Daily Defender News
A cross-product view of Microsoft Defender changes related to Cloud and workloads.
The documentation now describes an optional Application Vulnerabilities workbook tab and an analytics rule correlating SAP Application Vulnerability Report Service findings with BTP audit events. The rule detects custom apps with open high or critical vulnerabilities, using a default CVSS threshold of 7.0 and a 14-day evaluation window.
The documentation adds a separate preview connector for SAP BTP Application Vulnerability Report Service findings, plus a preview analytics rule and an Application Vulnerabilities workbook tab with a vulnerability posture KPI.
The October 2026 documentation adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect interactive XSUAA logins involving custom apps with open high or critical vulnerabilities.
The comparison now documents Defender portal preview support for environment onboarding, plan management, and cloud security cost reporting. It also clarifies that data export remains available in the Azure portal.
The documentation now states that updates to cloud scopes, including subscription changes, may take about 8–10 hours to appear in portal filters and scoped data views. During the refresh, results may be incomplete or empty even when the configuration was saved.
New documentation describes connecting Azure subscriptions and management groups to Microsoft Defender for Cloud, including prerequisites, tenant preparation, and connector setup. The capability is in preview.
The article now specifies that it covers enabling Defender for Cloud on an Azure subscription in the Azure portal and links to separate instructions for connecting Azure commercial subscriptions or management groups in the Microsoft Defender portal.
The article now states that the calculator covers the existing plan-pricing model and links to separate guidance for estimating costs with the Defender Workload Unit (DWU) pricing model.
The documentation now describes connecting Azure commercial environments at subscription or management-group level and configuring Defender for Cloud plans for selected or all connected environments. AWS, GCP, and unsupported Azure environments must still be onboarded through the Azure portal.
The Microsoft Learn page describing eligibility, required roles, enablement steps, and expected results for Defender for Cloud preview features in the Defender portal was deleted.
The documentation introduces Defender Workload Units (DWUs), a Cloud Security Cost Estimator, and a Cloud security cost report. It also describes updated workload measurements, plan consolidations, and DNS billing treatment.
The FAQ now explains that existing Defender for Endpoint servers need no changes, how to onboard new servers, Direct onboarding scope, offboarding options, and why historical records may remain visible. The offboarding link was also updated.
The documentation now states that cloud security data supports Azure, AWS, and GCP, while onboarding and plan management currently support Azure commercial environments only. After migration, plan settings become view-only in the Azure portal, resource-level configurations are not preserved, and billing uses Defender Workload Units.
The page now documents supported environments, scope-level-only plan configuration, replacement of resource-level settings during migration, remaining Azure portal capabilities, and daily cost fluctuations.
The new guidance covers global or scoped plan configuration across connected Azure commercial environments, required permissions, migration behavior, and the loss of resource-level configurations after migration. The capability is in preview.
On October 20, 2026, the expanded server security experience will support automated and manual onboarding for Azure, Azure Arc-enabled, Windows, Linux, and on-premises servers. Cloud security plan management will also become available in the Defender portal, including DWU cost tracking and eligible 30-day trials.
The procedure now states that direct onboarding affects all eligible existing and future non-Azure servers in the same Microsoft Entra tenant. Individual-server or pilot-group selection isn't supported, and prerequisites include healthy Defender for Endpoint telemetry, a matching tenant, and specific roles.
A new page explains that moving plan management from the Azure portal to the Defender portal changes billing to Defender Workload Units, shifts configuration to tenant, management-group, or subscription scope, and may replace, consolidate, or measure plans differently. Resource-level configurations are not preserved, and migrated settings become view-only in Azure portal.
The documentation now lists required CrowdStrike REST API scopes, links to upgrade notes, adds Pathlock deployment guidance, removes the Red Canary connector section, and adds SilentPush Feeds details.
The table adds entries for SilentPush Feeds, Theom, and Theom via the Codeless Connector Framework, and removes the Red Canary Threat Detection entry.
The documented KQL now queries SQL Vulnerability Assessment records, filters resources by Log Analytics workspace IDs, and returns workspace ID, machine name, and machine UUID. The prior subassessment, OnPremiseSql, and 30-day scan-time filters were removed.
The article now states that, as of October 15, 2026, two EWS-based detections are marked Retired and no longer generate alerts.
The documentation now explains that protection applies across tenants within the same Microsoft Edge work-profile session. Separate Edge work profiles provide separate session enforcement between tenants.
The connector reference now uses a relative setup-guide link, an anonymized server URL example, and reformatted CrowdStrike region mapping table.
The guide now lists auto-labeling migration for SharePoint and OneDrive, plus DLP file-policy migration for Google Workspace, Box, Dropbox, and Salesforce. Previously, it listed only SharePoint and OneDrive DLP migration as supported.
When 250 or more Defender-tagged snapshots accumulate because deletion authorization fails, new scans are suspended for the affected AWS scanning scope to limit additional storage charges.
The instructions now use Create > Logic App playbook and distinguish Consumption triggers—including alert, case, and legacy options—from Standard playbooks, which start with Blank playbook. The page also explains case-versus-incident terminology and adds supporting links.
The documentation now states that deletion authorization failures involving 250 or more Defender-tagged snapshots suspend new scans for the affected AWS scope. Snapshots continue accruing storage charges until deleted.
The comparison table now describes excluding a rule from the correlation engine and marks it supported for analytics rules and custom detections, with configuration guidance linked.
The FAQ now recommends having more than one subscription owner and removing disabled or guest accounts with owner, write, or read permissions on Azure resources.
The documentation now specifies that Security Admin and Owner roles on the subscription containing the Log Analytics workspace are required to enable, disable, or change File Integrity Monitoring. Security Reader can view results.
The release notes now describe a new server asset page combining cloud and endpoint details, link to server offboarding guidance, and reference the new Defender server security experience.
The reference adds a connector that ingests SAP BTP application vulnerability findings into Microsoft Sentinel. It also updates Confluence permissions and DCR support, and changes Corelight naming and access requirements.
The table now labels the Netskope Web Transactions connector as deprecated, removes several older connector entries, and adds new connectors plus Snowflake V3 tables.
The Kubernetes misconfiguration enforcement page now lists ElazarK and elkrieger instead of dlanger as its author metadata.
Two authoring metadata link entries were updated, but their URLs remain unchanged.
The documentation now explains that the generated table sets `disabled=false` to enable custom parsers and advises forwarding `pack` only when the source-specific parser supports it.
The document’s author and ms.author metadata changed from TimShererWithAquent and v-tishe to ElazarK and elkrieger.
The document author changed from dlanger to ElazarK, and the ms.author value changed from dlanger to elkrieger.
The page author changed from TimShererWithAquent to ElazarK, and the ms.author value changed from v-tishe to elkrieger.
The FAQ metadata date changed from June 9, 2026, to September 23, 2026.
The page adds an Email Event mapping to `_Im_EmailEvent`, updates the Process Event mapping to include `_Im_ProcessEvent`, and refreshes ontology links and the publication date.
The documentation adds AgentEvent and AssetEntity entries, updates the ProcessEvent listing, and revises parser examples to show explicit parameter-to-column mappings. Several examples also include fields such as `pack` and `disabled`.
The parser-management documentation updates custom unifying-function examples to pass `disabled=disabled` where supported, including AgentEvent and DNS parser examples, and adds or updates parser entries.
The documentation now lists the `_Im_AgentEvent_AnthropicClaudeCompliance` parser, its BlueVoyant Codeless Connector Framework source, and that it uses the pack parameter. The page date was also updated.
The experience combines Microsoft Defender for Endpoint and Defender for Servers data, enabling unified inventory, cross-service investigations, Go hunt, and access management through RBAC, device groups, and cloud scopes. Administrators can also offboard eligible servers from Defender for Endpoint by disabling Defender for Servers for a subscription.
The normalization page now links to the Email Event schema and has an updated documentation date.
The schema reference now lists the Email Event schema as `EmailEvent`, version 1.0.0, with GA status.
Starting October 5, 2026, KSPM misconfiguration recommendations will align with Kubernetes workload controllers instead of individual running container instances.
The page now states that re-ingestion costs follow standard log ingestion pricing for paid tables, with final costs affected by tenant discounts or commitment tiers.
The documentation now states that the integration can use an existing Defender for Endpoint sensor from the same tenant, adds updated platform and Linux requirements, and lists pre-deployment checks for connectivity, proxy authentication, file-system settings, and security policies.
The documentation heading for filtering malware scans to specific items no longer includes “(Preview).”
Starting October 15, 2026, the Defender for Cloud Apps integration with Identity inventory will move from opt-in to automatic enablement for eligible tenants that do not use the listed excluded configurations.
Microsoft Defender for Storage on-demand malware scanning can now target individual blobs or files, containers or file shares, or objects matching a path prefix. REST API filters define the scope; without filters, the entire storage account is scanned.
The comparison table now identifies flexible rule frequency and configurable lookback for custom detection rules, with links to detailed guidance. Page metadata was also updated.
The documentation now lists flexible and high-frequency support for Sentinel data. It specifies lookback limits of up to 48 hours for frequencies over one hour and up to 14 days for frequencies of one hour or less; lookback remains in public preview.
App/instance admin and User group admin role assignments can no longer be used in new configurations. Existing configurations remain supported.
The regional availability documentation now lists ap-southeast-7 among the supported regions.
The Cisco Meraki connector now documents File Scanned detections and the `CiscoMerakiFileScannedEvents_CL` table. F5Telemetry LTM and RFI Playbook Alert Results tables are marked supported, and workspace transform DCR support is documented.
The reference now lists CiscoMerakiFileScannedEvents_CL and changes F5Telemetry_LTM_CL and RFI_PlaybookAlertResults_V2_CL from No/No to Yes/Yes in the two status columns.
The page now only states that Foundational CSPM is free. It no longer includes the October 27, 2026 opt-in notice for new Azure subscriptions or the AWS and GCP scope note.
The overview clarifies that a server is a device running a server operating system and links to the common questions page.
The documentation now states that VMs in the Starting power state are billed and links to upcoming billing updates.
Starting October 27, 2026, new Azure subscriptions will have Foundational CSPM disabled by default. The plan remains free; existing subscriptions and AWS/GCP environments are unaffected.
Plan 1 will no longer bill desktop, workstation, and mobile devices as servers. For Plans 1 and 2, server identification will run more frequently and count deployed machines individually, which may change billed server totals.
Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. It remains free and can be enabled at any time; existing subscriptions and AWS or GCP environments are unaffected.
The documentation adds Risk management templates, including New high risk app and Risk score policies with customizable risk thresholds. It also updates monitoring guidance and the navigation path.
The page updates wording from app compliance to app security, renames the sharing section, and says administrators can review app details, aggregated data, and permission usage before viewing more information in Entra ID.
The guide now describes itself as a quickstart and changes the step from assessing app compliance posture to assessing security posture, including an updated link. Author and publication metadata were also refreshed.
The app categories documentation now includes Risky apps—apps with a high risk score—and adds Risk score. Minor wording was also clarified.
The documentation now describes risk scores, last-used dates, and a Used by AI Agents (Preview) field. Salesforce inventory is also documented as including Connected Apps and External Client Apps.
The article now describes app risk scores, privilege levels, publisher information, and usage, clarifies SaaS insight definitions, and links to filtering and query guidance.
The page title and headings were simplified, portal navigation wording was updated, and “drop-down” was standardized to “dropdown.” Two authoring references were also added.
Updated capitalization and wording throughout the classic configuration article, including configuration checks, exemptions, Resource Manager templates, and Boolean baseline examples.
The article title, portal terminology, prose, list punctuation, emphasis, and screenshot formatting were revised.
The article updates its title, prerequisites, navigation labels, instructions for existing Security Private Link resources, and descriptions of the containers sub-resource. Several sentences were also rewritten for clarity and consistency.
Updated the page title, wording, formatting, and the GitHub Advanced Security for Azure DevOps link. The page continues to state that MSDO CredScan secrets scanning is deprecated.
The article updates prerequisite wording, navigation text, capitalization, and makes the environment-settings screenshot expandable.
The documentation now presents the Azure, Defender CSPM, Endor Labs account, API key, and role prerequisites in clearer noun-phrase format. The portal instruction was also changed from “Navigate to” to “Go to.”
The article updates wording, formatting, and step instructions, including clearer prerequisites, assignment fields, and supported ticket types. The assignment screenshot was also repositioned.
The article’s title, introduction, prerequisites, navigation steps, ServiceNow selection instructions, and grace-period wording were revised for clarity and consistency.
The article now uses revised headings, wording, links, and step-by-step instructions. Prerequisites and details about supported Purview information types, labels, and sensitivity thresholds were clarified.
The documentation now describes Airlock Digital SaaS polling, self-hosted polling, and push connectors, including supported data tables, prerequisites, setup, and connection behavior.
The article’s applicability changed from Azure commercial cloud only to both Azure commercial and Azure Government clouds.
The article now uses updated Defender External Attack Surface Management naming, clearer prerequisite wording, and revised steps for opening Cloud security explorer and Attack path analysis.
The page updates terminology and UI steps, adds instructions for disabling all four Defender for Databases subplans, and clarifies autoprovisioning, Azure Policy assignments, and resource-level plan settings.
The procedure now uses revised wording for the outcome, Azure portal navigation, and Databases plan controls. It states that disabling the plan stops SQL alerts and recommendations for selected machines.
The article updates heading capitalization, link and emphasis formatting, and punctuation in the filtering option descriptions.
The article was retitled and updated with a clearer introduction, revised formatting, refreshed links, and clarified descriptions and examples for CVE, image digest, OS version, severity, and fix-status exclusions.
The article reorganizes prerequisites and clarifies that enabling Defender CSPM or Defender for Storage automatically enables sensitive data discovery. It also documents sensitivity settings, the up-to-24-hour wait for initial results, and updated AWS S3 and RDS discovery steps.
The article updates its title, description, navigation steps, query instructions, and examples. It also removes the guidance about Azure Resource Graph findings and filtering by sensitivity labels and sensitive information types.
The documentation was edited for clearer wording, formatting, and navigation across Express/Classic configuration guidance, scan history, finding exclusions, Logic Apps notifications, API usage, and Resource Manager baseline examples.
The feature-availability page was refreshed, including metadata and reference links. The Codeless Connectors Platform entry remains in public preview, while its final availability field changed from No to Yes.
The SQL machine protection documentation now links to instructions for verifying SQL machine protection in government cloud.
Microsoft added a guide covering prerequisites, Partner Center publishing, and Azure Government endpoint updates for Sentinel CCF data connector solutions.
The publishing guidance now links to separate instructions for making published solutions that include a CCF data connector available in Azure Government.
The enhanced agent for Defender for SQL Servers on Machines supports resource- and subscription-level enablement for SQL Server instances on Azure VMs and Azure Arc-enabled machines in Azure Government, without requiring Azure Monitor Agent deployment.
The article now expands Defender CSPM and CVE on first use, clarifies the dashboard’s purpose, standardizes severity labels and Kubernetes terminology, and improves wording and punctuation.
Adds instructions for using Defender for Cloud Apps app governance to filter, investigate, and assess Microsoft Entra RBAC roles assigned directly to service principals, including role permissions, privilege levels, and risk signals.
The guide now states that, after publishing a CCF data connector solution to Azure public cloud, publishers must enable Azure Government for the plan in Partner Center.
The reference adds mappings for Fortra Agari, Airlock Digital, BloodHound Enterprise, and Cisco Meraki connectors, updates ASim and Armis entries, and removes several older mappings.
The documentation now labels the procedure as updating the plan at the subscription level and directs administrators to select **Action required** instead of **Settings**.
The article’s wording, prerequisites, portal navigation, step numbering, and event-log instructions were revised. Guidance for regions, endpoints, platform types, and XPath filters was clarified, and a screenshot was removed.
The page replaces “blast radius” with “impact,” changes numbered lists to bullets, and revises wording for impacted-asset filtering, repository integration, exemptions, and Azure portal availability.
The article now uses Microsoft Defender for Servers Plan 2 terminology and clearer wording for the 500 MB per-node daily allowance, subscription-wide calculation, and Log Analytics workspace application.
The article received wording, capitalization, punctuation, and formatting improvements. The validation steps remain the same, including sending a suspicious `User-Agent` value, and screenshots now support lightbox viewing.
The article now applies to both Azure commercial and Azure Government clouds, replacing the separate Government-cloud article reference.
Seven Azure Storage alert entries now list their severity as Informational instead of High, Medium, or Low variants.
The documentation now states that parser creation skills normalize each source record independently and preserve record cardinality. Query-local datatable/lookup mappings are allowed when lookup keys are unique, while same-table and cross-table event enrichment are not used.
The documentation now restricts parsers to the declared source table, one normalized output per source record, and scalar or local static mappings. Cross-table enrichment, watchlists, multi-value expansion, joins, aggregation, and deduplication are prohibited for parser operations.
The article now more clearly explains that it covers supported RegEx syntax, known limitations, and examples for building expressions in content inspection and file policies.
The documentation now describes required ARM template files, folder layouts, metadata fields, validation checks, and incident-versus-alert trigger types for Sentinel playbooks.
The article updates its title and metadata, standardizes formatting, renames tab headings, and clarifies instructions for adding OR condition groups and entity-property values.
The documentation now highlights that using **Remove all tags** removes the **Custom app** tag, while retaining instructions for filtering custom apps by that tag. Wording around custom apps was also clarified.
The article now explicitly directs readers to use Azure Resource Graph queries in Power BI, improves the introductory and sample-query wording, and updates metadata.
The article now focuses on adding Sentinel MCP tools to AI agents, clarifies how to use the client secret and Azure values in Copilot Studio OAuth settings, and retitles step 3 around configuring the redirect URI.
The article now distinguishes CSV and JSON template guidance, adds instructions for choosing CSV template options, and describes CSV schema and JSON STIX 2.1 examples more precisely. Documentation metadata was also updated.
The article now more clearly covers authentication, autoloading providers and components, Python kernels, package installation issues, and MSTICPYCONFIG environment variables, with platform-specific tabs for Windows, Linux, and Azure Machine Learning.
The page now includes clearer advanced-options setup guidance, prerequisites and deployment references, container-preserving token renewal instructions, updated Defender portal terminology, and expanded Syslog troubleshooting guidance.
The article now explains that the unified MCP server exposes Sentinel tool collections, links to the getting-started guidance, and more explicitly identifies the endpoint as the MCP server endpoint for Security Copilot agent creation tools. Title and metadata were also refreshed.
