← Previous day

Next day →
Day in brief

Retirement notice: MDE and XDR Advanced Hunting APIs retiring; migrate to Microsoft Graph Security API leads 571 Defender updates

28 January 2026 recorded 3 new, 556 updated, 9 removed Microsoft Defender documentation changes and 3 relevant Message Center announcements. The most active areas were Endpoint, Defender XDR, Identity.

This period briefing was assembled from the tracked Microsoft Learn and Message Center changes.

571 updates

28

Investigate Alerts

Updated

Updated Microsoft Defender documentation in defender-xdr/investigate-alerts.md.

Investigate Alerts

Updated

Updated Microsoft Defender documentation in defender-xdr/investigate-alerts.md.

Investigate Alerts

Updated

Updated Microsoft Defender documentation in defender-xdr/investigate-alerts.md.

Manage Rbac

Updated

Updated Microsoft Defender documentation in defender-xdr/manage-rbac.md.

Manage Rbac

Updated

Updated Microsoft Defender documentation in defender-xdr/manage-rbac.md.

Use custom functions

Updated

Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-custom-functions.md.

Compare Rbac Roles

Updated

Updated Microsoft Defender documentation in defender-xdr/compare-rbac-roles.md.

Investigate Alerts

Updated

Updated Microsoft Defender documentation in defender-xdr/investigate-alerts.md.

Investigate Alerts

Updated

Updated Microsoft Defender documentation in defender-xdr/investigate-alerts.md.

Investigate Alerts

Updated

Updated Microsoft Defender documentation in defender-xdr/investigate-alerts.md.

Compare Rbac Roles

Updated

Updated Microsoft Defender documentation in defender-xdr/compare-rbac-roles.md.

Edit Delete Rbac Roles

Updated

Updated Microsoft Defender documentation in defender-xdr/edit-delete-rbac-roles.md.

Experts On Demand

Updated

Updated Microsoft Defender documentation in defender-xdr/experts-on-demand.md.

Faq Managed Response

Updated

Updated Microsoft Defender documentation in defender-xdr/faq-managed-response.md.

Manage Rbac

Updated

Updated Microsoft Defender documentation in defender-xdr/manage-rbac.md.

Phishing Triage Agent

Updated

Updated Microsoft Defender documentation in defender-xdr/phishing-triage-agent.md.

Manage Rbac

Updated

Updated Microsoft Defender documentation in defender-xdr/manage-rbac.md.

6

Alert Policies

Updated

Updated Microsoft Defender documentation in defender-xdr/alert-policies.md.

3
1
1
293

Get all vulnerabilities

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-all-vulnerabilities.md.

Get vulnerability by ID

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-vulnerability-by-id.md.

Android New Ux

Updated

Updated Microsoft Defender documentation in defender-endpoint/android-new-ux.md.

Data Storage Privacy

Updated

Updated Microsoft Defender documentation in defender-endpoint/data-storage-privacy.md.

Mac Whatsnew

Updated

Updated Microsoft Defender documentation in defender-endpoint/mac-whatsnew.md.

Android Configure Mam

Updated

Updated Microsoft Defender documentation in defender-endpoint/android-configure-mam.md.

Linux Install Manually

Updated

Updated Microsoft Defender documentation in defender-endpoint/linux-install-manually.md.

Linux Whatsnew

Updated

Updated Microsoft Defender documentation in defender-endpoint/linux-whatsnew.md.

Edr Detection

Updated

Updated Microsoft Defender documentation in defender-endpoint/edr-detection.md.

Mde Sec Ops Guide

Updated

Updated Microsoft Defender documentation in defender-endpoint/mde-sec-ops-guide.md.

Access Mssp Portal

Updated

Updated Microsoft Defender documentation in defender-endpoint/access-mssp-portal.md.

Admin Submissions Mde

Updated

Updated Microsoft Defender documentation in defender-endpoint/admin-submissions-mde.md.

Analyzer Feedback

Updated

Updated Microsoft Defender documentation in defender-endpoint/analyzer-feedback.md.

Analyzer Report

Updated

Updated Microsoft Defender documentation in defender-endpoint/analyzer-report.md.

Apis Intro

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/apis-intro.md.

Automated Investigations

Updated

Updated Microsoft Defender documentation in defender-endpoint/automated-investigations.md.

Batch Update Alerts

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/batch-update-alerts.md.

Cancel Machine Action

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/cancel-machine-action.md.

Client Analyzer

Updated

Updated Microsoft Defender documentation in defender-endpoint/overview-client-analyzer.md.

Collect Diagnostic Data

Updated

Updated Microsoft Defender documentation in defender-endpoint/collect-diagnostic-data.md.

Configure Mssp Support

Updated

Updated Microsoft Defender documentation in defender-endpoint/configure-mssp-support.md.

Configure Siem

Updated

Updated Microsoft Defender documentation in defender-endpoint/configure-siem.md.

Controlled Folders

Updated

Updated Microsoft Defender documentation in defender-endpoint/controlled-folders.md.

Data Collection Analyzer

Updated

Updated Microsoft Defender documentation in defender-endpoint/data-collection-analyzer.md.

Defender Compatibility

Updated

Updated Microsoft Defender documentation in defender-endpoint/defender-compatibility.md.

Delete Library

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/delete-library.md.

Device Health Reports

Updated

Updated Microsoft Defender documentation in defender-endpoint/device-health-reports.md.

Evaluate Mdav Using Gp

Updated

Updated Microsoft Defender documentation in defender-endpoint/evaluate-mdav-using-gp.md.

Exposed Apis List

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/exposed-apis-list.md.

Feedback-loop blocking

Updated

Updated Microsoft Defender documentation in defender-endpoint/feedback-loop-blocking.md.

File resource type

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/files.md.

Get Agent Details

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/Get-agent-details.md.

Get all scan agents

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-all-scan-agents.md.

Get installed software

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-installed-software.md.

Get Live Response Result

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-live-response-result.md.

Get scan definitions

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-all-scan-definitions.md.

Get software by ID

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-software-by-id.md.

Gov

Updated

Updated Microsoft Defender documentation in defender-endpoint/gov.md.

Internet Facing Devices

Updated

Updated Microsoft Defender documentation in defender-endpoint/internet-facing-devices.md.

Investigate Incidents

Updated

Updated Microsoft Defender documentation in defender-endpoint/investigate-incidents.md.

List all recommendations

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-all-recommendations.md.

List devices by software

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-machines-by-software.md.

List Library Files

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/list-library-files.md.

List software

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-software.md.

Machine resource type

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/machine.md.

Manage Gradual Rollout

Updated

Updated Microsoft Defender documentation in defender-endpoint/manage-gradual-rollout.md.

Manage Incidents

Updated

Updated Microsoft Defender documentation in defender-endpoint/manage-incidents.md.

Manage Suppression Rules

Updated

Updated Microsoft Defender documentation in defender-endpoint/manage-suppression-rules.md.

Management Apis

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/management-apis.md.

Mdav Scan Best Practices

Updated

Updated Microsoft Defender documentation in defender-endpoint/mdav-scan-best-practices.md.

Mde Side By Side

Updated

Updated Microsoft Defender documentation in defender-endpoint/mde-side-by-side.md.

Mtd

Updated

Updated Microsoft Defender documentation in defender-endpoint/mtd.md.

Network Devices

Updated

Updated Microsoft Defender documentation in defender-endpoint/network-devices.md.

Partner Applications

Updated

Updated Microsoft Defender documentation in defender-endpoint/partner-applications.md.

Partner Integration

Updated

Updated Microsoft Defender documentation in defender-endpoint/partner-integration.md.

Professional Services

Updated

Updated Microsoft Defender documentation in defender-endpoint/professional-services.md.

Run Analyzer Windows

Updated

Updated Microsoft Defender documentation in defender-endpoint/run-analyzer-windows.md.

Run Live Response

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/run-live-response.md.

Sandbox Mdav

Updated

Updated Microsoft Defender documentation in defender-endpoint/sandbox-mdav.md.

Schedule Antivirus Scans

Updated

Updated Microsoft Defender documentation in defender-endpoint/schedule-antivirus-scans.md.

Technological Partners

Updated

Updated Microsoft Defender documentation in defender-endpoint/technological-partners.md.

Upload Library

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/upload-library.md.

Use Client Analyzer

Updated

Updated Microsoft Defender documentation in defender-endpoint/use-client-analyzer.md.

Validate Antimalware

Updated

Updated Microsoft Defender documentation in defender-endpoint/validate-antimalware.md.

View Incidents Queue

Updated

Updated Microsoft Defender documentation in defender-endpoint/view-incidents-queue.md.

Web content filtering

Updated

Updated Microsoft Defender documentation in defender-endpoint/web-content-filtering.md.

Admin Submissions Mde

Updated

Updated Microsoft Defender documentation in defender-endpoint/admin-submissions-mde.md.

Admin Submissions Mde

Updated

Updated Microsoft Defender documentation in defender-endpoint/admin-submissions-mde.md.

Alerts Queue

Updated

Updated Microsoft Defender documentation in defender-endpoint/alerts-queue.md.

Device Control Overview

Updated

Updated Microsoft Defender documentation in defender-endpoint/device-control-overview.md.

Indicators Overview

Updated

Updated Microsoft Defender documentation in defender-endpoint/indicators-overview.md.

Web Protection Response

Updated

Updated Microsoft Defender documentation in defender-endpoint/web-protection-response.md.

Android Whatsnew

Updated

Updated Microsoft Defender documentation in defender-endpoint/android-whatsnew.md.

Android Whatsnew

Removed

Removed Microsoft Defender documentation in defender-endpoint/android-whatsnew.md.

Linux Whatsnew

Removed

Removed Microsoft Defender documentation in defender-endpoint/linux-whatsnew.md.

Mac Whatsnew

Removed

Removed Microsoft Defender documentation in defender-endpoint/mac-whatsnew.md.

Whats New Mde Archive

Removed

Removed Microsoft Defender documentation in defender-endpoint/whats-new-mde-archive.md.

Windows Whatsnew

Removed

Removed Microsoft Defender documentation in defender-endpoint/windows-whatsnew.md.

53

Api Explorer

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/api-explorer.md.

Api Hello World

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/api-hello-world.md.

Api Microsoft Flow

Updated

Updated Microsoft Defender documentation in defender-endpoint/api-microsoft-flow.md.

Api Power Bi

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/api-power-bi.md.

Api Release Notes

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/api-release-notes.md.

Delete Indicator API.

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/delete-ti-indicator-by-id.md.

Find devices by tag API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/find-machines-by-tag.md.

Get alerts API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/alerts.md.

Get file information API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-file-information.md.

Get file statistics API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-file-statistics.md.

Get IP statistics API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-ip-statistics.md.

Get machine by ID API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-machine-by-id.md.

Get package SAS URI API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-package-sas-uri.md.

Import Indicators API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/import-ti-indicators.md.

Isolate machine API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/isolate-machine.md.

List alerts API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-alerts.md.

List Indicators API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-ti-indicators-collection.md.

List Investigations API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-investigation-collection.md.

List machineActions API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-machineactions-collection.md.

List machines API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-machines.md.

Offboard machine API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/offboard-machine-api.md.

Run Advanced Query Api

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/run-advanced-query-api.md.

Run antivirus scan API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/run-av-scan.md.

Set device value API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/set-device-value.md.

Start Investigation API

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/initiate-autoir-investigation.md.

14

Event Error Codes

Updated

Updated Microsoft Defender documentation in defender-endpoint/event-error-codes.md.

Troubleshoot Mdatp

Updated

Updated Microsoft Defender documentation in defender-endpoint/troubleshoot-mdatp.md.

Troubleshoot Np

Updated

Updated Microsoft Defender documentation in defender-endpoint/troubleshoot-np.md.

Troubleshoot Siem

Updated

Updated Microsoft Defender documentation in defender-endpoint/troubleshoot-siem.md.

12
9

Get exposure score

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-exposure-score.md.

Get recommendation by Id

Updated

Updated Microsoft Defender documentation in defender-endpoint/api/get-recommendation-by-id.md.

5
3

Check Sensor Status

Updated

Updated Microsoft Defender documentation in defender-endpoint/check-sensor-status.md.

20

Mdo Gov

Updated

Updated Microsoft Defender documentation in defender-office-365/mdo-gov.md.

Quarantine About

Updated

Updated Microsoft Defender documentation in defender-office-365/quarantine-about.md.

Pim In Mdo Configure

Updated

Updated Microsoft Defender documentation in defender-office-365/pim-in-mdo-configure.md.

Pim In Mdo Configure

Updated

Updated Microsoft Defender documentation in defender-office-365/pim-in-mdo-configure.md.

Quarantine About

Updated

Updated Microsoft Defender documentation in defender-office-365/quarantine-about.md.

Scc Permissions

Updated

Updated Microsoft Defender documentation in defender-office-365/scc-permissions.md.

Scc Permissions

Updated

Updated Microsoft Defender documentation in defender-office-365/scc-permissions.md.

Mdo Portal Permissions

Updated

Updated Microsoft Defender documentation in defender-office-365/mdo-portal-permissions.md.

Mdo Portal Permissions

Updated

Updated Microsoft Defender documentation in defender-office-365/mdo-portal-permissions.md.

Mdo Sec Ops Guide

Updated

Updated Microsoft Defender documentation in defender-office-365/mdo-sec-ops-guide.md.

Mdo Sec Ops Guide

Updated

Updated Microsoft Defender documentation in defender-office-365/mdo-sec-ops-guide.md.

Office 365 Ti

Updated

Updated Microsoft Defender documentation in defender-office-365/office-365-ti.md.

Office 365 Ti

Updated

Updated Microsoft Defender documentation in defender-office-365/office-365-ti.md.

35

Accounts

Updated

Updated Microsoft Defender documentation in defender-for-identity/security-posture-assessments/accounts.md.

Accounts

Updated

Updated Microsoft Defender documentation in defender-for-identity/security-posture-assessments/accounts.md.

Accounts

Updated

Updated Microsoft Defender documentation in defender-for-identity/security-posture-assessments/accounts.md.

Whats New

Updated

Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.

Whats New

Updated

Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.

Identity Inventory

Updated

Updated Microsoft Defender documentation in defender-for-identity/identity-inventory.md.

Whats New

Updated

Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.

Whats New

Updated

Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.

Whats New

Updated

Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.

Activate Sensor

Updated

Updated Microsoft Defender documentation in defender-for-identity/deploy/activate-sensor.md.

Whats New

Updated

Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.

Identity Inventory

Updated

Updated Microsoft Defender documentation in defender-for-identity/identity-inventory.md.

Okta Integration

Updated

Updated Microsoft Defender documentation in defender-for-identity/okta-integration.md.

Okta Integration

Updated

Updated Microsoft Defender documentation in defender-for-identity/okta-integration.md.

Remediation Actions

Updated

Updated Microsoft Defender documentation in defender-for-identity/remediation-actions.md.

Remediation Actions

Updated

Updated Microsoft Defender documentation in defender-for-identity/remediation-actions.md.

Role Groups

Updated

Updated Microsoft Defender documentation in defender-for-identity/role-groups.md.

Role Groups

Updated

Updated Microsoft Defender documentation in defender-for-identity/role-groups.md.

Whats New

Updated

Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.

2

Deploy Defender Identity

Updated

Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-defender-identity.md.

Deploy Defender Identity

Updated

Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-defender-identity.md.

16

Discovery Docker Windows

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/discovery-docker-windows.md.

Get Started

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/get-started.md.

Release Notes

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/release-notes.md.

Release Notes

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/release-notes.md.

Get Started

Updated

Updated Microsoft Defender documentation in defender-for-cloud-apps/get-started.md.

4

Configure Permissions

Updated

Updated Microsoft Defender documentation in defender-for-iot/configure-permissions.md.

Configure Permissions

Updated

Updated Microsoft Defender documentation in defender-for-iot/configure-permissions.md.

Set Up Rbac

Updated

Updated Microsoft Defender documentation in defender-for-iot/set-up-rbac.md.

Set Up Rbac

Updated

Updated Microsoft Defender documentation in defender-for-iot/set-up-rbac.md.

9

Configure Data Connectors

Updated

Updated Microsoft Defender documentation in exposure-management/configure-data-connectors.md.

Whats New

Updated

Updated Microsoft Defender documentation in exposure-management/whats-new.md.

Prerequisites

Updated

Updated Microsoft Defender documentation in exposure-management/prerequisites.md.

Prerequisites

Updated

Updated Microsoft Defender documentation in exposure-management/prerequisites.md.

Whats New

Updated

Updated Microsoft Defender documentation in exposure-management/whats-new.md.

Whats New

Updated

Updated Microsoft Defender documentation in exposure-management/whats-new.md.

Configure Data Connectors

Updated

Updated Microsoft Defender documentation in exposure-management/configure-data-connectors.md.

Configure Data Connectors

Updated

Updated Microsoft Defender documentation in exposure-management/configure-data-connectors.md.

10

Preview customers

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-software-inventory.md.

Fixed Reported Inaccuracies

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/fixed-reported-inaccuracies.md.

Tvm Weaknesses

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-weaknesses.md.

Tvm Supported Os

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-supported-os.md.

Data Storage Privacy

Removed

Removed Microsoft Defender documentation in defender-vulnerability-management/data-storage-privacy.md.

Retention Logic Mdvm

Removed

Removed Microsoft Defender documentation in defender-vulnerability-management/retention-logic-mdvm.md.

3

Tvm Security Recommendation

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-security-recommendation.md.

Tvm Security Recommendation

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-security-recommendation.md.

2

Tvm Prerequisites

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-prerequisites.md.

Tvm Prerequisites

Updated

Updated Microsoft Defender documentation in defender-vulnerability-management/tvm-prerequisites.md.

32

Mdb Setup Configuration

Updated

Updated Microsoft Defender documentation in defender-business/mdb-setup-configuration.md.

Mdb Requirements

Updated

Updated Microsoft Defender documentation in defender-business/mdb-requirements.md.

Mdb Roles Permissions

Updated

Updated Microsoft Defender documentation in defender-business/mdb-roles-permissions.md.

Mdb Email Notifications

Updated

Updated Microsoft Defender documentation in defender-business/mdb-email-notifications.md.

Mdb Manage Devices

Updated

Updated Microsoft Defender documentation in defender-business/mdb-manage-devices.md.

Mdb View Tvm Dashboard

Updated

Updated Microsoft Defender documentation in defender-business/mdb-view-tvm-dashboard.md.

Mdb Offboard Devices

Updated

Updated Microsoft Defender documentation in defender-business/mdb-offboard-devices.md.

Mdb Tutorials

Updated

Updated Microsoft Defender documentation in defender-business/mdb-tutorials.md.

Mdb Get Started

Updated

Updated Microsoft Defender documentation in defender-business/mdb-get-started.md.

2
1

Mdb Onboard Devices

Updated

Updated Microsoft Defender documentation in defender-business/mdb-onboard-devices.md.

1
4

Playbook Managed Security

Updated

Updated Microsoft Defender documentation in unified-secops-platform/playbook-managed-security.md.

Playbook Managed Security

Updated

Updated Microsoft Defender documentation in unified-secops-platform/playbook-managed-security.md.

2