Microsoft Defender XDR

Whats New

14 October 2026Doc update+2 / −2 lines

In brief

The What's new entries for the preview AgentsInfo and AIAgentsInfo advanced hunting tables now show table names as inline code instead of linked text.

What Defender admins need to know

Administrators reviewing these entries will need to use the surrounding documentation navigation rather than the removed inline links.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

- The [`CloudAuditEvents`](advanced-hunting-cloudauditevents-table) table contains information about cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud.
- The [`CloudDnsEvents`](advanced-hunting-clouddnsevents-table) table contains information about DNS activity events from cloud infrastructure environments.
- The [`CloudProcessEvents`](advanced-hunting-cloudprocessevents-table) table contains information about process events in multicloud hosted environments.

(Preview) The AgentsInfo table in advanced hunting is now available in preview. The ~~AIAgentsInfo~~AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use the AgentsInfo table today. The AIAgentsInfo table remains accessible until July 1, 2026. Update your queries to use AgentsInfo before this date. For more information, see Advanced hunting schema - Naming changes.

May 2026

April 2026

(Preview) You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. Learn more
(Preview) The ~~AIAgentsInfo~~AIAgentsInfo table in advanced hunting now includes additional columns that provide deeper visibility into AI agents operating in your Microsoft 365 environment. These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace, and custom line-of-business agents.
(GA) Built-in alert tuning rules are now generally available. Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.
Microsoft Defender Experts MDR customers can now see Defender Experts as a distinct entry in the Microsoft Defender portal navigation menu. This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access to the service. Learn more.

@@ -82,7 +82,7 @@ You can also get product updates and important notifications through the [messag     - The [`CloudAuditEvents`](advanced-hunting-cloudauditevents-table) table contains information about cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud.
     - The [`CloudDnsEvents`](advanced-hunting-clouddnsevents-table) table contains information about DNS activity events from cloud infrastructure environments.
     - The [`CloudProcessEvents`](advanced-hunting-cloudprocessevents-table) table contains information about process events in multicloud hosted environments.
-- (Preview) The [`AgentsInfo`](advanced-hunting-agentsinfo-table) table in advanced hunting is now available in preview. The [`AIAgentsInfo`](advanced-hunting-aiagentsinfo-table) table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use the `AgentsInfo` table today. The `AIAgentsInfo` table remains accessible until July 1, 2026. Update your queries to use `AgentsInfo` before this date. For more information, see [Advanced hunting schema - Naming changes](advanced-hunting-schema-changes).
+- (Preview) The [`AgentsInfo`](advanced-hunting-agentsinfo-table) table in advanced hunting is now available in preview. The `AIAgentsInfo` table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use the `AgentsInfo` table today. The `AIAgentsInfo` table remains accessible until July 1, 2026. Update your queries to use `AgentsInfo` before this date. For more information, see [Advanced hunting schema - Naming changes](advanced-hunting-schema-changes).
 
 ## May 2026
 
@@ -95,7 +95,7 @@ You can also get product updates and important notifications through the [messag ## April 2026
 
 - (Preview) You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the **Activities** tab of the incident page. [Learn more](autoad-results#track-the-action-status-in-the-activities-tab-preview)
-- (Preview) The [`AIAgentsInfo`](advanced-hunting-aiagentsinfo-table) table in advanced hunting now includes additional columns that provide deeper visibility into AI agents operating in your Microsoft 365 environment. These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace, and custom line-of-business agents.
+- (Preview) The `AIAgentsInfo` table in advanced hunting now includes additional columns that provide deeper visibility into AI agents operating in your Microsoft 365 environment. These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace, and custom line-of-business agents.
 - (GA) [Built-in alert tuning rules](investigate-alerts#built-in-alert-tuning-rules) are now generally available. Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.
 - Microsoft Defender Experts MDR customers can now see **Defender Experts** as a distinct entry in the Microsoft Defender portal navigation menu. This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access to the service. [Learn more](defender-experts/defender-experts-mdr-start-using).