Microsoft Defender for Office 365 is adding two new Advanced Hunting tables, SubmissionEvents and SubmissionResults, to enhance email submission visibility and detection workflows. Public Preview starts early October 2026; General Availability begins late October 2026. No immediate action or compliance concerns are required.
Day in brief
AI agent support matrix clarifies Defender for Endpoint’s activity-based discovery
The period’s most consequential administrator guidance concerns local AI agents in Microsoft Defender for Endpoint. A new support matrix covers supported agents, MCP server discovery, and runtime protection by operating system and configuration, while related pages clarify that discovery depends on observed activity. Sentinel also added specific custom-parser guidance. Most remaining updates—32 in Microsoft Security Exposure Management—were page-attribution maintenance.
- New matrix separates AI agent support by operating system and configuration
Endpoint · Endpoint protectionA new Microsoft Defender for Endpoint article documents supported local AI agents, MCP server discovery, and runtime protection scenarios, with support listed separately by operating system and configuration. It also explains that discovery depends on observed agent activity.
- Installed agents may remain absent until Defender observes activityEndpoint · Endpoint protection
The local-agent guidance states that Defender lists an agent after observing activity on an onboarded device; installation alone does not guarantee discovery. It also says the inventory is not a complete software inventory, directing administrators to Software inventory for installed-software details and the support matrix for coverage.
- Runtime protection guidance broadens inspection-point terminologyEndpoint · Endpoint protection
The AI Agent Runtime Protection overview now uses broader descriptions of inspection points, streamlines its explanations of agent-native and network inspection, updates discovery terminology, and removes the explicit event-point list and vendor links.
- Sentinel parser guidance sets disabled=false and conditions pack forwarding
Sentinel · Cloud and workloadsNormalization guidance now explains that the generated table sets `disabled=false` to enable custom parsers and advises forwarding `pack` only when the source-specific parser supports it. Review custom unifying parser functions for these parameter expectations.
- Exposure Management updates largely change page attribution
Exposure Management · Developer and APIA broad Microsoft Security Exposure Management sweep changed author metadata across connector, attack-surface, and vulnerability/exposure pages. For example, the OT data connectors page now credits DebLanger instead of limwainstein/lwainstein. These edits indicate no administrator action.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
44 updates
Microsoft Defender XDR
1 updateMicrosoft Defender for Endpoint
4 updatesA new Learn article documents supported local AI agents, MCP server discovery, and runtime protection scenarios, with support listed separately by operating system and configuration. It also explains that discovery depends on observed agent activity.
Ai Agent Runtime Protection Overview
Doc updateThe article now uses broader descriptions of inspection points, streamlines explanations of agent-native and network inspection, updates discovery terminology, and removes the explicit event-point list and vendor links.
Local Agent Discovery Overview
Feature updateThe documentation now states that Defender lists a local AI agent after observing activity on an onboarded device; installation alone does not guarantee discovery. It also clarifies that the inventory is not a complete software inventory and references the support matrix for coverage details.
Discover local AI agents with Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
Feature updateThe documentation states that Defender surfaces supported AI agents and MCP servers after observing activity on onboarded devices. An installed agent may not appear until it becomes active; the guidance also adds comparing query results with the discovery support matrix.
Migrate File Policies To Purview
Doc updateTwo authoring metadata link entries were updated, but their URLs remain unchanged.
Microsoft Defender for Cloud
4 updatesKubernetes Misconfiguration Enforcement
Doc updateThe Kubernetes misconfiguration enforcement page now lists ElazarK and elkrieger instead of dlanger as its author metadata.
Simulate Alerts Sql Machines
Doc updateThe document’s author and ms.author metadata changed from TimShererWithAquent and v-tishe to ElazarK and elkrieger.
Transition Disable Rules Exemptions
Doc updateThe document author changed from dlanger to ElazarK, and the ms.author value changed from dlanger to elkrieger.
Workflow Automations
Doc updateThe page author changed from TimShererWithAquent to ElazarK, and the ms.author value changed from v-tishe to elkrieger.
Microsoft Sentinel
1 updateNormalization Manage Parsers
Doc updateThe documentation now explains that the generated table sets `disabled=false` to enable custom parsers and advises forwarding `pack` only when the source-specific parser supports it.
Microsoft Security Exposure Management
32 updates
The page author changed from limwainstein to DebLanger, and the ms.author value changed from lwainstein to dlanger.
Defender Code Security skills overview - Microsoft Security Exposure Management | Microsoft Learn
Doc updateThe page author changed from “dlanger” to “DebLanger.”
The page author changed from “dlanger” to “DebLanger.”
The document’s author metadata changed from “dlanger” to “DebLanger.”
The page author changed from “dlanger” to “DebLanger.”
The page author changed from “dlanger” to “DebLanger.”
The page author metadata changed from “dlanger” to “DebLanger.”
The vulnerability management integration page author changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The document author changed from “dlanger” to “DebLanger.”
The data connectors overview now lists DebLanger instead of dlanger as the author.
The page author changed from “dlanger” to “DebLanger.”
The prerequisites page author attribution changed from “dlanger” to “DebLanger.”
The page author was changed from “dlanger” to “DebLanger.”
The author metadata changed from “dlanger” to “DebLanger” on the Initiatives page.
The page author changed from dlanger to DebLanger.
The page author changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The initiatives list documentation now credits DebLanger instead of dlanger as the author.
The document’s author name changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The Exposure Management What's New page now lists the author as DebLanger instead of dlanger.
The page author changed from “dlanger” to “DebLanger.”
The page author metadata changed from limwainstein to DebLanger.
The page’s author metadata changed from limwainstein/lwainstein to DebLanger/dlanger.
The page author changed from limwainstein to DebLanger, and the Microsoft author alias changed from lwainstein to dlanger.
The document author changed from “dlanger” to “DebLanger.”
The Enterprise Exposure Graph documentation now lists DebLanger instead of dlanger as the author.
The documentation page author changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The document author changed from dlanger to DebLanger.
The document author changed from dlanger to DebLanger.
The page author metadata changed from guywi-ms/guywild to poliveria/pauloliveria.