Microsoft Defender XDR is enhancing the Identity page's Timeline tab to provide a unified, chronological view of identity-related activities and alerts from multiple Microsoft security sources. Rolling out mid-September to mid-October 2026, it offers improved context, filtering, and automatic updates without changing existing policies. No action is required to enable it.
Day in brief
Defender XDR adds unified identity actions and a consolidated timeline this fall
Two Defender XDR identity-protection announcements set out a fall 2026 rollout: centralized response actions across linked identities, followed by a richer Identity-page timeline that combines activity and alerts from Microsoft security sources.
- Unified response actions across identity accounts
Defender XDR · Identity protectionDefender XDR will let security teams manage actions such as disabling accounts and forcing password changes across linked accounts from one workflow. The capability supports multiple identity systems and SaaS apps, with worldwide rollout beginning in mid-October 2026.
- Identity page receives a unified TimelineDefender XDR · Identity protection
The Identity page’s Timeline tab will show a chronological view of identity-related activities and alerts from multiple Microsoft security sources, with improved context, filtering, and automatic updates. Rollout is planned from mid-September through mid-October 2026; no action is required to enable it, and existing policies are unchanged.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
2 updates
Microsoft Defender XDR
2 updatesMicrosoft Defender XDR unifies identity response actions across linked accounts, enabling security teams to manage actions like disabling accounts or forcing password changes from one workflow. It supports multiple identity systems and SaaS apps, enhancing response speed and consistency. Rollout begins mid-October 2026 worldwide.