Advanced Hunting Schema Changes
Hunting and detection
The `AadDeviceId` column is being replaced by `EntraIdDeviceId`. `AadDeviceId` will remain available for 30 days to support query updates.
Product
Microsoft Defender XDR
Track documentation and Message Center changes for Microsoft Defender XDR.
Microsoft Learn documentation ↗Latest Microsoft Defender XDR changes
Governance Relationships
General
The documentation now explains how to grant Microsoft Sentinel permissions to delegated remote tenant groups through Defender URBAC, including required permissions, role assignment, and workspace selection. It also retains the resource-group assignment option and clarifies management-plane versus data-plane access.
Investigate Users
General
The user investigation documentation revises its authoring reference links and changes `GraphApiAuditEvents` to `GraphAPIAuditEvents`.
Whats New
Identity protection
The what's new documentation now uses the table name `GraphAPIAuditEvents` when describing Microsoft Entra ID API requests to Microsoft Graph API.
Advanced Hunting Microsoft Defender
Hunting and detection
The document’s `ms.author` value changed from `pauloliveria` to `kschwabacher`.
Ai Agent Real Time Protection
General
The documentation now states that block events from Microsoft Prompt Shields for Foundry, Copilot Studio, and Copilot Agent Builder are recorded as behaviors.
Api Advanced Hunting
Hunting and detection
The page’s author metadata changed from EdB-MSFT (edbaynash) to Karinschwabacher13 (kschwabacher).
Integrated Security Operations Data Billing Retention
General
The document’s listed author changed from monaberdugo to kschwabacher.
Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles
General
Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.
Microsoft Threat Actor Naming
General
The page now lists Crystal Typhoon and Storm-2380, Storm-2570, Storm-2634, Storm-2990, Storm-2992, Storm-3069, Storm-3119, Storm-3168, and Storm-3189, including available aliases, classifications, and reference links. The page date was also updated and two internal authoring links were removed.
Advanced Hunting Clouddnsevents Table
Hunting and detection
The table reference replaces DnsEventType and DnsEventSubType with EventType and EventSubType, and updates the request-filter example accordingly.
Create a rule from the Settings page
General
Administrators can select specific detection sources within service sources when creating or editing alert tuning rules, including include/exclude choices for existing rules.
Security Copilot is now included as part of your Microsoft 365 E5/E7 plan
Architecture and deployment
Updated October 19, 2026: We have identified that this message did not reach it's intended audience. You can safely disregard this message, and we apologize any confusion this may have caused.
Ai Agent Real Time Protection
General
The documentation now describes malicious content propagation, secret exfiltration, evasion techniques, and unsafe email domains, including how blocking affects user requests, model responses, tool requests, and tool responses.
Manage Rbac
General
The page adds two reference links, refreshes the Microsoft Sentinel table entry, and adds a sample two-column table.
Mto Urbac
General
Updated reference links and removed “(Preview)” from the headings for creating or editing custom roles, deleting roles, and importing roles.
Governance Relationships
General
The page updates its DevRel reference links and removes the “Important” callout stating that the feature is currently in preview.
Microsoft Defender for Office 365: Localized default mark and notify email template
General
Microsoft Defender for Office 365 will localize the default "Mark and notify" email template based on users' Outlook language settings, improving clarity in user-reported message notifications. Rollout starts June 2026 globally, with no changes to message classification or custom templates. No action is required.
Advanced Hunting Agentsinfo Table
Hunting and detection
The page no longer includes the notice that some information concerns prereleased products subject to substantial change before commercial release.
Advanced Hunting Aiagentsinfo Table
Hunting and detection
The AIAgentsInfo advanced hunting table is transitioning to AgentsInfo. AIAgentsInfo remains accessible until July 1, 2026, and its reference documentation was removed.
Advanced Hunting Schema Changes
Hunting and detection
The documentation now describes the transition from `AIAgentsInfo` to the unified `AgentsInfo` table, which expands beyond Copilot Studio-specific columns.
Advanced Hunting Schema Tables
Hunting and detection
The schema page no longer labels AgentsInfo as Preview and no longer lists AIAgentsInfo.
Dlp Investigate Alerts Defender
General
The documentation now states that the built-in rule took effect in early October 2026. DLP signals are treated as behaviors, so they do not generate alerts or appear in the incident queue, but remain available in advanced hunting.
Investigate Alerts
General
The documentation adds steps for disabling a built-in alert tuning rule and states that each alert tuning rule supports up to 200 conditions.
Whats New
General
The What's new entries for the preview AgentsInfo and AIAgentsInfo advanced hunting tables now show table names as inline code instead of linked text.
Alerts Incidents Correlation
General
The page now states that detection rules involved in creating a source incident are added to the target incident. It also explains that correlation settings control alerts from analytics rules or custom detections.
Custom Detection Manage
Hunting and detection
The documentation now states that custom detections are included in correlation by default and have a per-rule option to include or exclude them.
Manage detection rule correlation settings in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn
Hunting and detection
The documentation now covers including or excluding custom detections from Microsoft Defender XDR correlation on a per-rule basis. Custom detections are included by default; exclusions create predictable single-alert incidents when no matching grouping rule applies.
Microsoft Defender for Office 365: New email submissions data in Advanced Hunting
Hunting and detection
Microsoft Defender for Office 365 is adding two new Advanced Hunting tables, SubmissionEvents and SubmissionResults, to enhance email submission visibility and detection workflows. Public Preview starts early October 2026; General Availability begins late October 2026. No immediate action or compliance concerns are required.
Microsoft Defender for Office 365: Post-delivery protection for malicious QR codes in Microsoft Teams
General
Microsoft Defender for Office 365 extends Teams URL protection to detect malicious URLs in QR codes post-delivery, warning users and enabling security teams to investigate via Advanced Hunting. Rolling out worldwide from October to November 2026, no user action is required, but admins should review related settings and processes.
Microsoft Defender Vulnerability Management: Private preview for selected developer package vulnerability coverage
Vulnerabilities and exposure
Microsoft Defender Vulnerability Management is privately previewing expanded vulnerability coverage for selected Node.js, Python, and Java packages on Windows devices. It integrates with existing workflows, APIs, and exports, with rollout planned from September to December 2026. Organizations should prepare for increased data volume and validate integrations before enabling.
Microsoft Virus Initiative - Microsoft Defender XDR | Microsoft Learn
General
The virus initiative criteria page updates its VB100 entry from Grade C or higher to Grade B or higher for a 95% detection rate. Its platform identifier was also updated.
Hunts in Microsoft Defender Experts Hunting overview - Microsoft Defender XDR | Microsoft Learn
Hunting and detection
The Hunts overview documents an experience for viewing in-progress and completed expert-led hunts, including hunt types, statuses, outcomes, and supporting details in the Defender portal.
Automatic Attack Disruption Exclusions
General
The documentation now explains that identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. It clarifies Unified RBAC permissions for both products’ data sources and adds guidance on role assignments and data-source scope.
Custom Detection Manage
Hunting and detection
The Edit option description now notes flexible frequency and lookback for all supported data sources and links to further guidance.
Custom Detection Manage
Hunting and detection
The Edit description no longer mentions flexible frequency and lookback being in public preview or links to related guidance. Author and date metadata also changed.
Custom Detection Rules
Hunting and detection
The documentation now describes independently configuring detection frequency from 5 minutes to 14 days and lookback from 5 minutes to 30 days across supported data sources. Lookback must be at least as long as the frequency to avoid coverage gaps.
Custom Detection Rules
Hunting and detection
Custom frequency from 5 minutes to 14 days is available only for rules based exclusively on Microsoft Sentinel data. Rules using Defender XDR data now use fixed lookback periods based on their run frequency, ranging from 4 hours to 30 days.
Microsoft Defender for Office 365: Changes to Unified RBAC permission mapping for Microsoft Entra Security Operator role
Email and collaboration
Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.
Microsoft Defender for Office 365: Enhancing how we handle promotional mail
Email and collaboration
Microsoft Defender for Office 365 will tag promotional emails as “promotions” and can auto-move them to a Promotions folder, learning from user actions. Public preview starts mid-April 2026; general rollout completes by late 2026. Admins control settings; users can customize via message moves.
Microsoft Defender for Identity auto-activation and auto-auditing automatic enablement
Identity protection
Microsoft Defender for Identity will auto-enable sensor v3.x activation and Windows event auditing for eligible tenants starting late October 2026, easing setup for security admins. A portal banner allows opt-out before rollout; manual control remains afterward. Review configurations and update guidance accordingly.
Non-human identities in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn
Identity protection
The page now documents inventory insights for new, highly privileged, risky, unused, overprivileged, externally unverified, and AI-agent-used identities. It also clarifies that Salesforce inventory includes Connected Apps and External Client Apps.
Microsoft Defender XDR: Detection source support in alert tuning rules
Incidents and response
Microsoft Defender XDR will allow alert tuning rules to target specific detection sources for finer control. This feature rolls out in public preview mid-October 2026 and general availability mid-November 2026. Existing rules apply to all sources unless updated. No action is needed unless customization is desired.
Microsoft Defender for Office 365: Teams user reporting enabled by default
General
Microsoft Defender for Office 365 will enable Teams user reporting by default starting late October 2026 for licensed organizations. Users can report suspicious Teams content to improve threat detection. Admins can review or opt out via a dedicated Defender portal page before October 25, 2026.
Case Management in Microsoft Defender
General
Microsoft Defender introduces native Case Management to unify threat investigations, assign analysts, track SLAs, and capture notes in one workspace. Launching in public preview September 2026, it integrates with existing workflows and permissions, enhancing security team coordination and response efficiency without requiring manual migration.
Microsoft Defender for Cloud Apps: Retirement of EWS detections in App Governance
General
Exchange Web Services (EWS) in Exchange Online will be retired starting October 1, 2026, with related Microsoft Defender for Cloud Apps app governance detections ending October 15, 2026. Organizations not using EWS need no action; those continuing EWS use will lose related alerts and should migrate away from EWS.
Microsoft Defender for Endpoint: Support for Amazon Linux 2 (ARM64) retiring October 31, 2026
Endpoint protection
Support for Microsoft Defender for Endpoint on Amazon Linux 2 (ARM64) will retire on October 31, 2026. After this date, no updates or support will be provided. Organizations must identify affected devices, prevent upgrades beyond version 101.25122.0004, and migrate to a supported Linux distribution before the deadline.
Microsoft Defender for Endpoint: Update to Linux connectivity requirements with new service URLs to allowlist
Endpoint protection
Microsoft Defender for Endpoint on Linux now requires allowlisting new service URLs specific to tenant types for delivering internal configuration updates, feature rollouts, and critical issue mitigations. This update is available worldwide, with no change to user experience, and ensures devices receive the latest features and optimizations.
Microsoft Defender for Office 365: View approver details for remediation actions in Advanced Hunting
Hunting and detection
Microsoft Defender for Office 365 added an ApproverUpn column to the EmailPostDeliveryEvents table in Advanced Hunting, showing who approved remediation actions. This enables faster investigations without using Action Center. The feature is available worldwide, enabled by default, and requires no action from administrators.
Microsoft Defender for Office 365: Remediation actions from the Teams message entity flyout
Email and collaboration
Microsoft Defender for Office 365 will enhance the Teams message entity flyout by late September 2026, enabling security admins to submit messages to Microsoft and block senders or domains in one workflow. This streamlines Teams message investigations for Plan 1 and Plan 2 customers without requiring configuration changes.
Microsoft Defender for Office 365: New MessageContents table in Advanced Hunting for Microsoft Teams messages
Hunting and detection
Microsoft Defender for Office 365 introduces a new MessageContents table in Advanced Hunting for Teams messages, enabling authorized security analysts to query message snippets and metadata for threat investigations. It rolls out worldwide from late September to mid-October 2026, requiring appropriate permissions for access.
Advanced Hunting Query Results
Hunting and detection
Advanced hunting results can be mapped to nodes and edges using a Builder or JSON, then explored with entity enrichment, relationship details, folding, and mapping edits.
Best practices for graph mapping in advanced hunting
Hunting and detection
A new page explains how to prepare query results, configure graph nodes and edges, apply relationship conditions, and use recognized entity types and identifiers for Defender enrichment.
AADSignInEventsBeta table in the advanced hunting schema (deprecated)
Hunting and detection
The documentation now labels AADSignInEventsBeta as deprecated and states that it will be replaced by EntraIdSignInEvents. Queries using the table will be migrated automatically on that date.
AADSpnSignInEventsBeta table in the advanced hunting schema (deprecated)
Hunting and detection
The table is now documented as deprecated and will be replaced by EntraIdSpnSignInEvents on October 19, 2026. Queries using it will be migrated automatically.
Activate Defender Rbac
Vulnerabilities and exposure
The documentation now provides direct navigation and toggle-based steps for deactivating workloads, including confirmation and the resulting **Not Active** status.
Advanced Hunting Clouddnsevents Table
Hunting and detection
The table documentation now describes ImageDigest, Region, and HostName, including their meanings for container image, cluster region, and node hostname data.
Advanced Hunting Defender Use Custom Rules
Hunting and detection
The article now warns that deleting functions and saved queries is permanent, clarifies guidance for the `adx()`, `arg()`, and `workspace()` operators, updates menu image descriptions, and renames analytics rule section headings.
Advanced Hunting Devicebaselinecomplianceassessment Table
Hunting and detection
The Advanced Hunting schema now describes ConfigurationId as identifying a configuration within a specific benchmark and benchmark version.
Advanced Hunting Devicebaselinecomplianceassessmentkb Table
Hunting and detection
The documentation now specifies that `ConfigurationId` is identified within a benchmark and benchmark version, and documents the `ConfigurationBenchmarkVersion` field.
Advanced Hunting Emailevents Table
Hunting and detection
The Advanced Hunting EmailEvents page updated its ownership metadata and date, and changed the documented column reference for sender, recipient, delivery, threat, authentication, and policy fields.
Advanced Hunting Extend Data
Hunting and detection
The page wording was revised to emphasize correct settings across data sources, and section headings now clearly describe enabling Windows advanced security auditing and installing the Defender for Identity sensor. Section anchors and the page date were also updated.
Advanced Hunting Go Hunt
Hunting and detection
The documentation date changed to July 2, 2026, and the wording now specifies that the associated incident includes the entity.
Advanced Hunting Limits
Hunting and detection
The explanation now explicitly describes the difference between average daily use and top daily use; the example values remain 75% and 100%. The document date was updated to July 2, 2026.
Advanced Hunting Link To Incident
Hunting and detection
The article date and wording were updated, with shorter instructions for running queries, confirming prerequisites, troubleshooting, creating alerts, viewing linked incidents, and filtering manually detected alerts.
Advanced Hunting Microsoft Defender
Hunting and detection
The documentation now states that a newly created Microsoft Sentinel function in Log Analytics can take up to 20 minutes to appear in advanced hunting.
Advanced Hunting Migrate From Mde
Hunting and detection
The documentation now clarifies migration queries from Microsoft Defender for Endpoint, including PowerShell technique filtering, AlertInfo and AlertEvidence joins, and entity filtering. It also updates the Microsoft Defender XDR setup link and publication date.
Advanced Hunting Modes
Hunting and detection
The article now includes an updated section heading, refreshed screenshots and image descriptions, clearer guided-tour wording, and a new publication date.
Advanced Hunting Overview
Hunting and detection
The documentation now distinguishes 30-day native Defender XDR data retention from Microsoft Sentinel analytics-tier retention. It explains that onboarding a Sentinel workspace and configuring table retention can support longer retention, while streaming to external services remains another option.
Advanced Hunting Query Builder
Hunting and detection
Updated the publication date, clarified wording for the Run query and All filters controls, improved screenshot descriptions, and renamed the Related content section with an anchor.
Advanced Hunting Query Builder Details
Hunting and detection
The page updates its date, clarifies when the EventType filter is available, and improves descriptions of EventType, sample-size, Edit in KQL, and generated KQL screenshots. It also specifies the file-name and SHA256 example when describing narrowed Emails & collaboration queries.
Advanced Hunting Query Emails Devices
Hunting and detection
The article date was updated, and explanatory text was revised to clarify extracting the account name from recipient email addresses and checking logon activity on a recipient's device after ZAP processing.
Advanced Hunting Query History
Hunting and detection
The Query history section was reworded for clarity, with an updated date and new section anchor. It continues to describe rerunning past queries, retaining up to 30 queries from the last 28 days, and using or editing queries.
Advanced Hunting Query Language
Hunting and detection
The article now uses clearer terms for the advanced hunting schema and time zone settings, identifies the Get started pane on the Advanced hunting page in the Microsoft Defender portal, and fixes link wording. The article date was updated to July 2, 2026.
Advanced Hunting Query Results
Hunting and detection
The article adds stable anchors and clearer “Example chart” headings, refines query descriptions, identifies the newly added filter, and documents when the timeline appears: results must contain more than 40 events and a `Timestamp` or `timeGenerated` column.
Advanced Hunting Security Copilot
Hunting and detection
The documentation now describes Rich insights and Query only modes, with Rich insights as the default. It updates mode-switching steps, notes that modes aren't available on non-primary workspaces, and explains that switching starts a new chat and clears the current conversation. It also documents support for queries spanning multiple tables.
Advanced Hunting Shared Queries
Hunting and detection
The page date moved to July 2, 2026. Wording now describes query sections as lists or groups, simplifies rename and delete instructions, updates the GitHub contribution link, and directs readers to threat analytics reports in the Defender portal.
Ai Agent Detection Protection
General
The documentation now states that unpublished Foundry agents, including playground-only agents, aren't supported for threat detection and links to publishing guidance. It also updates terminology and metadata.
Ai Agent Real Time Protection
General
The documentation now labels Copilot Studio agent protection as Preview and describes protection for Foundry agents, covering user requests, agent responses, tool invocations, and tool responses.
Alert classification for suspicious inbox manipulation rules
Incidents and response
The playbook now more explicitly covers true and false positives, compromised accounts, rules without filters, activity before suspicious rules were created, and related alerts. Metadata and the publication date were also updated.
Alert Classification Malicious Exchange Connectors
Incidents and response
The page updates wording, metadata, and investigation guidance. Sample queries are now described as covering new connector creation, connector-to-mail-flow correlation, and external domain detection, with added admin logon checks.
Alert Classification Password Spray Attack
Incidents and response
The article now explains MFA fatigue, clarifies query descriptions and alert references, and adds a Kusto query to check whether MFA strong authentication requirements were removed from Microsoft Entra ID accounts.
Alert classification playbooks in Microsoft Defender XDR
Incidents and response
The page title and headings now explicitly reference Microsoft Defender XDR. An Overview section and an anchor for the available playbooks section were added, and the publication date was updated.
Alert Classification Suspicious Ip Password Spray
Incidents and response
The article updates its date and wording, and adds clearer instructions for the investigation queries. Administrators are told to set the `ip_address` variable, use an eight-hour lookback, and review legacy-protocol indicators, successful sign-ins, and related cloud app activity.
Alert Grading Playbook Email Forwarding
Incidents and response
The playbook now presents alert-review steps as a numbered sequence, clarifies terminology for the forwarding user and recipient lists, and refines investigation and remediation wording. Metadata and the documentation date were also updated.
Alert Grading Playbook Inbox Forwarding Rules
Incidents and response
The article now uses clearer terminology for investigating suspicious rule parameters, identifying the IP involved in inbox rule creation, and remediating account compromise. Its metadata and publication date were also updated.
Alert policies in the Microsoft Defender portal
Incidents and response
The article now notes that some default alert policies contain filters not shown in the Microsoft Defender portal. These filters can affect whether activities match conditions and trigger alerts, and the article provides a PowerShell command to view them.
AlertEvidence
General
The documentation now lists alerts from Defender for Endpoint, Office 365, Cloud Apps, Identity, and onboarded Microsoft Sentinel sources. It also clarifies that data availability depends on deployed services and accessible Sentinel workspaces, and recommends joining AlertEvidence with AlertInfo by AlertId for alert metadata.
AlertInfo
General
The documentation now states that AlertInfo can contain Microsoft Sentinel alerts associated with incidents when Sentinel is onboarded to the Defender portal. Data availability depends on deployed Defender services and accessible Sentinel workspaces.
Api Incident
Incidents and response
The documentation explains that lastUpdateTime identifies incidents changed after creation. It also states that severity may change when alerts are added or removed, and that the incident resource does not provide severity-change history.
Api List Incidents
Developer and API
The documentation now explains that incident properties, including severity, may change after creation. Applications should poll `lastUpdateTime` and compare current values with retained values; severity cannot be filtered server-side.
Before you begin using Defender Experts MDR
General
The documentation adds Plan 2 prerequisites covering endpoint, email, identity, cloud workload protection, Sentinel ingestion and connectivity, access permissions, 90-day retention, and UEBA. It also updates data storage, retention, deletion, and GCC availability details.
CallActivityEvents table in the advanced hunting schema
Hunting and detection
The new table documents Microsoft Teams call activity details, including timestamps, call and participant identifiers, activity types, scheduling information, and join links. It is populated by Microsoft Defender for Office 365.
Communicating with experts in the Microsoft Defender Experts service
General
The documentation now states that Security Delivery Experts are included for services licensed for at least 1,500 seats, replacing the previous 500-device threshold.
Compare Rbac Roles
General
The page now clarifies that activating Defender unified RBAC for Email & collaboration imports only actively assigned source roles and role groups. Unassigned built-in roles and groups are not imported, and the permission mapping tables were revised.
Configure Asset Rules
General
The guidance now explains that administrators can select an existing tag or create a new one, and warns that deleting a dynamic rule removes it and may affect tag or device value assignments. Turning off the rule stops it from applying while retaining it.
Configure Attack Disruption
General
The page now describes automatic device isolation for Microsoft Defender for Endpoint-managed end-user workstations and identifies it as in preview. It adds prerequisites, safeguards, exclusion guidance, and clearer Sense Agent and connector setup instructions.
Configure email alert notifications in Microsoft Defender XDR
Incidents and response
The page title and description now refer to Microsoft Defender XDR, setup step numbering was corrected, and a warning explains that deleting a notification rule permanently stops its future email notifications.
Configure Event Hub
General
The article clarifies resource provider registration, app and service principal creation, client-secret handling, namespace settings, resource ID retrieval, and event hub choices.
Configure Microsoft Defender XDR to stream Advanced Hunting events to your Azure event hub
Hunting and detection
The article now includes expanded configuration guidance for streaming Advanced Hunting events to Azure Event Hubs, portal steps for raw data streaming, and a JSON event-payload example. It also updates terminology and schema links.
Create an incident report with Microsoft Copilot in Microsoft Defender
Incidents and response
The article was rewritten for clarity, explicitly states that Security Copilot access is required, and clarifies that resolving an incident before report generation helps capture all actions. Links, metadata, and descriptions were also updated.
Create custom Microsoft Defender XDR reports using Microsoft Graph security API and Power BI
Developer and API
The article now refers to required RBAC permissions, expands OData, and documents relative lookback and date-parameter queries for Microsoft Graph alert and incident data. It also updates wording and metadata.
Create Custom Rbac Roles
General
The article now documents selecting GDAP remote tenant groups for a custom role assignment. Members of selected groups inherit the configured permissions, data-source access, and applicable scopes.
Custom Detection Rules
Hunting and detection
The documentation adds support for governance actions on supported SaaS identities returned by CloudAppEvents queries. Queries must include AccountObjectId, InstanceId, ApplicationId, AppInstanceId, and other required fields; unsupported actions or services produce no action.
DataSecurityBehaviors
General
The table documentation removes the Preview label and prerelease notice and adds the `PolicyInfo` and `Policies` columns.
DataSecurityEvents
General
The table no longer includes the Preview label or prerelease notice. It adds physical access, removable media, and risky AI usage fields, while removing several URL, email, file-path, workload, and Cloud App Alert fields.
Defender Experts Hunting Ask Experts
Hunting and detection
The documentation now includes screenshots showing the Ask Defender Experts option on the Defender Experts overview page and in the message center. The page metadata and authoring identifier were also updated.
Defender Experts Hunting Prerequisites
Hunting and detection
The prerequisites now document storage locations for hunting, reporting, and operational data; retention of up to 90 days after subscription expiry and deletion within 30 days after termination; and availability for eligible GCC customers through Defender Experts Hunting for Gov.
Defender Experts Overview
Fundamentals
The overview now states that Plan 2 extends expert triage and investigation to supported third-party sources ingested through Microsoft Sentinel, in addition to Microsoft Defender workloads.
Defender Threat Intelligence
General
The documentation now explains how to use Copilot in Defender on the Threat analytics, Intel profiles, and Intel explorer pages, including prompts, built-in actions, and saved chat sessions.
Detecting human-operated ransomware attacks with Microsoft Defender
General
The playbook now uses Microsoft Defender branding, updates its date, and revises the ransomware signal table to include Defender for Cloud Apps for email or cloud-app exfiltration and Defender for Endpoint for endpoint file encryption. Related API, Sentinel integration, and queue references were also renamed.
DeviceInfo
General
The DeviceInfo table reference now documents the DeviceRoles string column, including JSON-formatted roles, confidence levels, and last-seen times. It also includes minor formatting and wording updates.
DeviceLogonEvents table in the advanced hunting schema
Hunting and detection
The page now explains that token creation events initiated by lsass.exe can include access-token privilege context in AdditionalFields. It also refines guidance for investigating authentication activity and privileged logons.
DeviceProcessEvents table in the advanced hunting schema
Hunting and detection
The page corrects the table name, clarifies that initiating-process signature fields do not describe the created process, and adds a Kusto query that joins DeviceFileCertificateInfo to retrieve signing details.
Edit Delete Rbac Roles
General
The article now provides clearer steps and prerequisites for editing, deleting, and exporting roles. It also highlights that deleting an active workload role removes its assigned user permissions and clarifies export behavior for newer tenants.
Enable attack disruption actions in Okta with Microsoft Defender XDR
Identity protection
The article updates its title and terminology, clarifies Okta and Microsoft prerequisites, and specifies that the saved token is used when creating an integration profile in the Defender portal. The prerequisite link text and documentation metadata were also updated.
Enriching Defender Experts MDR with third-party network signals
General
The capability is deprecated effective September 1, 2026, closed to new enablement, and existing coverage ends at the organization’s next renewal. Microsoft Defender Experts MDR Plan 2 is the stated replacement.
Entity Page Device
General
The documentation clarifies that custom activity data from Microsoft Sentinel must include a strong identifier combination for the host to be mapped and displayed in the Device Timeline.
Entity Page Threat Intelligence
General
The documentation now explains the 0–100 reputation score, its Malicious, Suspicious, Neutral, and Unknown ranges, scoring inputs, and infrastructure data sources including passive DNS, port scans, web crawling, and reverse DNS.
EntraIdSignInEvents
General
The replacement of AADSignInEventsBeta is now scheduled for October 19, 2026, with queries migrated automatically. Custom detections require no changes, and several field definitions and schema fields were updated.