Tuesday, 6 October 2026

The virus initiative criteria page updates its VB100 entry from Grade C or higher to Grade B or higher for a 95% detection rate. Its platform identifier was also updated.

The Linux deployment article now explains how to embed the tenant-specific onboarding file in a golden image, keep `mdatp` stopped during image creation, and start Defender on clones only after their final hostname is set. It also adds onboarding and health verification steps.

Users can report scheduled or Meet now Microsoft Teams meetings, or individual meeting participants, as security concerns during or after the meeting.

The documentation now covers reporting Teams meetings and meeting participants, including related metadata, the meeting reporting policy, and updated government-cloud limitations.

The guide now covers reported Teams meetings and meeting participants, including alert generation and Defender portal review locations. It also corrects alert wording and terminology.

The article now covers malicious activity in Teams messages, calls, and meetings, and lists messages, calls, meetings, and meeting participants as reportable items. It also links to Teams user reporting settings.

The guide now directs administrators to configure the Allow users to report meetings policy in the Teams admin center. The Defender portal step to verify Monitor reported items in Microsoft Teams remains.

The documentation now states that automatic sensor activation and automatic Windows auditing require an active license that includes Microsoft Defender for Identity. The domain-controller onboarding heading no longer labels the process as preview.

The page date was updated, and the “Offboard a domain controller without Defender for Endpoint deployment” heading no longer includes “(Preview).”

The documentation adds sensor v3.x activation without Defender for Endpoint for eligible Windows Server 2019 or later domain controllers. It applies only to new sensor v3.x deployments, and automatic activation and Windows auditing require an active license that includes Microsoft Defender for Identity.

Automatic sensor activation and automatic Windows auditing now require an active license that includes Microsoft Defender for Identity.

Starting October 5, 2026, KSPM misconfiguration recommendations will align with Kubernetes workload controllers instead of individual running container instances.

The schema reference now lists the Email Event schema as `EmailEvent`, version 1.0.0, with GA status.

The normalization page now links to the Email Event schema and has an updated documentation date.

The page now states that re-ingestion costs follow standard log ingestion pricing for paid tables, with final costs affected by tenant discounts or commitment tiers.

Microsoft added reference documentation for the ASIM Email Event schema, including email routing, authentication, delivery outcomes, and threat fields. It also documents the `_Im_EmailEvent` parser, custom parser naming, and filtering parameters.

The instructions now direct administrators to Agentic code scanning management, select Add another under Source code environment, and choose Azure DevOps. Connector naming remains optional.

The page received updated internal links, title capitalization, wording, punctuation, and terminology. A navigation section was removed, while the role-assignment instructions remain focused on the Microsoft 365 and Entra admin centers.

The page title and description were updated, wording and link formatting were refined, and the Related resources section was removed.

The guide has revised wording and capitalization, linked portal references, punctuation, and formatting for the Intune enrollment option.

The page title and headings were capitalized consistently, and periods were added to two troubleshooting list items and their linked reference.

The page updates its title, description, terminology, links, and setup instructions for using the Streaming API with Defender for Business and Microsoft 365 Business Premium.