Microsoft Defender for Office 365 will introduce prompt injection protection for email, detecting and quarantining malicious content targeting AI assistants. Rolling out from July to October 2026, it affects organizations with Defender Plan 2 or Microsoft 365 E5, enabling automatic high-confidence threat quarantine by default with no required action.
Day in brief
Defender for Office 365 will quarantine AI-targeting prompt injections by default
Microsoft Defender for Office 365 is preparing prompt injection protection for email, with rollout scheduled from July through October 2026 for organizations with Defender Plan 2 or Microsoft 365 E5. The remaining updates are targeted guidance and documentation corrections: Defender XDR now specifies required device identifiers for Sentinel-mapped activity, Defender for Identity documents custom service-account classification, and Endpoint troubleshooting corrects a registry-path typo.
- Prompt injection protection planned for email
Defender XDR · Email and collaborationMicrosoft Defender for Office 365 will detect and quarantine malicious email content targeting AI assistants. For organizations with Defender Plan 2 or Microsoft 365 E5, automatic high-confidence threat quarantine is enabled by default during the July–October 2026 rollout, with no required administrator action.
- Device Timeline mappings require specific identifiers
Defender XDR · GeneralThe Entity Page guidance now specifies that custom activity data mapped from Sentinel to Microsoft Defender XDR must include either HostName plus NTDomain or HostName plus DnsDomain for correct Device Timeline visibility.
- Custom rules can identify missed service accounts
Identity · Identity protectionDefender for Identity guidance explains that custom classification rules can identify service accounts not detected automatically, including accounts using an `srv` prefix.
- Endpoint troubleshooting path corrected
Endpoint · TroubleshootingThe troubleshooting guidance corrects the `ProductAppDataPath` registry value from `Microsft` to `Microsoft` in the Windows Defender data path, giving administrators the accurate registry path to use when following the procedure.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
4 updates
Microsoft Defender XDR
2 updatesEntity Page Device
Doc updateAction requiredThe documentation now specifies that custom activity data mapped from Sentinel to Microsoft Defender XDR must include either HostName plus NTDomain or HostName plus DnsDomain.
Microsoft Defender for Endpoint
1 updateTroubleshoot Service Startup Problems
Doc updateThe troubleshooting page corrects the `ProductAppDataPath` registry value from `Microsft` to `Microsoft` in the Windows Defender data path.
Microsoft Defender for Identity
1 updateService Account Discovery
Doc updateThe documentation explains that custom classification rules can identify service accounts Defender for Identity does not detect automatically, such as accounts using an `srv` prefix.