Daily Defender NewsThe period’s most consequential change moves Microsoft Defender for Endpoint automated investigation and response from a manually triggered, standalone experience into always-on antivirus protection. Defender for Cloud Apps also has a firm App Governance role-support retirement deadline, while Defender XDR is staging two unified identity capabilities. One Attack Surface Reduction Rules example received a precise identifier correction.
Defender XDR · Endpoint protectionMicrosoft Defender for Endpoint will remove manual triggering and the standalone automated investigation and response experience by early September 2026. AIR functions will be integrated into always-on antivirus protection. Organizations using AIR in playbooks or scripts must update them before September 1, 2026.
Defender XDR · GeneralSupport for the Cloud Application Administrator role in Microsoft Defender for Cloud Apps App Governance will retire on September 26, 2026. When URBAC is enabled, affected administrators should be reassigned to supported roles such as Security Administrator, with role assignments reviewed by September 25.
Defender XDR · Identity protectionA unified workflow will let security teams manage identity response actions such as disabling accounts or forcing password changes across linked accounts. The capability supports multiple identity systems and SaaS applications, with worldwide rollout beginning in mid-October 2026.
Defender XDR · Identity protectionThe Identity page’s Timeline tab will provide a chronological view of identity activities and alerts from multiple Microsoft security sources, with improved context, filtering, and automatic updates. Rollout is scheduled from mid-September through mid-October 2026, with no policy changes or enablement action required.
Endpoint · Vulnerabilities and exposureThe Attack Surface Reduction Rules command example changes one rule ID from an identifier ending in `...e5` to one ending in `...e5b`. Administrators copying the example should use the updated identifier.
Prioritize AIR playbook and script remediation before September 1, 2026. Review Cloud Application Administrator assignments by September 25 and reassign affected administrators to supported roles such as Security Administrator where URBAC is enabled. The Identity Timeline rollout requires no enablement action; the unified response-actions notice specifies a rollout beginning in mid-October but no required administrator step. Use the corrected ASR rule identifier when copying the command example.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Microsoft Defender XDR is enhancing the Identity page's Timeline tab to provide a unified, chronological view of identity-related activities and alerts from multiple Microsoft security sources. Rolling out mid-September to mid-October 2026, it offers improved context, filtering, and automatic updates without changing existing policies. No action is required to enable it.
Microsoft Defender XDR unifies identity response actions across linked accounts, enabling security teams to manage actions like disabling accounts or forcing password changes from one workflow. It supports multiple identity systems and SaaS apps, enhancing response speed and consistency. Rollout begins mid-October 2026 worldwide.
Microsoft Defender for Endpoint will remove manual triggering and the standalone experience of automated investigation and response (AIR) by early September 2026. AIR functions are integrated into always-on antivirus protection. Organizations using AIR in playbooks or scripts must update them before September 1, 2026.
Support for the Cloud Application Administrator role in Microsoft Defender for Cloud Apps' App Governance will retire on September 26, 2026. Organizations must reassign affected administrators to supported roles like Security Administrator to maintain access when URBAC is enabled. Review role assignments by September 25, 2026.
The command example changes one Attack Surface Reduction rule ID from ending in `...e5` to `...e5b`.
