Custom Detection Manage
Doc updateThe Edit description no longer mentions flexible frequency and lookback being in public preview or links to related guidance. Author and date metadata also changed.
Day in brief
Custom detections spell out 5-minute-to-14-day scheduling and lookback boundaries
The period focuses on guidance changes that sharpen administrator decisions. Custom-detection pages spell out the 5-minute-to-14-day custom-frequency range, the Sentinel-only data-source boundary, fixed 4-hour-to-30-day lookbacks for Defender XDR data, and Sentinel lookback limits that remain in public preview. Other meaningful updates clarify Unified RBAC coverage for identity exclusions, restrict two Cloud Apps admin roles in new configurations, and record four GA Defender for Cloud sensor builds with security and dependency fixes.
- Custom frequency is restricted to Sentinel-only detections
Defender XDR · Hunting and detectionUpdated Custom Detection Rules guidance says custom frequency from 5 minutes to 14 days is available only for rules based exclusively on Microsoft Sentinel data. Rules using Defender XDR data instead use fixed lookback periods tied to run frequency, ranging from 4 hours to 30 days, and cannot use custom scoping with this frequency option.
- Sentinel guidance sets preview lookback ceilings by frequency
Sentinel · Cloud and workloadsThe comparison guidance lists flexible and high-frequency support for Sentinel data: lookback is up to 48 hours when frequency exceeds one hour and up to 14 days when frequency is one hour or less. Lookback remains labeled public preview.
- Identity-exclusion guidance covers both response products
Defender XDR · GeneralThe updated guidance explains that identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. Its Unified RBAC permissions coverage now addresses both products’ data sources, role assignments, and data-source scope.
- Cloud Apps admin roles are unavailable for new configurations
Cloud Apps · Cloud and workloadsApp/instance admin and User group admin role assignments can no longer be used in new configurations. Existing configurations remain supported, and organizations needing these capabilities are directed to Microsoft Support.
- Defender for Cloud records four September GA sensor builds
Defender for Cloud · Identity protectionThe sensor changelog now lists versions 0.11.7, 0.10.10, 0.9.68, and 0.8.61 as September 2026 GA releases, each containing security vulnerability fixes and dependency updates.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
12 updates
Microsoft Defender XDR
5 updatesCustom Detection Rules
Feature updateCustom frequency from 5 minutes to 14 days is available only for rules based exclusively on Microsoft Sentinel data. Rules using Defender XDR data now use fixed lookback periods based on their run frequency, ranging from 4 hours to 30 days.
Custom Detection Rules
Public previewThe documentation now describes independently configuring detection frequency from 5 minutes to 14 days and lookback from 5 minutes to 30 days across supported data sources. Lookback must be at least as long as the frequency to avoid coverage gaps.
Custom Detection Manage
Public previewThe Edit option description now notes flexible frequency and lookback for all supported data sources and links to further guidance.
Automatic Attack Disruption Exclusions
Doc updateThe documentation now explains that identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. It clarifies Unified RBAC permissions for both products’ data sources and adds guidance on role assignments and data-source scope.
Microsoft Defender for Endpoint
1 update
Whats New In Microsoft Defender Endpoint
Doc updateThe Defender Endpoint What's New entry now links to the preview-specific Microsoft Store applications section.
Manage Admins
RetirementApp/instance admin and User group admin role assignments can no longer be used in new configurations. Existing configurations remain supported.
Microsoft Defender for Cloud
2 updatesRegional Availability
Feature updateThe regional availability documentation now lists ap-southeast-7 among the supported regions.
Defender Sensor Change Log
Doc updateThe changelog now lists sensor versions 0.11.7, 0.10.10, 0.9.68, and 0.8.61 as GA releases from September 2026, each containing security vulnerability fixes and dependency updates.
Microsoft Sentinel
2 updatesCompare Analytics Rules Custom Detections
Feature updateThe documentation now lists flexible and high-frequency support for Sentinel data. It specifies lookback limits of up to 48 hours for frequencies over one hour and up to 14 days for frequencies of one hour or less; lookback remains in public preview.
Compare Analytics Rules Custom Detections
Public previewThe comparison table now identifies flexible rule frequency and configurable lookback for custom detection rules, with links to detailed guidance. Page metadata was also updated.
Tvm Software Inventory
Doc updateThe documentation date was updated, “Dell Command” was changed to “Dell Command | Update,” and the listed software examples were revised to add 1Password, Beyond Compare, and Evernote while removing two entries.