Daily Defender News
A cross-product view of Microsoft Defender changes related to General.
The documentation now explains how to grant Microsoft Sentinel permissions to delegated remote tenant groups through Defender URBAC, including required permissions, role assignment, and workspace selection. It also retains the resource-group assignment option and clarifies management-plane versus data-plane access.
The user investigation documentation revises its authoring reference links and changes `GraphApiAuditEvents` to `GraphAPIAuditEvents`.
The documentation now states that block events from Microsoft Prompt Shields for Foundry, Copilot Studio, and Copilot Agent Builder are recorded as behaviors.
The document’s listed author changed from monaberdugo to kschwabacher.
Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.
The page now lists Crystal Typhoon and Storm-2380, Storm-2570, Storm-2634, Storm-2990, Storm-2992, Storm-3069, Storm-3119, Storm-3168, and Storm-3189, including available aliases, classifications, and reference links. The page date was also updated and two internal authoring links were removed.
Administrators can select specific detection sources within service sources when creating or editing alert tuning rules, including include/exclude choices for existing rules.
The documentation now describes malicious content propagation, secret exfiltration, evasion techniques, and unsafe email domains, including how blocking affects user requests, model responses, tool requests, and tool responses.
The page adds two reference links, refreshes the Microsoft Sentinel table entry, and adds a sample two-column table.
Updated reference links and removed “(Preview)” from the headings for creating or editing custom roles, deleting roles, and importing roles.
The page updates its DevRel reference links and removes the “Important” callout stating that the feature is currently in preview.
Microsoft Defender for Office 365 will localize the default "Mark and notify" email template based on users' Outlook language settings, improving clarity in user-reported message notifications. Rollout starts June 2026 globally, with no changes to message classification or custom templates. No action is required.
The page no longer labels Microsoft Store applications as Preview or lists individual supported apps. It now states that vulnerability assessment is available for a limited set of commonly used Microsoft Store applications.
The documentation now states that the built-in rule took effect in early October 2026. DLP signals are treated as behaviors, so they do not generate alerts or appear in the incident queue, but remain available in advanced hunting.
The documentation adds steps for disabling a built-in alert tuning rule and states that each alert tuning rule supports up to 200 conditions.
The What's new entries for the preview AgentsInfo and AIAgentsInfo advanced hunting tables now show table names as inline code instead of linked text.
The page now states that detection rules involved in creating a source incident are added to the target incident. It also explains that correlation settings control alerts from analytics rules or custom detections.
The page author metadata changed from guywi-ms/guywild to poliveria/pauloliveria.
Microsoft Defender for Office 365 extends Teams URL protection to detect malicious URLs in QR codes post-delivery, warning users and enabling security teams to investigate via Advanced Hunting. Rolling out worldwide from October to November 2026, no user action is required, but admins should review related settings and processes.
The virus initiative criteria page updates its VB100 entry from Grade C or higher to Grade B or higher for a 95% detection rate. Its platform identifier was also updated.
The documentation now explains that identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. It clarifies Unified RBAC permissions for both products’ data sources and adds guidance on role assignments and data-source scope.
The documentation date was updated, “Dell Command” was changed to “Dell Command | Update,” and the listed software examples were revised to add 1Password, Beyond Compare, and Evernote while removing two entries.
Microsoft Defender for Office 365 will enable Teams user reporting by default starting late October 2026 for licensed organizations. Users can report suspicious Teams content to improve threat detection. Admins can review or opt out via a dedicated Defender portal page before October 25, 2026.
Microsoft Defender introduces native Case Management to unify threat investigations, assign analysts, track SLAs, and capture notes in one workspace. Launching in public preview September 2026, it integrates with existing workflows and permissions, enhancing security team coordination and response efficiency without requiring manual migration.
Exchange Web Services (EWS) in Exchange Online will be retired starting October 1, 2026, with related Microsoft Defender for Cloud Apps app governance detections ending October 15, 2026. Organizations not using EWS need no action; those continuing EWS use will lose related alerts and should migrate away from EWS.
The documentation now states that unpublished Foundry agents, including playground-only agents, aren't supported for threat detection and links to publishing guidance. It also updates terminology and metadata.
The documentation now labels Copilot Studio agent protection as Preview and describes protection for Foundry agents, covering user requests, agent responses, tool invocations, and tool responses.
The documentation now lists alerts from Defender for Endpoint, Office 365, Cloud Apps, Identity, and onboarded Microsoft Sentinel sources. It also clarifies that data availability depends on deployed services and accessible Sentinel workspaces, and recommends joining AlertEvidence with AlertInfo by AlertId for alert metadata.
The documentation now states that AlertInfo can contain Microsoft Sentinel alerts associated with incidents when Sentinel is onboarded to the Defender portal. Data availability depends on deployed Defender services and accessible Sentinel workspaces.
The Analyst insights page was deleted. Its previous notice stated that Defender TI will be discontinued and merged into Microsoft Defender, with existing access available until August 1, 2026.
The article’s introductory text and description of filter sorting were rewritten for clarity. The publication date and custom metadata were also updated.
The article now identifies Defender Vulnerability Management as part of Microsoft Security Exposure Management, clarifies licensing requirements, and refreshes the steps and terminology for viewing recommendations, exposed assets, and remediation activity.
The article now provides clearer navigation and instructions, updates terminology and links, refreshes metadata, and clarifies how device values affect exposure scores.
The article now separates prerequisites and states that users must be default privileged admins or have the Admin role on the sensor. Setup wording for Azure portal and OT network sensors was also streamlined.
The documentation adds Plan 2 prerequisites covering endpoint, email, identity, cloud workload protection, Sentinel ingestion and connectivity, access permissions, 90-day retention, and UEBA. It also updates data storage, retention, deletion, and GCC availability details.
The article now describes block and warn actions, prerequisites, file-hash-based indicators, and the updated Advanced features link. Wording was also refined around vulnerable application versions and indicator limits.
The documentation now states that Security Delivery Experts are included for services licensed for at least 1,500 seats, replacing the previous 500-device threshold.
The page now clarifies that activating Defender unified RBAC for Email & collaboration imports only actively assigned source roles and role groups. Unassigned built-in roles and groups are not imported, and the permission mapping tables were revised.
Updated the article title, date, metadata, formatting, and terminology for configuration status and failure reporting.
The article updates its metadata and rewords the prerequisite requiring the sensor’s management-port IP address to reach the OT network before active monitoring is configured.
The page clarifies distribution-file selection, CMake and IAR build instructions, configuration-setting descriptions, network activity collection, Log Analytics guidance, and related-content links. The security alerts and API links are now marked as preview.
The guidance now explains that administrators can select an existing tag or create a new one, and warns that deleting a dynamic rule removes it and may affect tag or device value assignments. Turning off the rule stops it from applying while retaining it.
The page now describes automatic device isolation for Microsoft Defender for Endpoint-managed end-user workstations and identifies it as in preview. It adds prerequisites, safeguards, exclusion guidance, and clearer Sense Agent and connector setup instructions.
The article now clarifies tenant relationships, governing-tenant accounts and group representation, the disabled-by-default Enable invitations setting, and that Sentinel Azure RBAC grants management-plane—not data-plane—access.
The article clarifies resource provider registration, app and service principal creation, client-secret handling, namespace settings, resource ID retrieval, and event hub choices.
The guide updates metadata, wording, capitalization, and references to examples. It also renames “Next steps” to “Related content” and adjusts the Micro agent event collection link presentation.
Updated the page metadata, clarified the OT sensor activation prerequisite link text, and renamed the final section from “Next steps” to “Related content.”
The article now provides an overview of roles and permissions, clarifies Microsoft Entra global roles versus Defender unified RBAC, adds prerequisite guidance, and improves links to feature-specific permission mappings and site security monitoring.
The article now uses clearer terminology and navigation for the OT sensor deployment path, subnet configuration, ICS subnet definition, port and VLAN naming, DNS lookup, and DHCP procedures. Metadata and section formatting were also updated.
The page metadata and wording for adding policies were updated. It reiterates that newly created policies can take up to one week to affect inventory.
The article now separates setup and tenant management links and simplifies guidance about tenant visibility, switching groups, and refreshing after changes.
The article now presents its user-management procedures more clearly, including prerequisites as notes, revised wording and links, and updated metadata.
The page metadata was refreshed, wording was updated to refer to potential attack paths, and the “Next steps” section was renamed “Related content” while retaining the same links.
The guide updates capitalization, phrasing, drop-down terminology, the Save button label, and changes the “Next steps” heading to “Related content.”
The article now documents selecting GDAP remote tenant groups for a custom role assignment. Members of selected groups inherit the configured permissions, data-source access, and applicable scopes.
The article title now specifies OT sensors, and the instructions clarify how to create and update custom data mining reports. Metadata and the final section heading were also updated.
The page now clarifies the role-requirements link, renames “Next steps” to “Related content,” and revises wording for cloud-connected sensor reports. The same related report links remain available, with metadata also updated.
The article now includes prerequisites, steps for creating recommendation and CVE exceptions, and guidance that exception durations cannot be extended. It also explains that a new exception is required after expiration.
The overview page was revised to describe automatic attack disruption as containing attacks, limiting lateral movement, and reducing impact. The page date and authoring metadata were also updated.
The article updates navigation labels, clarifies and renumbers role and assignment steps, adds screenshot descriptions, refreshes metadata, and includes related-content links.
The data sets page was deleted. Its notice stated that Defender TI will be merged into Microsoft Defender and retired on August 1, 2026; existing customers retain access until then.
The table documentation removes the Preview label and prerelease notice and adds the `PolicyInfo` and `Policies` columns.
The table no longer includes the Preview label or prerelease notice. It adds physical access, removable media, and risky AI usage fields, while removing several URL, email, file-path, workload, and Cloud App Alert fields.
The overview now refers to Microsoft Threat Intelligence and describes capabilities in Microsoft Defender XDR and Microsoft Sentinel that aggregate and enrich threat data from multiple sources.
The documentation now explains how to use Copilot in Defender on the Threat analytics, Intel profiles, and Intel explorer pages, including prompts, built-in actions, and saved chat sessions.
The documentation now names the user-trial setting, adds links to trial-management sections, clarifies the 30-day extension request, and states that trial data is retained for approximately 180 days before permanent deletion.
The documentation now refers to “Defender XDR” instead of “Defender for XDR” in the automated investigation and response description.
The playbook now uses Microsoft Defender branding, updates its date, and revises the ransomware signal table to include Defender for Cloud Apps for email or cloud-app exfiltration and Defender for Endpoint for endpoint file encryption. Related API, Sentinel integration, and queue references were also renamed.
The documentation now describes Vendor as the device’s hardware vendor, as identified from the MAC address.
The DeviceInfo table reference now documents the DeviceRoles string column, including JSON-formatted roles, confidence levels, and last-seen times. It also includes minor formatting and wording updates.
The page heading changed from “Devices” to “Devices in multitentant management.”
The article now covers finding OT devices, filtering inventory data, investigating device details, managing site associations, and accessing vulnerability-prioritization guidance. Metadata was also updated.
The page now uses clearer bold headings and expanded descriptions for attack-surface snapshots, risk and CVE prioritization, Security Copilot insights, and attack-surface curation. Image markup was also updated, and several example prompt rows were removed.
The article now provides clearer steps and prerequisites for editing, deleting, and exporting roles. It also highlights that deleting an active workload role removes its assigned user permissions and clarifies export behavior for newer tenants.
The recommendations page was revised with updated wording, filtering and navigation instructions, terminology, metadata, and section headings.
The capability is deprecated effective September 1, 2026, closed to new enablement, and existing coverage ends at the organization’s next renewal. Microsoft Defender Experts MDR Plan 2 is the stated replacement.
The article now refers to Microsoft 365 E5 or E5 Security plans, clarifies that disabling enterprise IoT security removes access to alerts, vulnerabilities, and recommendations, and updates the standalone-license link text.
The documentation clarifies that custom activity data from Microsoft Sentinel must include a strong identifier combination for the host to be mapped and displayed in the Device Timeline.
The documentation now explains the 0–100 reputation score, its Malicious, Suspicious, Neutral, and Unknown ranges, scoring inputs, and infrastructure data sources including passive DNS, port scans, web crawling, and reverse DNS.
The replacement of AADSignInEventsBeta is now scheduled for October 19, 2026, with queries migrated automatically. Custom detections require no changes, and several field definitions and schema fields were updated.
The replacement date for AADSpnSignInEventsBeta moved to October 19, 2026. Queries will migrate automatically, custom detections need no changes, and several fields are now documented.
The page now uses clearer wording for recommendation and CVE exception scope, explains how exceptions affect portal counts and impact values, and updates the related-content heading.
The article now explains exclusion policies, adds permission requirements for device and identity exclusions, clarifies policy application and IP exclusion steps, and recommends excluding specific assets rather than opting out entirely.
The page now lists June–August 2026 corrections to detections, recommendations, CVSS scores, and tags, plus MDVM support for additional applications.
The tutorial page was deleted. Its notice stated that Defender TI will be discontinued and merged into Microsoft Defender, with existing customers retaining access until August 1, 2026.
The FAQ now distinguishes Plan 1 from Plan 2, including Sentinel requirements, supported third-party sources, Sentinel deployment responsibilities, and incident coverage. Plan 2 extends coverage to supported third-party sources but does not manage the customer’s Sentinel deployment.
The article now explicitly refers to Microsoft Defender XDR plus Microsoft Defender for Identity preview customers and clarifies that BIOS recommendations appear when a specific BIOS version is installed on at least 5% of devices across organizations. Metadata was also updated.
The documentation date and metadata were updated, and descriptions and links for detection, protection, investigation, response, and Copilot metrics were clarified.
The page adds Frontier Blizzard, Storm-2581, and Storm-3127; updates several Storm group classifications to financially motivated; and revises links to Defender XDR threat analytics and Microsoft Graph Threat Intelligence APIs.
The article now provides clearer descriptions of SMBIOS requirements, renamed configuration sections, stable anchors, corrected module twin JSON formatting, and reorganized related links.
The page now explicitly identifies the listed products and plans as applying to Advanced hunting queries in Microsoft Defender Vulnerability Management. The page date and authoring metadata were also updated.
The article was updated with a new introductory description and additional explanations for the taskkill.exe process-stop and cipher.exe multi-drive data-deletion queries. The publication date was also updated.
The page refreshes metadata and clarifies permission prerequisites, Defender unified RBAC role terminology, activation instructions, and the relationship between imported roles and their source roles.
The infrastructure chaining documentation was deleted. It described Defender TI investigation workflows and stated that Defender TI will be merged into Microsoft Defender before retirement on August 1, 2026.
The article now has clearer installation wording, reordered repository setup commands, and updated guidance that the baseline validation failure recommendation may take up to one hour to appear in IoT Hub.
The page date changed from June 15, 2026 to August 7, 2026. Links for Defender for Office 365 and Defender for Cloud Apps were updated to new URLs.
The article now explains pulling incidents through REST APIs and streaming event data through Azure Event Hubs to supported SIEM platforms. It also clarifies terminology for Splunk CIM mapping and the ArcSight SmartConnector, which replaces the retired FlexConnector.
The article now links directly to asset-specific filter guidance, uses clearer section titles and anchors, and clarifies the procedure for removing the default Approved state filter. Metadata was also updated.
The page updates headings, anchors, wording, and tag-color descriptions. It also notes that alert suppression is incompatible with custom detections and recommends fine-tuning them to avoid false positives.
The article title, headings, descriptions, and deployment references were updated from Microsoft Defender XDR to Microsoft Defender. Threat intelligence wording and tutorial links were also revised, along with metadata and the publication date.
The article’s publication date changed from June 12 to July 3, 2026, and its custom authoring metadata was updated. The supplied content excerpt is unchanged.
The documentation now states that a built-in alert tuning rule will take effect in early October 2026. In Microsoft Defender XDR, affected DLP signals will appear as behaviors instead of alerts, so they will not generate alerts or enter the incident queue, but will remain available for advanced hunting.
The article now includes a clearer introduction, an updated Microsoft Sentinel connector link, revised SOAR terminology, and a KQL query for finding a specific DLP alert by SystemAlertId and correlating it with CloudAppEvents activity.
The page refreshes metadata and clarifies how to investigate Defender for IoT incidents, use the DeviceInfo Site property in advanced hunting, and interpret the San Francisco site query.
The article’s publication date, custom authoring identifier, and introductory text were updated.
The Defender TI access and customization quickstart was deleted. Its content stated that Defender TI will be discontinued and merged into Microsoft Defender, with existing customers retaining access until August 1, 2026.
The page now links to the Microsoft Defender Action center and clarifies that **Apply to X more instances of the selected quarantined file** is used before selecting **Undo**. The documentation date was also updated.
The page date changed from June 15 to July 2, 2026. The “See also” section was renamed “Related content” and given a direct anchor.
The page date and wording were refreshed, and the settings section was renamed to “Change automated investigation settings” with an updated anchor and additional learning link.
The documentation now consistently refers to email notifications, clarifies that severity filters can be set for each service or detection source, and refines the instructions for creating rules and opening incidents from notification emails.
The documentation now refers to these capabilities as being in Microsoft Defender instead of Microsoft Defender XDR and uses the complete link for automated investigation and response.
The article now explains Automatic and Manual update modes, provides a direct onboarding link, clarifies portal navigation and package status details, and links the Sites and sensors page.
The page now explicitly names the Incident correlation default setting and clarifies that individual analytics rules can override it with the `#INC_CORR#` description tag. Microsoft Sentinel Contributor role wording and page metadata were also updated.
The page title, heading, role-and-permissions link text, metadata, and formatting were updated.
The page adds guidance for calculating detected devices for standalone licensing and warns that disabling Enterprise IoT security stops all purpose-built alerts, vulnerabilities, and recommendations. It also clarifies cancellation steps for legacy plan customers.
The article was updated with a new date, clearer incident-lifecycle wording, a Microsoft Defender portal access note, expanded KQL terminology, and more precise instructions for exporting an Incident report as a PDF from the Copilot side panel.
The article was refreshed with clearer wording, updated terminology and capitalization, improved formatting of UI labels, and revised instructions for filtering, exporting, and identifying devices that have not recently communicated.
The article now describes sizing, purchasing, and updating licenses, including moving from a trial to a permanent license. Section headings, links, metadata, and the fallback from Purchase services to Marketplace were clarified.
The migration guidance now explicitly instructs administrators to select Microsoft 365 as the price plan, save the change, and then update site details to match the license. Wording, metadata, and related-content labeling were also updated.
The page replaces Microsoft Defender XDR with Microsoft Defender in its descriptions, licensing notes, role guidance, and workload activation instructions. The page date was also updated.
