April 2026 — Daily Defender News

← Previous month

Next month →

MondayMon

TuesdayTue

WednesdayWed

ThursdayThu

FridayFri

SaturdaySat

SundaySun

Month in brief

Planned breaking changes to ASIM KQL functions used by Microsoft Sentinel for Developers leads 1759 Defender updates

April 2026 recorded 628 new, 1090 updated, 36 removed Microsoft Defender documentation changes and 5 relevant Message Center announcements. The most active areas were Sentinel, Endpoint, Defender XDR.

Defender XDR · Hunting and detection
Planned breaking changes to ASIM KQL functions used by Microsoft Sentinel for Developers
Microsoft Sentinel for Developers will have planned breaking changes to ASIM KQL functions, updating _Im_ProcessCreate to use targetusername_has instead of targetusername. Organizations should review and update queries by May 25 or later to avoid disruptions. Rollout dates will be announced later.
IoT · General
OT threat monitoring in enterprise security operation center (SOC) teams - Microsoft Defender for IoT
Added Microsoft Defender documentation in defender-for-iot-azure/organizations/concept-sentinel-integration.md.
Sentinel · Cloud and workloads
Sap Solution Security Content
Updated Microsoft Defender documentation in sentinel/sap/sap-solution-security-content.md.
Endpoint · Vulnerabilities and exposure
Migrating from a non-Microsoft HIPS to attack surface reduction rules
Updated Microsoft Defender documentation in defender-endpoint/migrating-asr-rules.md.
Exposure Management · Vulnerabilities and exposure
Predefined classifications - Microsoft Security Research
Updated Microsoft Defender documentation in exposure-management/predefined-classification-rules-and-levels.md.

For Defender administrators

Review the linked Microsoft Learn changes that apply to your managed platforms, policies, applications, and rollout plans. The archive preserves the source diff for verification.

This period briefing was assembled from the tracked Microsoft Learn and Message Center changes.

1759 updates by product

Microsoft Defender XDR: Email summary powered by Security Copilot on the email entity page

New

Microsoft Defender XDR will add an AI-powered Email summary via Security Copilot on the Email entity page, launching in public preview mid-April 2026 and generally available by mid-May 2026. It provides concise threat insights, timeline analysis, URL and attachment assessments, requiring Security Copilot access and SCUs.

2 April 2026

Message CenterMC1268924 on mc.merill.net ↗Stay informed

Collaborate with experts on demand

Updated

Updated Microsoft Defender documentation in defender-xdr/experts-on-demand.md.

2 April 2026

UrlClickEvents

Updated

Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-urlclickevents-table.md.

2 April 2026

10 April 2026

Alert Policies

Updated

Updated

Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-cloudpolicyenforcementevents-table.md.

16 April 2026

Planned breaking changes to ASIM KQL functions used by Microsoft Sentinel for Developers

New

Updated

Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-schema-tables.md.

10 April 2026

16 April 2026

Endpoint protection

Microsoft Secure Score: New recommendation for Secure Boot 2023 certificate readiness in Microsoft Defender for Endpoint

New

Microsoft Defender for Endpoint will add a new Secure Score recommendation in late April 2026 to help organizations prepare for Secure Boot 2023 certificate updates replacing expiring certificates in June 2026. It provides visibility into device readiness, tracks progress, and is enabled by default.

27 April 2026

Message CenterMC1293483 on mc.merill.net ↗Stay informed

Whats New

Updated

Updated Microsoft Defender documentation in defender-xdr/whats-new.md.

23 April 2026

Upcoming retirement of older Microsoft Defender for Endpoint mobile app versions (iOS and Android)

New

Microsoft will retire Microsoft Defender for Endpoint mobile app versions released before February 2026 on iOS and Android starting May 10, 2026. Older versions will lose cloud connectivity and updates. Administrators must ensure devices update to supported versions to maintain protection and avoid service disruption.

10 April 2026

Message CenterMC1276511 on mc.merill.net ↗Major updatePlan for change

Architecture and deployment

Updated

Updated Microsoft Defender documentation in defender-endpoint/onboard-windows-multi-session-device.md.

14 April 2026

Troubleshooting

26 April 2026

Threat Protection Reports

Updated

Updated Microsoft Defender documentation in defender-endpoint/threat-protection-reports.md.

24 April 2026

Tamper Resiliency

Updated

Updated Microsoft Defender documentation in defender-endpoint/tamper-resiliency.md.

23 April 2026

Developer and API

Microsoft Defender Antivirus Using Powershell

Updated

Updated Microsoft Defender documentation in defender-endpoint/microsoft-defender-antivirus-using-powershell.md.

24 April 2026

Evaluate Microsoft Defender Antivirus using PowerShell

Updated

Updated Microsoft Defender documentation in defender-endpoint/microsoft-defender-antivirus-using-powershell.md.

4 April 2026

Email and collaboration

Architecture and deployment

Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2

Updated

Updated Microsoft Defender documentation in defender-office-365/air-about.md.

14 April 2026

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/accounts.md.

15 April 2026

Email and collaboration

Control Cloud Apps With Policies

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/control-cloud-apps-with-policies.md.

19 April 2026

Control Cloud Apps With Policies

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/control-cloud-apps-with-policies.md.

19 April 2026

Control Cloud Apps With Policies

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/control-cloud-apps-with-policies.md.

15 April 2026

Vulnerabilities and exposure

Vulnerability management API reference for OT monitoring sensors - Microsoft Defender for IoT

New

Added Microsoft Defender documentation in defender-for-iot-azure/organizations/api/sensor-vulnerability-apis.md.

27 April 2026

Defender-IoT-micro-agent for Eclipse ThreadX API

New

Added Microsoft Defender documentation in defender-for-iot-azure/device-builders/threadx-security-module-api.md.

27 April 2026

Authentication and password management API reference for OT monitoring sensors - Microsoft Defender for IoT

New

Added Microsoft Defender documentation in defender-for-iot-azure/organizations/api/sensor-auth-apis.md.

27 April 2026

Inventory management API reference for OT monitoring sensors - Microsoft Defender for IoT

New

Welcome to sentinel-azure!

New

New

20 April 2026

Microsoft Defender EASM

Updated Microsoft Defender documentation in easm/using-and-managing-discovery.md.

23 April 2026

Discovering Your Attack Surface

Updated

Inventory filters overview

New

Added Microsoft Defender documentation in easm/inventory-filters.md.

23 April 2026

Microsoft Security Exposure Management

2 updates

Vulnerabilities and exposure

Predefined classifications - Microsoft Security Research

Updated

Updated Microsoft Defender documentation in exposure-management/predefined-classification-rules-and-levels.md.

15 April 2026

Release notes

Updated

Updated Microsoft Defender documentation in exposure-management/whats-new.md.

15 April 2026

Microsoft Defender Vulnerability Management

14 updates

Updated Microsoft Defender documentation in defender-vulnerability-management/fixed-reported-inaccuracies.md.

9 April 2026

Endpoint protection

Misconfiguration recommendations support in Microsoft Defender for Endpoint

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/fixed-reported-inaccuracies-security-configuration-assessment.md.

14 April 2026

Microsoft Defender for Business

Updated Microsoft Defender documentation in defender-business/mdb-mtd.md.

6 April 2026

Architecture and deployment

Mdb Onboard Devices

Updated

Updated Microsoft Defender documentation in defender-business/mdb-onboard-devices.md.

25 April 2026

Vulnerabilities and exposure

Attack surface reduction in Microsoft Defender for Business

Updated

Updated Microsoft Defender documentation in defender-business/mdb-asr.md.

24 April 2026

Microsoft Unified SecOps Platform

Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.

10 April 2026

How Microsoft names threat actors

Updated

Updated

Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.

19 April 2026