Daily Defender NewsStarting October 15, 2026, the Defender for Cloud Apps integration with Identity inventory will move from opt-in to automatic enablement for eligible tenants without listed excluded configurations. Defender for Storage adds targeted on-demand scanning, while Defender for Cloud guidance adds integration prerequisites and Linux requirements. Microsoft also documents the Defender XDR Hunts experience for Defender Experts customers and clarifies Identity sensor v3 activation eligibility and operating mode.
Cloud Apps · Cloud and workloadsThe Defender for Cloud Apps release notes set October 15, 2026, as the date when Identity inventory integration will automatically enable for eligible tenants that do not use the listed excluded configurations.
Defender for Cloud · Cloud and workloadsOn-demand malware scanning can target individual blobs or files, containers or file shares, or objects matching a path prefix. REST API filters define the scope; without filters, the entire storage account is scanned.
Defender for Cloud · Cloud and workloadsThe Enable Defender For Endpoint guidance now states that the integration can use an existing Defender for Endpoint sensor from the same tenant. It also adds platform and Linux requirements plus checks for connectivity, proxy authentication, file-system settings, and security policies; Linux servers require Python 3.
Defender XDR · Hunting and detectionThe new Hunts overview describes how to view in-progress and completed expert-led hunts, including hunt types, statuses, outcomes, and supporting details in the Defender portal. The organization must be enrolled in Defender Experts Hunting, Plan 1, or Plan 2, and the user needs at least the Security Reader role in Microsoft Defender RBAC.
Identity · Identity protectionThe Activate Sensor guidance specifies support for new sensor v3.x deployments on eligible domain controllers without sensor v2.x. It also states that the standalone package activates sensor v3.x on Windows Sense in restricted identity-only mode.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The Hunts overview documents an experience for viewing in-progress and completed expert-led hunts, including hunt types, statuses, outcomes, and supporting details in the Defender portal.
The page now specifies that the method supports new sensor v3.x deployments on eligible domain controllers without sensor v2.x, and that the standalone package activates sensor v3.x on Windows Sense in restricted identity-only mode.
Starting October 15, 2026, the Defender for Cloud Apps integration with Identity inventory will move from opt-in to automatic enablement for eligible tenants that do not use the listed excluded configurations.
The documentation now states that the integration can use an existing Defender for Endpoint sensor from the same tenant, adds updated platform and Linux requirements, and lists pre-deployment checks for connectivity, proxy authentication, file-system settings, and security policies.
The documentation heading for filtering malware scans to specific items no longer includes “(Preview).”
Microsoft Defender for Storage on-demand malware scanning can now target individual blobs or files, containers or file shares, or objects matching a path prefix. REST API filters define the scope; without filters, the entire storage account is scanned.
