the sensor's local system account” before migrating because migration does not change this setting automatically. It also instructs admins to verify that the setting remains selected instead of using gMSA for action accounts.

The documentation clarifies automatic Windows auditing for v3.x sensors, distinguishes it from automatic sensor activation, updates the listed auditing settings, changes the System event ID from 7045 to 4697, and directs administrators to use Certification Authority for CA auditing.

The page now separates v2.x and v3.x prerequisites, ports, and connectivity procedures. It adds v3.x guidance stating that the sensor uses Microsoft Defender for Endpoint service endpoints and clarifies expected test results and troubleshooting use.

The page now explicitly scopes DSA usage, recommendations, supported options, and selection behavior to Defender for Identity v2.x sensors. It also clarifies domain synchronizer responsibilities and improves wording.

The page now uses clearer deployment wording, fixes the static IP example and links, and separates auditing guidance for AD FS and AD CS servers.

The page now describes validating Defender for Identity sensors through portal data, advanced hunting, and test alerts. It also clarifies that queries should run separately and explains which placeholders to replace.

The guidance now specifies that automatic Windows event auditing applies to v3.x sensors and tells administrators to check the health issue table for the relevant sensor version before remediation. Several alert descriptions were also clarified.

The troubleshooting page now points scheduled-task and proxy silent-installation references to the corresponding sections under `deploy/install-sensor`; page metadata was also refreshed.

The article now applies its procedures and Directory Service Account requirement specifically to Defender for Identity v2.x sensors. Administrators using v3.x sensors are directed to separate deployment and configuration guidance.

The page now covers configuration and validation for Defender for Identity v2.x sensors, while directing v3.x users to separate post-activation guidance and shared deployment validation steps.

The article now explicitly states that action accounts with the required permissions are used for remediation actions and are separate from Directory Service Accounts.

The section now refers to removing the legacy Unified Sensor RPC Audit tag and clarifies that removing it does not disable automatic RPC auditing on v3.x sensors.

The guide now specifies that eligible Windows Server 2019 or later domain controllers should follow the v3.x deployment guidance, not the v2.x installer procedures. It also links to the v3.x onboarding package for deployments without Defender for Endpoint.

The page now documents assessments for excessive local-group privileges granted by GPOs and reversible passwords stored in Group Policy Preferences, including risks, user impact, and remediation steps.

The prerequisite changed from the July 2026 to the September 2026 or later Windows Server cumulative update. Post-migration guidance now covers manually removing workspace DSA or gMSA configuration and retiring unused gMSA accounts after verifying they have no other users.

The FAQ now states that offboarding a server from Defender for Endpoint stops Defender for Identity v3.x sensor reporting, including sensors migrated from v2.x, and does not automatically enable identity-only mode.

The alert catalog now includes updated descriptions and fields, plus entries for several OAuth, Okta, Kerberos, AD CS, and DPAPI-related alerts. The malicious MFA device registration severity is shown as High.

The October announcement adds 19 alerts covering Entra ID, Active Directory, and other identity providers, including Okta, with links to detailed alert information.

The health alerts page revises the entry describing a missing or incorrectly applied Unified Sensor RPC Audit configuration tag and its resolution steps.

The documented prerequisite changed from the July 2026 or later cumulative update to the September 2026 or later cumulative update.

The archive entry for “Suspicious network connection over Encrypting File System Remote Protocol” now links to the “Suspected PetitPotam coercion attack” section.

The Defender for Identity remediation-actions table now lists Security Operator among the roles for the Revoke session action.

The documentation now states that automatic sensor activation and automatic Windows auditing require an active license that includes Microsoft Defender for Identity. The domain-controller onboarding heading no longer labels the process as preview.

The page date was updated, and the “Offboard a domain controller without Defender for Endpoint deployment” heading no longer includes “(Preview).”

The documentation adds sensor v3.x activation without Defender for Endpoint for eligible Windows Server 2019 or later domain controllers. It applies only to new sensor v3.x deployments, and automatic activation and Windows auditing require an active license that includes Microsoft Defender for Identity.

Automatic sensor activation and automatic Windows auditing now require an active license that includes Microsoft Defender for Identity.

The page now specifies that the method supports new sensor v3.x deployments on eligible domain controllers without sensor v2.x, and that the standalone package activates sensor v3.x on Windows Sense in restricted identity-only mode.

Windows Server 2019 or later AD FS, AD CS, and Microsoft Entra Connect servers are now documented as supporting sensor v3.x onboarding with or without Microsoft Defender for Endpoint.

The documentation now states that eligible servers can use sensor v3.x onboarding without Defender for Endpoint deployment, replacing the previous domain-controller-specific wording.

The deployment guidance now links to v2.x server requirements and migration prerequisites. It specifies that in-place migration from sensor v2.x to v3.x is currently available only for eligible domain controllers, not other servers.

The sizing tool now applies only to v2.x sensors and is not required for v3.x. Automatic auditing for v3.x configures supported auditing settings, with additional steps specified.

The prerequisite changed from the July 2026 to the September 2026 Windows Server cumulative update for sensor version 3.0.10 or later. The guidance also clarifies v2 migration account settings and that migration does not automatically remove workspace DSA or gMSA configuration.

The documented prerequisite for Windows Server 2019 or later changed from the July 2026 cumulative update to the September 2026 cumulative update.

The article now states that, as of October 15, 2026, two EWS-based detections are marked Retired and no longer generate alerts.

The guide now lists auto-labeling migration for SharePoint and OneDrive, plus DLP file-policy migration for Google Workspace, Box, Dropbox, and Salesforce. Previously, it listed only SharePoint and OneDrive DLP migration as supported.

The documentation now explains that protection applies across tenants within the same Microsoft Edge work-profile session. Separate Edge work profiles provide separate session enforcement between tenants.

Two authoring metadata link entries were updated, but their URLs remain unchanged.

Starting October 15, 2026, the Defender for Cloud Apps integration with Identity inventory will move from opt-in to automatic enablement for eligible tenants that do not use the listed excluded configurations.

App/instance admin and User group admin role assignments can no longer be used in new configurations. Existing configurations remain supported.

The new guidance covers global or scoped plan configuration across connected Azure commercial environments, required permissions, migration behavior, and the loss of resource-level configurations after migration. The capability is in preview.

The comparison now documents Defender portal preview support for environment onboarding, plan management, and cloud security cost reporting. It also clarifies that data export remains available in the Azure portal.

The documentation introduces Defender Workload Units (DWUs), a Cloud Security Cost Estimator, and a Cloud security cost report. It also describes updated workload measurements, plan consolidations, and DNS billing treatment.

A new page explains that moving plan management from the Azure portal to the Defender portal changes billing to Defender Workload Units, shifts configuration to tenant, management-group, or subscription scope, and may replace, consolidate, or measure plans differently. Resource-level configurations are not preserved, and migrated settings become view-only in Azure portal.

The documentation now states that cloud security data supports Azure, AWS, and GCP, while onboarding and plan management currently support Azure commercial environments only. After migration, plan settings become view-only in the Azure portal, resource-level configurations are not preserved, and billing uses Defender Workload Units.

On October 20, 2026, the expanded server security experience will support automated and manual onboarding for Azure, Azure Arc-enabled, Windows, Linux, and on-premises servers. Cloud security plan management will also become available in the Defender portal, including DWU cost tracking and eligible 30-day trials.

The page now documents supported environments, scope-level-only plan configuration, replacement of resource-level settings during migration, remaining Azure portal capabilities, and daily cost fluctuations.

New documentation describes connecting Azure subscriptions and management groups to Microsoft Defender for Cloud, including prerequisites, tenant preparation, and connector setup. The capability is in preview.

The Microsoft Learn page describing eligibility, required roles, enablement steps, and expected results for Defender for Cloud preview features in the Defender portal was deleted.

The procedure now states that direct onboarding affects all eligible existing and future non-Azure servers in the same Microsoft Entra tenant. Individual-server or pilot-group selection isn't supported, and prerequisites include healthy Defender for Endpoint telemetry, a matching tenant, and specific roles.

The documentation now describes connecting Azure commercial environments at subscription or management-group level and configuring Defender for Cloud plans for selected or all connected environments. AWS, GCP, and unsupported Azure environments must still be onboarded through the Azure portal.

The FAQ now explains that existing Defender for Endpoint servers need no changes, how to onboard new servers, Direct onboarding scope, offboarding options, and why historical records may remain visible. The offboarding link was also updated.

The documentation now states that updates to cloud scopes, including subscription changes, may take about 8–10 hours to appear in portal filters and scoped data views. During the refresh, results may be incomplete or empty even when the configuration was saved.

The article now states that the calculator covers the existing plan-pricing model and links to separate guidance for estimating costs with the Defender Workload Unit (DWU) pricing model.

The article now specifies that it covers enabling Defender for Cloud on an Azure subscription in the Azure portal and links to separate instructions for connecting Azure commercial subscriptions or management groups in the Microsoft Defender portal.

The documented KQL now queries SQL Vulnerability Assessment records, filters resources by Log Analytics workspace IDs, and returns workspace ID, machine name, and machine UUID. The prior subassessment, OnPremiseSql, and 30-day scan-time filters were removed.

The documentation now states that deletion authorization failures involving 250 or more Defender-tagged snapshots suspend new scans for the affected AWS scope. Snapshots continue accruing storage charges until deleted.

When 250 or more Defender-tagged snapshots accumulate because deletion authorization fails, new scans are suspended for the affected AWS scanning scope to limit additional storage charges.

The FAQ now recommends having more than one subscription owner and removing disabled or guest accounts with owner, write, or read permissions on Azure resources.

The documentation now specifies that Security Admin and Owner roles on the subscription containing the Log Analytics workspace are required to enable, disable, or change File Integrity Monitoring. Security Reader can view results.

The release notes now describe a new server asset page combining cloud and endpoint details, link to server offboarding guidance, and reference the new Defender server security experience.

The Kubernetes misconfiguration enforcement page now lists ElazarK and elkrieger instead of dlanger as its author metadata.

The document’s author and ms.author metadata changed from TimShererWithAquent and v-tishe to ElazarK and elkrieger.

The document author changed from dlanger to ElazarK, and the ms.author value changed from dlanger to elkrieger.

The page author changed from TimShererWithAquent to ElazarK, and the ms.author value changed from v-tishe to elkrieger.

The experience combines Microsoft Defender for Endpoint and Defender for Servers data, enabling unified inventory, cross-service investigations, Go hunt, and access management through RBAC, device groups, and cloud scopes. Administrators can also offboard eligible servers from Defender for Endpoint by disabling Defender for Servers for a subscription.

The FAQ metadata date changed from June 9, 2026, to September 23, 2026.

Starting October 5, 2026, KSPM misconfiguration recommendations will align with Kubernetes workload controllers instead of individual running container instances.

The documentation now states that the integration can use an existing Defender for Endpoint sensor from the same tenant, adds updated platform and Linux requirements, and lists pre-deployment checks for connectivity, proxy authentication, file-system settings, and security policies.

The documentation heading for filtering malware scans to specific items no longer includes “(Preview).”

Microsoft Defender for Storage on-demand malware scanning can now target individual blobs or files, containers or file shares, or objects matching a path prefix. REST API filters define the scope; without filters, the entire storage account is scanned.

The regional availability documentation now lists ap-southeast-7 among the supported regions.

The documentation now maps legacy plans to new plans, including default serverless protection in Defender CSPM, revised billing units, consolidated Databases and API plans, and discontinued DNS coverage. DNS protection can be maintained by manually enabling Defender for Servers Plan 2, with possible additional charges.

The article now clarifies that it covers using Azure Policy to enable Defender for Cloud across subscriptions in a management group, and links to separate guidance for connecting Azure environments in the Defender portal.

The documentation now states that disabling Defender for Servers for Azure subscriptions in public preview automatically offboards eligible servers. Switching from Plan 2 to Plan 1 does not trigger automatic offboarding.

The documentation now lists sensor versions 0.11.8, 0.10.11, 0.9.69, and 0.8.62, all released in October 2026 with security updates to sensor components and dependencies.

The documentation now explains that some identity and access recommendations can appear without the Azure CSPM standard assigned, but those recommendations don't support exemptions unless the standard is assigned. It also links to assignment instructions.

The changelog now lists sensor versions 0.11.7, 0.10.10, 0.9.68, and 0.8.61 as GA releases from September 2026, each containing security vulnerability fixes and dependency updates.

The article now covers EKS provisioning failures caused by recreated IAM roles, endpoint allowlist reconciliation, and stale Azure Arc registrations. It adds diagnostic commands and resolution steps.

The documentation adds a separate preview connector for SAP BTP Application Vulnerability Report Service findings, plus a preview analytics rule and an Application Vulnerabilities workbook tab with a vulnerability posture KPI.

The documentation now describes an optional Application Vulnerabilities workbook tab and an analytics rule correlating SAP Application Vulnerability Report Service findings with BTP audit events. The rule detects custom apps with open high or critical vulnerabilities, using a default CVSS threshold of 7.0 and a 14-day evaluation window.

The October 2026 documentation adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect interactive XSUAA logins involving custom apps with open high or critical vulnerabilities.

The documentation now lists required CrowdStrike REST API scopes, links to upgrade notes, adds Pathlock deployment guidance, removes the Red Canary connector section, and adds SilentPush Feeds details.

The table adds entries for SilentPush Feeds, Theom, and Theom via the Codeless Connector Framework, and removes the Red Canary Threat Detection entry.

The connector reference now uses a relative setup-guide link, an anonymized server URL example, and reformatted CrowdStrike region mapping table.

The instructions now use Create > Logic App playbook and distinguish Consumption triggers—including alert, case, and legacy options—from Standard playbooks, which start with Blank playbook. The page also explains case-versus-incident terminology and adds supporting links.

The comparison table now describes excluding a rule from the correlation engine and marks it supported for analytics rules and custom detections, with configuration guidance linked.

The reference adds a connector that ingests SAP BTP application vulnerability findings into Microsoft Sentinel. It also updates Confluence permissions and DCR support, and changes Corelight naming and access requirements.

The table now labels the Netskope Web Transactions connector as deprecated, removes several older connector entries, and adds new connectors plus Snowflake V3 tables.

The documentation now explains that the generated table sets `disabled=false` to enable custom parsers and advises forwarding `pack` only when the source-specific parser supports it.

The documentation adds AgentEvent and AssetEntity entries, updates the ProcessEvent listing, and revises parser examples to show explicit parameter-to-column mappings. Several examples also include fields such as `pack` and `disabled`.

The parser-management documentation updates custom unifying-function examples to pass `disabled=disabled` where supported, including AgentEvent and DNS parser examples, and adds or updates parser entries.

The documentation now lists the `_Im_AgentEvent_AnthropicClaudeCompliance` parser, its BlueVoyant Codeless Connector Framework source, and that it uses the pack parameter. The page date was also updated.

The page adds an Email Event mapping to `_Im_EmailEvent`, updates the Process Event mapping to include `_Im_ProcessEvent`, and refreshes ontology links and the publication date.

The schema reference now lists the Email Event schema as `EmailEvent`, version 1.0.0, with GA status.

The normalization page now links to the Email Event schema and has an updated documentation date.

The page now states that re-ingestion costs follow standard log ingestion pricing for paid tables, with final costs affected by tenant discounts or commitment tiers.

The documentation now lists flexible and high-frequency support for Sentinel data. It specifies lookback limits of up to 48 hours for frequencies over one hour and up to 14 days for frequencies of one hour or less; lookback remains in public preview.

The comparison table now identifies flexible rule frequency and configurable lookback for custom detection rules, with links to detailed guidance. Page metadata was also updated.

The Cisco Meraki connector now documents File Scanned detections and the `CiscoMerakiFileScannedEvents_CL` table. F5Telemetry LTM and RFI Playbook Alert Results tables are marked supported, and workspace transform DCR support is documented.

The reference now lists CiscoMerakiFileScannedEvents_CL and changes F5Telemetry_LTM_CL and RFI_PlaybookAlertResults_V2_CL from No/No to Yes/Yes in the two status columns.

The page now documents `imProcessEvent` for querying all process event types, retains specialized parsers, revises custom parser naming guidance, and updates the filtering example.

Microsoft added reference documentation for the ASIM Email Event schema, including email routing, authentication, delivery outcomes, and threat fields. It also documents the `_Im_EmailEvent` parser, custom parser naming, and filtering parameters.

The article now documents a connector that ingests SAP Application Vulnerability Report Service findings into Microsoft Sentinel, including setup prerequisites, credentials, polling and ingestion-delay settings, verification, and related analytics content.

The page author changed from limwainstein to DebLanger, and the ms.author value changed from lwainstein to dlanger.

The page author changed from “dlanger” to “DebLanger.”

The page author changed from “dlanger” to “DebLanger.”

The document’s author metadata changed from “dlanger” to “DebLanger.”

The page author changed from “dlanger” to “DebLanger.”

The page author changed from “dlanger” to “DebLanger.”

The page author metadata changed from “dlanger” to “DebLanger.”

The vulnerability management integration page author changed from “dlanger” to “DebLanger.”

The page author changed from dlanger to DebLanger.

The document author changed from “dlanger” to “DebLanger.”

The data connectors overview now lists DebLanger instead of dlanger as the author.

The page author changed from “dlanger” to “DebLanger.”

The prerequisites page author attribution changed from “dlanger” to “DebLanger.”

The page author was changed from “dlanger” to “DebLanger.”

The author metadata changed from “dlanger” to “DebLanger” on the Initiatives page.

The page author changed from dlanger to DebLanger.

The page author changed from “dlanger” to “DebLanger.”

The page author changed from dlanger to DebLanger.

The initiatives list documentation now credits DebLanger instead of dlanger as the author.

The document’s author name changed from “dlanger” to “DebLanger.”

The page author changed from dlanger to DebLanger.

The Exposure Management What's New page now lists the author as DebLanger instead of dlanger.

The page author changed from “dlanger” to “DebLanger.”

The page author metadata changed from limwainstein to DebLanger.

The page’s author metadata changed from limwainstein/lwainstein to DebLanger/dlanger.

The page author changed from limwainstein to DebLanger, and the Microsoft author alias changed from lwainstein to dlanger.

The document author changed from “dlanger” to “DebLanger.”

The Enterprise Exposure Graph documentation now lists DebLanger instead of dlanger as the author.

The documentation page author changed from “dlanger” to “DebLanger.”

The page author changed from dlanger to DebLanger.

The document author changed from dlanger to DebLanger.

The document author changed from dlanger to DebLanger.

The instructions now direct administrators to Agentic code scanning management, select Add another beside Source code environment, and choose Azure DevOps to open the connector flow.

The guide now instructs administrators to select GitHub under Source code environment, rather than Azure DevOps, and proceed to the GitHub connector flow.

The instructions now direct administrators to Agentic code scanning management, select Add another under Source code environment, and choose Azure DevOps. Connector naming remains optional.

The page no longer labels Microsoft Store applications as Preview or lists individual supported apps. It now states that vulnerability assessment is available for a limited set of commonly used Microsoft Store applications.

The documentation date was updated, “Dell Command” was changed to “Dell Command | Update,” and the listed software examples were revised to add 1Password, Beyond Compare, and Evernote while removing two entries.

The page title capitalization was standardized, the “Weaknesses” description was simplified, and the Vulnerability Management link was reformatted.

The article’s title, wording, formatting, and links were revised. Guidance on next-generation protection, firewall policies, controlled folder access, and attack surface reduction was reorganized and simplified.

The guide was revised for capitalization, grammar, image description, list and link formatting, and clearer references to Microsoft Intune.

The page title and description were updated, the description now covers product updates and feature-availability changes, and several release-note entries and links were reworded.

The article’s title, descriptions, navigation steps, severity explanations, and attack-disruption text were revised. The incident screenshot can now be opened in a lightbox.

The article title and headings were updated, browser enforcement wording was clarified, setup examples and policy instructions were streamlined, and two ontology links were added.

The page received capitalization and wording edits, revised onboarding guidance for local scripts and Intune, an updated Intune enrollment link, and clearer Microsoft 365 Lighthouse wording.

The page received updated internal links, title capitalization, wording, punctuation, and terminology. A navigation section was removed, while the role-assignment instructions remain focused on the Microsoft 365 and Entra admin centers.

The page title and description were updated, wording and link formatting were refined, and the Related resources section was removed.

The guide has revised wording and capitalization, linked portal references, punctuation, and formatting for the Intune enrollment option.

The page title and headings were capitalized consistently, and periods were added to two troubleshooting list items and their linked reference.

The article now uses clearer wording for device replacement and retirement, inactive-device status, data retention, and exposure-score treatment. It also standardizes platform labels, portal links, and package and script instructions.

The article title, description, wording, image text, lists, and portal links were updated. Guidance on reviewing and editing policies in the Defender portal or Intune remains central.

The page updates its title and wording, simplifies the introduction and license-review step, and links directly to the Microsoft Defender portal.

The page title and wording were updated, the introductory “What to do” section was removed, and guidance for alert, vulnerability, and user-assignment rules was simplified.

The page updates portal capitalization, links the first portal reference directly to security.microsoft.com, and clarifies wording and punctuation in navigation descriptions.

The page now frames prerequisites around subscriptions, user accounts, browsers, and client operating systems, with clearer wording and links for accounts, permissions, operating systems, Microsoft Entra ID, and Conditional Access.

The page updates portal links, changes “details flyout” to “details pane,” improves punctuation and phrasing, and revises antivirus mode descriptions and terminology.

The article updates wording, links, step references, and portal terminology such as “flyout pane.” Instructions continue to cover firewall policies, custom rules, profiles, and the 150-rule limit.

The page title and description were updated, and wording throughout the article was revised for clarity, including role guidance and steps for reviewing incidents and releasing contained devices.

The article’s title capitalization, punctuation, portal references, and settings-table wording were updated. Microsoft Defender portal references are now clickable links.

The article now clarifies when to use the Defender portal or Intune admin center, adds links to both portals, and improves wording, formatting, and policy-setting descriptions.

The article received clearer wording, corrected action-list formatting, updated Action Center links, and two related-concepts links.

The article was revised with clearer descriptions of device groups, updated terminology, and refreshed create/edit policy instructions and formatting.

The article updates wording, image text, punctuation, and navigation links, including direct links to the Microsoft 365 admin center and Purchase services page. Placeholder direct URLs for the Devices page were removed.

The overview now has revised introductory and capability descriptions, clearer image text, corrected grammar, and improved table and footnote formatting.

Updated capitalization, wording, links, punctuation, footnote formatting, and troubleshooting instructions on the Defender for Business mobile threat defense page.

The page now uses formatted links and more concise, consistent wording throughout its report descriptions and instructions.

The page title, description, and several guidance phrases were revised, including wording about videos, customer portal access, and Defender for Endpoint API integrations.

The documentation now more clearly explains policy priority, how to change the order of custom policies, and that only the highest-priority applicable policy is applied.

The page now states that administrators can add a user and purchase additional licenses, with a link to related Microsoft 365 guidance. Titles, punctuation, and image description text were also updated.

The FAQ title capitalization, sentence punctuation, and wording were updated, including a change from “via” to “by.”

The page now presents Microsoft 365 Lighthouse guidance for CSPs and MSPs, links directly to the Lighthouse portal, updates the screenshot text, and removes the separate “Learn more” section and links.

The page title was capitalized consistently, “Microsoft Defender portal” was shortened to “Defender portal,” and “flyout” was clarified as “flyout pane.”

The page received wording, formatting, capitalization, and punctuation updates, plus linked references to the Defender, Intune, and Azure portals. The introduction now notes that several device onboarding options are available.

The page updates its title, description, terminology, links, and setup instructions for using the Streaming API with Defender for Business and Microsoft 365 Business Premium.

The page title and heading now capitalize “Attack Surface Reduction.” The text also uses “cyberattack” and revises punctuation around configuration method examples.

The page author metadata changed from guywi-ms/guywild to poliveria/pauloliveria.