Daily Defender News
Track documentation and Message Center changes for Microsoft Defender for Cloud.
Microsoft Learn documentation ↗The comparison now documents Defender portal preview support for environment onboarding, plan management, and cloud security cost reporting. It also clarifies that data export remains available in the Azure portal.
The documentation now states that updates to cloud scopes, including subscription changes, may take about 8–10 hours to appear in portal filters and scoped data views. During the refresh, results may be incomplete or empty even when the configuration was saved.
New documentation describes connecting Azure subscriptions and management groups to Microsoft Defender for Cloud, including prerequisites, tenant preparation, and connector setup. The capability is in preview.
The article now specifies that it covers enabling Defender for Cloud on an Azure subscription in the Azure portal and links to separate instructions for connecting Azure commercial subscriptions or management groups in the Microsoft Defender portal.
The article now states that the calculator covers the existing plan-pricing model and links to separate guidance for estimating costs with the Defender Workload Unit (DWU) pricing model.
The documentation now describes connecting Azure commercial environments at subscription or management-group level and configuring Defender for Cloud plans for selected or all connected environments. AWS, GCP, and unsupported Azure environments must still be onboarded through the Azure portal.
The documentation now lists sensor versions 0.11.8, 0.10.11, 0.9.69, and 0.8.62, all released in October 2026 with security updates to sensor components and dependencies.
The Microsoft Learn page describing eligibility, required roles, enablement steps, and expected results for Defender for Cloud preview features in the Defender portal was deleted.
The documentation introduces Defender Workload Units (DWUs), a Cloud Security Cost Estimator, and a Cloud security cost report. It also describes updated workload measurements, plan consolidations, and DNS billing treatment.
The FAQ now explains that existing Defender for Endpoint servers need no changes, how to onboard new servers, Direct onboarding scope, offboarding options, and why historical records may remain visible. The offboarding link was also updated.
The documentation now states that cloud security data supports Azure, AWS, and GCP, while onboarding and plan management currently support Azure commercial environments only. After migration, plan settings become view-only in the Azure portal, resource-level configurations are not preserved, and billing uses Defender Workload Units.
The page now documents supported environments, scope-level-only plan configuration, replacement of resource-level settings during migration, remaining Azure portal capabilities, and daily cost fluctuations.
The new guidance covers global or scoped plan configuration across connected Azure commercial environments, required permissions, migration behavior, and the loss of resource-level configurations after migration. The capability is in preview.
The article now clarifies that it covers using Azure Policy to enable Defender for Cloud across subscriptions in a management group, and links to separate guidance for connecting Azure environments in the Defender portal.
The documentation now maps legacy plans to new plans, including default serverless protection in Defender CSPM, revised billing units, consolidated Databases and API plans, and discontinued DNS coverage. DNS protection can be maintained by manually enabling Defender for Servers Plan 2, with possible additional charges.
On October 20, 2026, the expanded server security experience will support automated and manual onboarding for Azure, Azure Arc-enabled, Windows, Linux, and on-premises servers. Cloud security plan management will also become available in the Defender portal, including DWU cost tracking and eligible 30-day trials.
The procedure now states that direct onboarding affects all eligible existing and future non-Azure servers in the same Microsoft Entra tenant. Individual-server or pilot-group selection isn't supported, and prerequisites include healthy Defender for Endpoint telemetry, a matching tenant, and specific roles.
A new page explains that moving plan management from the Azure portal to the Defender portal changes billing to Defender Workload Units, shifts configuration to tenant, management-group, or subscription scope, and may replace, consolidate, or measure plans differently. Resource-level configurations are not preserved, and migrated settings become view-only in Azure portal.
The documented KQL now queries SQL Vulnerability Assessment records, filters resources by Log Analytics workspace IDs, and returns workspace ID, machine name, and machine UUID. The prior subassessment, OnPremiseSql, and 30-day scan-time filters were removed.
When 250 or more Defender-tagged snapshots accumulate because deletion authorization fails, new scans are suspended for the affected AWS scanning scope to limit additional storage charges.
The documentation now states that deletion authorization failures involving 250 or more Defender-tagged snapshots suspend new scans for the affected AWS scope. Snapshots continue accruing storage charges until deleted.
The article now covers EKS provisioning failures caused by recreated IAM roles, endpoint allowlist reconciliation, and stale Azure Arc registrations. It adds diagnostic commands and resolution steps.
The FAQ now recommends having more than one subscription owner and removing disabled or guest accounts with owner, write, or read permissions on Azure resources.
The documentation now explains that some identity and access recommendations can appear without the Azure CSPM standard assigned, but those recommendations don't support exemptions unless the standard is assigned. It also links to assignment instructions.
The documentation now specifies that Security Admin and Owner roles on the subscription containing the Log Analytics workspace are required to enable, disable, or change File Integrity Monitoring. Security Reader can view results.
The release notes now describe a new server asset page combining cloud and endpoint details, link to server offboarding guidance, and reference the new Defender server security experience.
The Kubernetes misconfiguration enforcement page now lists ElazarK and elkrieger instead of dlanger as its author metadata.
The document’s author and ms.author metadata changed from TimShererWithAquent and v-tishe to ElazarK and elkrieger.
The document author changed from dlanger to ElazarK, and the ms.author value changed from dlanger to elkrieger.
The page author changed from TimShererWithAquent to ElazarK, and the ms.author value changed from v-tishe to elkrieger.
The FAQ metadata date changed from June 9, 2026, to September 23, 2026.
The experience combines Microsoft Defender for Endpoint and Defender for Servers data, enabling unified inventory, cross-service investigations, Go hunt, and access management through RBAC, device groups, and cloud scopes. Administrators can also offboard eligible servers from Defender for Endpoint by disabling Defender for Servers for a subscription.
The documentation now states that disabling Defender for Servers for Azure subscriptions in public preview automatically offboards eligible servers. Switching from Plan 2 to Plan 1 does not trigger automatic offboarding.
Starting October 5, 2026, KSPM misconfiguration recommendations will align with Kubernetes workload controllers instead of individual running container instances.
The documentation now states that the integration can use an existing Defender for Endpoint sensor from the same tenant, adds updated platform and Linux requirements, and lists pre-deployment checks for connectivity, proxy authentication, file-system settings, and security policies.
The documentation heading for filtering malware scans to specific items no longer includes “(Preview).”
Microsoft Defender for Storage on-demand malware scanning can now target individual blobs or files, containers or file shares, or objects matching a path prefix. REST API filters define the scope; without filters, the entire storage account is scanned.
The changelog now lists sensor versions 0.11.7, 0.10.10, 0.9.68, and 0.8.61 as GA releases from September 2026, each containing security vulnerability fixes and dependency updates.
The regional availability documentation now lists ap-southeast-7 among the supported regions.
The page now only states that Foundational CSPM is free. It no longer includes the October 27, 2026 opt-in notice for new Azure subscriptions or the AWS and GCP scope note.
The overview clarifies that a server is a device running a server operating system and links to the common questions page.
The documentation now states that VMs in the Starting power state are billed and links to upcoming billing updates.
Starting October 27, 2026, new Azure subscriptions will have Foundational CSPM disabled by default. The plan remains free; existing subscriptions and AWS/GCP environments are unaffected.
The Plan 1 documentation now defines a server as a device running a server operating system and links to the Defender for Servers FAQ.
Plan 1 will no longer bill desktop, workstation, and mobile devices as servers. For Plans 1 and 2, server identification will run more frequently and count deployed machines individually, which may change billed server totals.
Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. It remains free and can be enabled at any time; existing subscriptions and AWS or GCP environments are unaffected.
Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. The free plan will remain available at no cost and can be enabled at any time.
The page title and headings were simplified, portal navigation wording was updated, and “drop-down” was standardized to “dropdown.” Two authoring references were also added.
Updated capitalization and wording throughout the classic configuration article, including configuration checks, exemptions, Resource Manager templates, and Boolean baseline examples.
The article title, portal terminology, prose, list punctuation, emphasis, and screenshot formatting were revised.
The article updates its title, prerequisites, navigation labels, instructions for existing Security Private Link resources, and descriptions of the containers sub-resource. Several sentences were also rewritten for clarity and consistency.
Updated the page title, wording, formatting, and the GitHub Advanced Security for Azure DevOps link. The page continues to state that MSDO CredScan secrets scanning is deprecated.
The article updates prerequisite wording, navigation text, capitalization, and makes the environment-settings screenshot expandable.
The documentation now presents the Azure, Defender CSPM, Endor Labs account, API key, and role prerequisites in clearer noun-phrase format. The portal instruction was also changed from “Navigate to” to “Go to.”
The article updates wording, formatting, and step instructions, including clearer prerequisites, assignment fields, and supported ticket types. The assignment screenshot was also repositioned.
The article’s title, introduction, prerequisites, navigation steps, ServiceNow selection instructions, and grace-period wording were revised for clarity and consistency.
The article now uses revised headings, wording, links, and step-by-step instructions. Prerequisites and details about supported Purview information types, labels, and sensitivity thresholds were clarified.
The article’s applicability changed from Azure commercial cloud only to both Azure commercial and Azure Government clouds.
The article now uses clearer wording for deploying the Defender sensor and Azure Policy, verifying automatic provisioning, Azure Arc extensions, RBAC permissions, and GKE Autopilot resource limits. Step numbering and title capitalization were also updated.
The article now uses updated Defender External Attack Surface Management naming, clearer prerequisite wording, and revised steps for opening Cloud security explorer and Attack path analysis.
The page updates terminology and UI steps, adds instructions for disabling all four Defender for Databases subplans, and clarifies autoprovisioning, Azure Policy assignments, and resource-level plan settings.
The procedure now uses revised wording for the outcome, Azure portal navigation, and Databases plan controls. It states that disabling the plan stops SQL alerts and recommendations for selected machines.
The article updates heading capitalization, link and emphasis formatting, and punctuation in the filtering option descriptions.
The article was retitled and updated with a clearer introduction, revised formatting, refreshed links, and clarified descriptions and examples for CVE, image digest, OS version, severity, and fix-status exclusions.
The article reorganizes prerequisites and clarifies that enabling Defender CSPM or Defender for Storage automatically enables sensitive data discovery. It also documents sensitivity settings, the up-to-24-hour wait for initial results, and updated AWS S3 and RDS discovery steps.
The article updates its title, description, navigation steps, query instructions, and examples. It also removes the guidance about Azure Resource Graph findings and filtering by sensitivity labels and sensitive information types.
The documentation was edited for clearer wording, formatting, and navigation across Express/Classic configuration guidance, scan history, finding exclusions, Logic Apps notifications, API usage, and Resource Manager baseline examples.
The SQL machine protection documentation now links to instructions for verifying SQL machine protection in government cloud.
The article updates its title and prerequisite section wording, and clarifies that the created access token grants Defender for Cloud read-only access.
The enhanced agent for Defender for SQL Servers on Machines supports resource- and subscription-level enablement for SQL Server instances on Azure VMs and Azure Arc-enabled machines in Azure Government, without requiring Azure Monitor Agent deployment.
The article now expands Defender CSPM and CVE on first use, clarifies the dashboard’s purpose, standardizes severity labels and Kubernetes terminology, and improves wording and punctuation.
The article now applies to both Azure commercial and Azure Government clouds instead of directing Government-cloud users to a separate article.
The documentation now labels the procedure as updating the plan at the subscription level and directs administrators to select **Action required** instead of **Settings**.
The article’s wording, prerequisites, portal navigation, step numbering, and event-log instructions were revised. Guidance for regions, endpoints, platform types, and XPath filters was clarified, and a screenshot was removed.
The page replaces “blast radius” with “impact,” changes numbered lists to bullets, and revises wording for impacted-asset filtering, repository integration, exemptions, and Azure portal availability.
The article now uses Microsoft Defender for Servers Plan 2 terminology and clearer wording for the 500 MB per-node daily allowance, subscription-wide calculation, and Log Analytics workspace application.
The article received wording, capitalization, punctuation, and formatting improvements. The validation steps remain the same, including sending a suspicious `User-Agent` value, and screenshots now support lightbox viewing.
The article now applies to both Azure commercial and Azure Government clouds, replacing the separate Government-cloud article reference.
Seven Azure Storage alert entries now list their severity as Informational instead of High, Medium, or Low variants.
The article now explicitly directs readers to use Azure Resource Graph queries in Power BI, improves the introductory and sample-query wording, and updates metadata.
The agentless data collection documentation now links AWS permission instructions to the AWS setup section and GCP permission instructions to the GCP setup section.
The documentation reiterates that AI model scanning is in preview, included with the Defender for AI Services plan, and has no additional scanning charge during preview; related threat protection costs may still apply.
The documentation now refers to identifying threats to generative AI applications and no longer mentions agents in that description.
The documentation now lists Malware detection and states that it detects malware running in the container.
The article now more clearly explains how Defender for Cloud uses agentless scanning to assess Defender for Endpoint EDR settings, identify misconfigurations, and provide actionable recommendations. Prerequisite and remediation links were also refreshed, along with metadata and the publication date.
The page date and authoring metadata were updated, and the guidance was rewritten for clarity. It still describes suggestions of up to three users based on control plane activity and assigning recommendations with notifications and due dates.
The article now describes how AWS and GCP onboarding creates security connectors and an IAM role, and clarifies assigning RBAC permissions to account or project connectors at subscription, resource group, or resource scope.
The article now explicitly covers assigning standards to Azure subscriptions, AWS accounts, and GCP projects, reviewing compliance assessments, and checking prerequisites. It also clarifies where the enabled standard appears in the Regulatory compliance dashboard.
The Attack paths article now links to the Azure section of the agentless scanning instructions using the updated page anchor.
The article description, prerequisites wording, attack-path guidance link text, metadata, and publication date were updated. It now describes deploying a mock vulnerable container image to explore container risks with Cloud Security Explorer.
The page title and heading now explicitly reference Microsoft Defender for Cloud. The publication date and custom authoring metadata were also updated.
Binary drift blocking now lists sensor version 0.10.2 or later for AKS and multicloud, and supports the multicloud ARC extension without specifying a preview release train. The documentation also warns that deleting a rule can change alerting or blocking behavior.
The article now explains that it covers queries for vulnerable registry images and running Kubernetes workloads, with streamlined query descriptions and result-review steps. Its metadata date was also updated.
The page title and description now explicitly mention queries for software vulnerabilities in virtual machines and container images. Sign-in steps now refer to Microsoft Defender for Cloud in the Azure portal, and the page metadata was updated.
The page date was updated, and the introductory text now describes queries for checking container images and cluster nodes in clearer language.
The documentation now more clearly explains prerequisites, required Azure roles, Defender CSPM expectations, and how to use and share query templates.
The page adds a prerequisite step and clarifies that the command lists Defender for Cloud pricing configurations, including each plan’s free trial status.
The documentation now states that APIs for classic vulnerability assessment configuration, along with classic Defender for SQL Advanced Threat Protection APIs, will be retired on August 16, 2027. It links to migration guidance.
The article now covers connected resources across Azure, AWS, and GCP; filtering, exporting, investigation, installed-application details, and Azure Resource Graph software inventory queries. It also clarifies summary metrics and assets outside configured cloud scopes.
The article adds navigation anchors, renames section headings, clarifies dashboard section and graph descriptions, and adds links to related cloud security resources and Azure portal guidance.
The article now organizes reporting capabilities, describes report sections more clearly, expands CNAPP, and documents environment requirements and report visibility options.
The article’s wording and metadata were updated, the “Scanning tools” section was renamed “Supported scanning tools,” and the Template Analyzer license label was clarified.
The page updates prerequisite wording and links, clarifies the procedure for existing Security Private Link resources, and explains that the DNS command verifies resolution to a private IP address.
The documentation now explains installing the Microsoft Security DevOps extension, configuring YAML pipelines with static analysis tools, and publishing SARIF findings to Defender for Cloud. It also documents the optional SARIF SAST Scans Tab extension for displaying results in the pipeline’s Scans tab.
The page now describes running static analysis and security tools, adds scanner integration guidance, restructures prerequisites and setup headings, and updates links and metadata.
The Defender for Cloud Docker Hub vulnerability assessment page updates its date and metadata, clarifies the Azure subscription prerequisite, and adds an explicit step for onboarding a Docker Hub organization.
The documentation now includes sections for prerequisites and steps to onboard a JFrog Artifactory tenant. The page date and authoring metadata were also updated.
The documentation now explains how to configure CloudTrail ingestion for Defender for Cloud when the AWS account is already connected to Microsoft Sentinel, using an SNS fan-out pattern, a dedicated SQS queue, and the required permissions.
The article now clearly covers connecting partner integrations to Defender for Cloud, adds a prerequisites introduction, and improves headings, anchors, links, and wording.
The article received updated metadata, clearer prerequisite and integration link text, a named section anchor, and revised Azure portal wording.
The page date and authoring metadata were updated, the Mend.io account prerequisite and Azure portal link were reworded, and the section heading now reads “Connect Mend.io to Defender for Cloud.”
The article now uses simpler wording and explicitly mentions adding a client secret, granting subscription access, and assigning Security Reader and Reader roles across relevant subscriptions. Metadata was also updated.
The page date was updated to July 3, 2026, authoring metadata was added, and the “Next step” heading was changed to “Next steps” with a named anchor.
The guide now recommends limiting Azure portal views to 10,000 resources or fewer. For larger AWS environments, it advises distributing AWS connectors across multiple Azure subscriptions and using the Azure portal global filter.
The documentation now recommends limiting each Azure portal view to 10,000 resources or fewer. For larger GCP environments, it suggests distributing GCP connectors across multiple Azure subscriptions and using the portal’s global filter.
The page now documents enabling antimalware through Defender sensor auto-provisioning, Helm for sensor 0.10.x or later, or the AKS preview API. It also updates prerequisites and removes earlier multicloud and `--antimalware` instructions.
The article now introduces prerequisites, clarifies supported incident, change request, and problem ticket types, explains that deleting the integration removes associated assignments within up to 24 hours, and updates the next-steps heading and anchor.
The page now describes governance rules as automatically opening ServiceNow ITSM tickets for selected recommendations or severity levels. It also clarifies the ServiceNow permissions prerequisite, rule criteria, and next-step resources.
The documentation now organizes prerequisites, expands the creation steps, clarifies the required HealthStatus query pattern, and adds REST and metadata examples for custom standards and policies.
The documentation now explains that Azure Lighthouse grants managing-tenant identities access to delegated resources without creating local users or role assignments in the managed tenant. It also states that the managed tenant’s Azure Activity Log records these actions and identifies the acting user.
