Daily Defender News
A cross-product view of Microsoft Defender changes related to Architecture and deployment.
The article now documents a connector that ingests SAP Application Vulnerability Report Service findings into Microsoft Sentinel, including setup prerequisites, credentials, polling and ingestion-delay settings, verification, and related analytics content.
The server onboarding page now links to `offboard-machines` instead of the `#offboard-servers` fragment.
Windows Server 2019 or later AD FS, AD CS, and Microsoft Entra Connect servers are now documented as supporting sensor v3.x onboarding with or without Microsoft Defender for Endpoint.
The documentation now states that eligible servers can use sensor v3.x onboarding without Defender for Endpoint deployment, replacing the previous domain-controller-specific wording.
The article now clarifies that it covers using Azure Policy to enable Defender for Cloud across subscriptions in a management group, and links to separate guidance for connecting Azure environments in the Defender portal.
The guide now distinguishes automatic onboarding, manual deployment, and servers already reporting to Defender for Endpoint. It adds prerequisites, rollout preparation guidance, antivirus coexistence considerations, and a warning that Direct onboarding has tenant-wide scope.
The documentation now maps legacy plans to new plans, including default serverless protection in Defender CSPM, revised billing units, consolidated Databases and API plans, and discontinued DNS coverage. DNS protection can be maintained by manually enabling Defender for Servers Plan 2, with possible additional charges.
The deployment guidance now links to v2.x server requirements and migration prerequisites. It specifies that in-place migration from sensor v2.x to v3.x is currently available only for eligible domain controllers, not other servers.
The sizing tool now applies only to v2.x sensors and is not required for v3.x. Automatic auditing for v3.x configures supported auditing settings, with additional steps specified.
Updated October 19, 2026: We have identified that this message did not reach it's intended audience. You can safely disregard this message, and we apologize any confusion this may have caused.
The documented prerequisite for Windows Server 2019 or later changed from the July 2026 cumulative update to the September 2026 cumulative update.
The prerequisite changed from the July 2026 to the September 2026 Windows Server cumulative update for sensor version 3.0.10 or later. The guidance also clarifies v2 migration account settings and that migration does not automatically remove workspace DSA or gMSA configuration.
The documentation now states that disabling Defender for Servers for Azure subscriptions in public preview automatically offboards eligible servers. Switching from Plan 2 to Plan 1 does not trigger automatic offboarding.
The page received wording, formatting, capitalization, and punctuation updates, plus linked references to the Defender, Intune, and Azure portals. The introduction now notes that several device onboarding options are available.
The Plan 1 documentation now defines a server as a device running a server operating system and links to the Defender for Servers FAQ.
Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. The free plan will remain available at no cost and can be enabled at any time.
The article now uses clearer wording for deploying the Defender sensor and Azure Policy, verifying automatic provisioning, Azure Arc extensions, RBAC permissions, and GKE Autopilot resource limits. Step numbering and title capitalization were also updated.
Manual activation preview is limited to eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers without an existing sensor. A July 2026 or later Windows Server cumulative update is required before installing or upgrading to sensor version 3.0.8 or later for automatic RPC auditing on domain controllers.
The article updates its title and prerequisite section wording, and clarifies that the created access token grants Defender for Cloud read-only access.
The article adds guidance for recreated workspaces, regional-capacity workarounds, generic setup errors, and workspaces missing from the Defender portal. It also adds a warning that deleting a Log Analytics workspace can cause permanent data loss.
The article adds prerequisites and onboarding guidance for Sentinel data lake and graph, announces September 2026 cutoffs for onboarding or configuring data risk graph, and clarifies policy exemption and workspace offboarding behavior.
The page adds licensing details for standalone, Microsoft 365 E3, and server deployments, and updates links for Windows Firewall and Application Control documentation.
The documentation for deploying the Microsoft Sentinel SAP data connector agent from the command line was deleted, including prerequisites and procedures for managed identities, registered applications, configuration files, and SNC.
The instructions now specify using the AD FS SingleSignOnService Location from the federation metadata and explicitly require a Microsoft Defender for Cloud Apps license. They also clarify which values are needed when configuring the relying party trust.
The article updates its metadata and clarifies setup instructions, including where the IdP SSO URL, signing certificate, Defender for Cloud Apps SSO URL, and attribute values are used in later steps.
The page now states that the Defender for Cloud Apps SAML certificate is valid for one year and requires a new certificate after expiration.
Updated the article’s title, metadata, wording, punctuation, and formatting. The deployment status section is now a top-level heading, and repository connection removal instructions were streamlined.
The article now explicitly identifies the Azure subscription, AWS account, or GCP project used to enable Defender for Azure SQL Databases. It also updates metadata and adds a stable anchor to the “Next steps” heading.
The article now explicitly describes deployment through Helm charts or an Azure Arc-enabled Kubernetes extension and names the Helm on Amazon EKS, Helm on Google Kubernetes Engine, and Azure Arc-enabled Kubernetes tabs. The publication date and documentation metadata were also updated.
The guide now expands APK terminology, refreshes metadata, and clarifies descriptions for Intune synchronization, the Google Play testing link, and prerelease-version screenshots.
The article now includes prerequisites, numbered AKS deployment steps, and explicit Defender sensor and Azure Policy extension instructions for Arc-connected EKS, GKE, and Kubernetes clusters. It also clarifies TCP 443 firewall access for private clusters and adds deployment verification links.
The article’s wording, formatting, and deployment step descriptions were updated, and the publication date and metadata were revised. The documented prerequisite remains Dynamics 365 Finance version 10.0.33 or later.
The article now provides clearer setup prerequisites, sandbox testing guidance, environment validation steps, troubleshooting links, and explanations of runtime-risk recommendations and matched GitHub alerts.
The guide now names the `mdc-mock-0001:mdc-ghas-integration` image, identifies the container registry authentication details to retrieve from the Azure portal, clarifies validation-query and risk-factor instructions, and adds related content.
The Microsoft Defender Antivirus reporting documentation now points to an updated Security auditing reference URL.
The page heading no longer includes “(preview),” note formatting was updated, and a screenshot showing successful deployment tool events was added.
The deployment article now states that VPN integration and syslog notifications require the v2.x sensor on applicable domain controllers; these features aren't supported by v3.x.
The article’s title, metadata, and wording were updated to clarify deployment planning, Microsoft security services, Sentinel workspace and resource-group guidance, and RBAC recommendations.
The page metadata was refreshed, and the scaling guidance now labels the linked resource as the SAP BTP onboarding script library.
The page removes agent-based deployment sections, related imagery, and multi-workspace setup guidance. It now describes installing the SAP solution with the agentless data connector and viewing deployed security content.
The documentation now covers v3.x sensors on non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers. Activation there is in preview, requires manual activation, and does not support automatic activation or migration.
The article now directs administrators to review prerequisites, including enabling Microsoft Defender for Azure SQL, and clarifies that express-configuration vulnerability assessment scans do not require a storage account.
The documentation received a minor formatting change with one line removed.
The overview title, descriptions, headings, and references now use “Microsoft Defender” instead of “Microsoft Defender XDR.”
Adds a how-to guide for onboarding a tenant through the Microsoft Defender portal, including workspace setup, roles, regional requirements, and setup steps.
The instructions for configuring Intune in Entra ID and adding enrolled devices to a Defender for Business device group now use consistent numbered-list formatting.
The page date and onboarding wording were updated to point readers to feature documentation and service-specific prerequisites for unified security operations.
The migration document updates terminology, anchors, and metadata. It now identifies the SCL -1 mail flow rule as the bypass spam filtering mail flow rule while retaining the instruction to turn it off without deleting it.
The documentation now requires completing Phases 1 and 2 first, adds macOS and Linux prerequisites for detection tests, clarifies ForceDefenderPassiveMode usage and commands, and links to troubleshooting if antivirus remains passive after uninstalling a non-Microsoft solution.
The page now explicitly states that Microsoft.Security must be registered at management group scope before onboarding so Defender for Cloud policies can be assigned and evaluated. It also updates headings, anchors, metadata, and the next-step link text.
The article now provides clearer onboarding direction for Azure, AWS, and GCP, including its coverage of running containers, registry vulnerabilities, and Kubernetes configuration analysis. It also clarifies AKS trusted access terminology.
The documentation now links to prerequisites and clarifies that the Docker Hub access token and username are used when configuring the Defender for Cloud Docker Hub connector.
Several prerequisite links were updated, including links for the February 2018 update rollup, telemetry update, .NET Framework, and Endpoint Protection anti-malware platform update.
The procedure now more clearly explains that administrators should copy the SSO URL and attributes, then enter them in the IdP’s custom app configuration steps.
The procedure now refers to the Defender portal, points SSO configuration details to step 8, adds a “Before you begin” section, and formats the support link as a tip.
The documentation recommends onboarding servers through Defender for Servers Plan 2, notes automatic Defender for Endpoint extension onboarding for supported Azure and Azure Arc machines, and identifies standalone server licenses as alternatives.
The documentation now describes onboarding and offboarding Windows 10 and Windows 11 devices with Intune, adds Intune licensing and Endpoint Security Manager prerequisites, updates links, and notes that diagnostic reporting frequency is deprecated in Intune EDR policies.
The Microsoft Sentinel prepurchase plan article clarifies its 200 GB/day pricing example and adds a warning that purchases are final and cannot be canceled or exchanged. It also includes minor wording, formatting, and metadata updates.
The article now explains one-year Defender Cloud Units, automatic application to eligible usage during the purchase term, and how to choose and purchase commit units. Links, section headings, and Azure portal navigation were also updated.
The guide changes the “Next steps” heading to “Next step” and removes the sentence beneath it.
The article now refers to “Microsoft Defender” instead of “Microsoft Defender XDR” in its introduction, headings, deployment table, signal-sharing description, and next-step section.
The article now uses Microsoft Defender instead of Microsoft Defender XDR in its deployment workflow, headings, integration instructions, and descriptions of signal correlation and Sentinel integration.
The article replaces several references to Microsoft Defender XDR with Microsoft Defender in its introduction, deployment workflow, signal-correlation guidance, management location, and next-step heading.
The article replaces references to Microsoft Defender XDR with Microsoft Defender across headings, descriptions, integration guidance, and the Defender portal link.
The overview now uses “Microsoft Threat Intelligence” and links to its Defender XDR page and getting-started guidance instead of the previous Defender Threat Intelligence references.
The documentation now describes 500 MB of free daily ingestion per node for eligible security data and says Defender for Servers Plan 2 must be enabled on the reporting Log Analytics workspace. Data must use a supported collection method, such as Azure Monitor Agent.
The article now more clearly describes using the sizing tool, reviewing prerequisites, following the tool’s steps, and using manual sizing guidance when the tool is unavailable.
The page now uses clearer wording for the steps to view software versions that have reached or are nearing end of support. Its publication date and authoring metadata were also updated.
The quickstart now links directly to content hub installation and data connector setup, labels the section for the Azure Activity data connector, identifies the wizard tabs where defaults should remain, and reorganizes related content.
The documentation page for expert, custom, manual, and on-premises deployment of the Microsoft Sentinel for SAP data connector agent was deleted, including its Azure Key Vault and CLI instructions.
The documentation received wording updates, clearer content-type links, expanded ARM terminology, and added guidance and a link for configuring data connectors. Support and content customization instructions were also clarified.
The article now describes dedicated Microsoft Defender XDR trial lab or pilot setup, including tenant provisioning and subscription activation. References to the pilot guide and configuration phases were updated to use “Microsoft Defender,” and metadata was refreshed.
The guide now more clearly describes its CSPM and CWPP coverage, recommends following the planning guides in order, renames the “Problem space” section, and updates navigation to the business-needs guide.
The page date and authoring metadata were updated, and descriptions of SOC device monitoring and readiness-assessment guidance were reworded for clarity.
Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. Its free capabilities will remain available and can be enabled at any time.
The article updates its date and authoring metadata, clarifies the Cloud overview and Vulnerabilities > Cloud navigation, improves software inventory and AWS/GCP onboarding links, and labels the BYOL scanning workflow more specifically.
Updated Microsoft Defender documentation in defender-endpoint/defender-endpoint-plan-1.md.
Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-defender-identity.md.
Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-sensor-v3.md.
Updated Microsoft Defender documentation in defender-office-365/air-review-approve-pending-completed-actions.md.
Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-sensor-v3.md.
Updated Microsoft Defender documentation in sentinel/datalake/sentinel-lake-onboard-defender.md.
Updated Microsoft Defender documentation in unified-secops-platform/overview-deploy.md.
Updated Microsoft Defender documentation in sentinel/monitor-key-vault-honeytokens.md.
Updated Microsoft Defender documentation in sentinel/ci-cd.md.
Updated Microsoft Defender documentation in defender-for-cloud/deploy-helm.md.
Updated Microsoft Defender documentation in defender-xdr/deploy-supported-services.md.
Updated Microsoft Defender documentation in defender-endpoint/device-control-deploy-manage-intune.md.
Updated Microsoft Defender documentation in sentinel/quickstart-onboard.md.
Updated Microsoft Defender documentation in defender-for-cloud/onboard-machines-with-defender-for-endpoint.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/ot-deploy/ot-deploy-path.md.
Updated Microsoft Defender documentation in defender-endpoint/defender-endpoint-plan-1.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/best-practices/plan-corporate-monitoring.md.
Updated Microsoft Defender documentation in sentinel/migration.md.
Updated Microsoft Defender documentation in defender-for-cloud/plan-multicloud-security-get-started.md.
Updated Microsoft Defender documentation in defender-xdr/integrate-microsoft-365-defender-secops-plan.md.
Updated Microsoft Defender documentation in defender-xdr/integrate-microsoft-365-defender-secops-services.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/tutorial-onboarding.md.
Updated Microsoft Defender documentation in defender-business/mdb-onboard-devices.md.
Updated Microsoft Defender documentation in sentinel/datalake/sentinel-lake-onboard-defender.md.
Updated Microsoft Defender documentation in defender-for-cloud-apps/proxy-idp-adfs.md.
Updated Microsoft Defender documentation in defender-for-cloud-apps/proxy-idp-okta.md.
Updated Microsoft Defender documentation in defender-for-cloud-apps/proxy-idp-pingone.md.
Updated Microsoft Defender documentation in sentinel/dynamics-365/deploy-dynamics-365-finance-operations-solution.md.
Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-sensor-v3.md.
Updated Microsoft Defender documentation in sentinel/sap/deploy-sap-btp-solution.md.
Updated Microsoft Defender documentation in defender-for-cloud-apps/proxy-deployment-any-app-idp.md.
Updated Microsoft Defender documentation in sentinel/connect-azure-stack.md.
Updated Microsoft Defender documentation in defender-for-identity/deploy/capacity-planning.md.
Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-end-of-support-software.md.
Updated Microsoft Defender documentation in defender-for-cloud/concept-authentication-architecture-aws.md.
Updated Microsoft Defender documentation in defender-for-cloud/authentication-architecture-google-cloud.md.
Updated Microsoft Defender documentation in defender-for-cloud/defender-for-containers-architecture.md.
Updated Microsoft Defender documentation in defender-for-cloud/tutorial-enable-servers-plan.md.
Updated Microsoft Defender documentation in defender-for-cloud/defender-for-servers-overview.md.
Updated Microsoft Defender documentation in defender-for-cloud/enable-sql-database-plan.md.
Updated Microsoft Defender documentation in defender-for-cloud/defender-for-containers-private-clusters.md.
Updated Microsoft Defender documentation in defender-for-cloud/defender-for-containers-deploy-azure-cli.md.
Updated Microsoft Defender documentation in defender-for-cloud/github-advanced-security-deploy.md.
Updated Microsoft Defender documentation in defender-endpoint/mobile-pretest-android.md.
