Daily Defender NewsThe period is dominated by documentation maintenance, but four updates carry useful operational detail. Defender XDR guidance now clearly describes default correlation, per-rule exclusions, and single-alert behavior for custom detections. Separate guidance covers July 2026 bulk-mail routing, Azure CSPM prerequisites for recommendation exemptions, and Defender for Containers provisioning failures.
Defender XDR · Hunting and detectionThe updated Defender XDR guidance states that custom detections are included in correlation by default and can be included or excluded on a per-rule basis. When a rule is excluded and no matching grouping rule applies, it produces a predictable single-alert incident. The page also states that no tenant-level custom-detection setting is available.
Office 365 · Email and collaborationThe Office 365 anti-spam guidance says that, as of July 2026, messages identified as bulk receive the Promotions tag. When Bulk moves enabled is turned on, messages move from Inbox to the Promotions folder only when they are promotional in nature, regardless of BCL value.
Defender for Cloud · Identity protectionDefender for Cloud guidance now explains that some identity and access recommendations can appear without the Azure CSPM standard assigned, but those recommendations do not support exemptions unless the standard is assigned. Administrators needing exemptions should assign the standard and follow the linked assignment procedure.
Defender for Cloud · TroubleshootingThe troubleshooting guidance now covers EKS provisioning failures caused by recreated IAM roles, endpoint allowlist reconciliation, and stale Azure Arc registrations. It adds diagnostic commands and resolution steps, including preserving required Defender provisioning network ranges in infrastructure automation.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now covers including or excluding custom detections from Microsoft Defender XDR correlation on a per-rule basis. Custom detections are included by default; exclusions create predictable single-alert incidents when no matching grouping rule applies.
The documentation now states that custom detections are included in correlation by default and have a per-rule option to include or exclude them.
The page now states that detection rules involved in creating a source incident are added to the target incident. It also explains that correlation settings control alerts from analytics rules or custom detections.
The page updates capitalization, expands MSSP to “Managed Security Service Provider,” refines wording, and adds metadata links. The tenant-specific portal URL and access instructions remain documented.
The page title was capitalized consistently, explanatory text was split for readability, and the two inspection approaches—Agent-native event inspection and Network inspection—are now named explicitly.
The article refreshes terminology, links, permission formatting, navigation instructions, and screenshots for submitting files and file hashes through the Defender portal.
The page was updated with revised metadata, clearer On/Off selection steps, an endpoint screenshot, and added guidance explaining that scoped device group correlation can produce separate incidents for Global SOC users.
The article received clearer wording, standardized terminology and formatting, revised examples, and updated link text.
The page updates heading capitalization, formats navigation paths and code blocks, and restructures the supported operating systems section for clearer presentation.
The page title and description were refined, and explanations of real-time protection, hybrid detection, cloud protection, and detection engines were reworded for clarity. The description now highlights client and cloud engines, machine learning, and behavior monitoring.
The page title capitalization changed, its description now covers viewing, organizing, and managing alerts and investigating threats involving devices, files, and users, and its metadata links were updated.
As of July 2026, messages identified as bulk receive the Promotions tag and, when Bulk moves enabled is turned on, are moved from the Inbox to the Promotions folder only when they are promotional in nature, regardless of BCL value.
The FAQ now recommends having more than one subscription owner and removing disabled or guest accounts with owner, write, or read permissions on Azure resources.
The documentation now explains that some identity and access recommendations can appear without the Azure CSPM standard assigned, but those recommendations don't support exemptions unless the standard is assigned. It also links to assignment instructions.
The article now covers EKS provisioning failures caused by recreated IAM roles, endpoint allowlist reconciliation, and stale Azure Arc registrations. It adds diagnostic commands and resolution steps.
The comparison table now describes excluding a rule from the correlation engine and marks it supported for analytics rules and custom detections, with configuration guidance linked.
The page title capitalization was standardized, the “Weaknesses” description was simplified, and the Vulnerability Management link was reformatted.
The article’s title, wording, formatting, and links were revised. Guidance on next-generation protection, firewall policies, controlled folder access, and attack surface reduction was reorganized and simplified.
The guide was revised for capitalization, grammar, image description, list and link formatting, and clearer references to Microsoft Intune.
The page title and description were updated, the description now covers product updates and feature-availability changes, and several release-note entries and links were reworded.
The article’s title, descriptions, navigation steps, severity explanations, and attack-disruption text were revised. The incident screenshot can now be opened in a lightbox.
The article title and headings were updated, browser enforcement wording was clarified, setup examples and policy instructions were streamlined, and two ontology links were added.
The page received capitalization and wording edits, revised onboarding guidance for local scripts and Intune, an updated Intune enrollment link, and clearer Microsoft 365 Lighthouse wording.
