Support for the Cloud Application Administrator role in Microsoft Defender for Cloud Apps' App Governance will retire on September 26, 2026. Organizations must reassign affected administrators to supported roles like Security Administrator to maintain access when URBAC is enabled. Review role assignments by September 25, 2026.

Microsoft Purview introduces AI-generated summaries and categorizations for DLP alerts within Microsoft Defender XDR, aiding security analysts in triage. The Data Security Triage Agent can be deployed from Defender XDR, with management in Purview. Rollout starts April 2026 (preview) and August 2027 (GA). Existing policies remain unchanged.

Microsoft Defender for Office 365's AIR experience will add a manual refresh button, replacing auto-refresh, and simplify investigation names by removing email subjects and UPNs. These changes improve performance, reduce network activity, and support data minimization. No admin action is required, but workflow updates are recommended.

Microsoft Teams will introduce a "Report a meeting" feature starting August 2026, allowing users to report suspicious or malicious activity during meetings. Reports help security teams investigate threats via Microsoft Defender and Teams admin center. The feature is enabled by default, with administrative controls and data collection for security investigations.

Microsoft Teams will introduce a "Report a call" feature for group calls, allowing users to report suspicious calls from call history. Administrators can review reports in Teams admin center and Microsoft Defender. The feature rolls out from August to October 2026 and is enabled by default.

Microsoft Defender XDR is enhancing the Identity page's Timeline tab to provide a unified, chronological view of identity-related activities and alerts from multiple Microsoft security sources. Rolling out mid-September to mid-October 2026, it offers improved context, filtering, and automatic updates without changing existing policies. No action is required to enable it.

Microsoft Defender XDR unifies identity response actions across linked accounts, enabling security teams to manage actions like disabling accounts or forcing password changes from one workflow. It supports multiple identity systems and SaaS apps, enhancing response speed and consistency. Rollout begins mid-October 2026 worldwide.

Microsoft Defender Unified RBAC will auto-enable on tenants starting late September 2026, completing by December 2026. It unifies access management across Defender and Sentinel workloads, importing existing roles with a 30-day notification period before activation. Opt-out is available post-activation; other Microsoft permissions remain unchanged.

Microsoft Defender for Identity now includes a new sensor health issue, "No Windows events received from domain controller," to alert administrators of missing Windows events. This improves visibility into event collection gaps affecting detections. It is available now, requires no pre-rollout action, and helps identify domain controller issues.

Microsoft Defender for Endpoint will remove manual triggering and the standalone experience of automated investigation and response (AIR) by early September 2026. AIR functions are integrated into always-on antivirus protection. Organizations using AIR in playbooks or scripts must update them before September 1, 2026.

Microsoft Edge will retire support for Windows Information Protection (WIP) and Microsoft Defender Application Guard (MDAG) by late September 2026. Organizations using these on Windows 10 must migrate to Microsoft Purview solutions and Edge's built-in security features, as these capabilities are already removed in Windows 11 version 24H2.

Update Microsoft Defender for Endpoint Android to version 1.0.9107.0101 or later by mid-September 2026 to avoid disruption in mobile threat protection due to infrastructure changes. Administrators should verify and update devices and inform users managing their own updates. No other configuration changes are needed.

Microsoft Defender for Identity now includes a health alert for missing domain controller network traffic, helping administrators detect traffic collection issues affecting visibility. The alert appears in sensor health tabs, requires no pre-rollout action, and guides troubleshooting if triggered after rollout. No impact on end users or compliance.

Updated Microsoft Defender documentation in defender-endpoint/mac-troubleshoot-netext-mde.md.

Updated Microsoft Defender documentation in defender-endpoint/mac-support-perf.md.

Updated Microsoft Defender documentation in defender-endpoint/mac-support-perf-overview.md.

Updated Microsoft Defender documentation in defender-endpoint/mac-support-sys-ext.md.

Updated Microsoft Defender documentation in defender-endpoint/mac-exclusions.md.

Updated Microsoft Defender documentation in defender-endpoint/use-intune-config-manager-microsoft-defender-antivirus.md.

The command example changes one Attack Surface Reduction rule ID from ending in `...e5` to `...e5b`.

Updated Microsoft Defender documentation in defender-office-365/safe-links-about.md.

Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-email-spoof-configure.md.

The documented supported value `Cryptominor` was corrected to `Cryptominer` in the alert normalization schema.