Daily Defender News5 changes were tracked across 1 Microsoft Defender products. The leading updates include Microsoft Defender for Endpoint: Support for Amazon Linux 2 (ARM64) retiring October 31, 2026; Case Management in Microsoft Defender; Microsoft Defender for Cloud Apps: Retirement of EWS detections in App Governance.
Support for Microsoft Defender for Endpoint on Amazon Linux 2 (ARM64) will retire on October 31, 2026. After this date, no updates or support will be provided. Organizations must identify affected devices, prevent upgrades beyond version 101.25122.0004, and migrate to a supported Linux distribution before the deadline.
Microsoft Defender for Endpoint on Linux now requires allowlisting new service URLs specific to tenant types for delivering internal configuration updates, feature rollouts, and critical issue mitigations. This update is available worldwide, with no change to user experience, and ensures devices receive the latest features and optimizations.
Microsoft Defender introduces native Case Management to unify threat investigations, assign analysts, track SLAs, and capture notes in one workspace. Launching in public preview September 2026, it integrates with existing workflows and permissions, enhancing security team coordination and response efficiency without requiring manual migration.
Exchange Web Services (EWS) in Exchange Online will be retired starting October 1, 2026, with related Microsoft Defender for Cloud Apps app governance detections ending October 15, 2026. Organizations not using EWS need no action; those continuing EWS use will lose related alerts and should migrate away from EWS.
Microsoft Defender for Office 365 added an ApproverUpn column to the EmailPostDeliveryEvents table in Advanced Hunting, showing who approved remediation actions. This enables faster investigations without using Action Center. The feature is available worldwide, enabled by default, and requires no action from administrators.
