Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.
Day in brief
Defender for Office 365 rolls out promotional-mail tagging and automatic folder moves
Defender for Office 365 will label promotional emails as “promotions” and can move them automatically to a Promotions folder, learning from user actions. Separately, the Office 365 permissions documentation removes the “related to Copilot” qualifier from descriptions of Data Security AI Admin DLP permissions while retaining the exclusion for prompt and response access.
- Promotional emails gain “promotions” labels and automatic folder handling
Defender XDR · Email and collaborationMicrosoft says Defender for Office 365 will tag promotional emails as “promotions” and can automatically move them to a Promotions folder. The capability learns from user actions, and users can customize handling by moving messages. Public preview starts in mid-April 2026, with general rollout completing by late 2026.
- Data Security AI Admin descriptions remove the Copilot qualifier
Office 365 · Email and collaborationThe Scc Permissions page now describes Data Security AI Admins and the Data Security AI Admin role as able to edit Data Loss Prevention policies without the previous “related to Copilot” qualifier. It continues to document access to view AI content, while prompt and response access remains excluded.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
3 updates
Microsoft Defender XDR
2 updatesMicrosoft Defender for Office 365 will tag promotional emails as “promotions” and can auto-move them to a Promotions folder, learning from user actions. Public preview starts mid-April 2026; general rollout completes by late 2026. Admins control settings; users can customize via message moves.
Scc Permissions
Doc updateThe documentation now describes Data Security AI Admins and the Data Security AI Admin role as editing Data Loss Prevention policies without the previous “related to Copilot” qualifier. Access to view AI content remains documented, while prompt and response access remains excluded.