Cases Overview
Fundamentals
The documentation now states that MDTI projects are deprecated and directs users to link threat indicators to cases in the Microsoft Defender portal.
Product
Microsoft Unified SecOps Platform
Track documentation and Message Center changes for Microsoft Unified SecOps Platform.
Microsoft Learn documentation ↗Latest Microsoft Unified SecOps Platform changes
Configure delegated access with governance relationships for multitenant organizations
General
The article now clarifies tenant relationships, governing-tenant accounts and group representation, the disabled-by-default Enable invitations setting, and that Sentinel Azure RBAC grants management-plane—not data-plane—access.
Create and manage tenant groups in Microsoft Defender multitenant management
General
The article now separates setup and tenant management links and simplifies guidance about tenant visibility, switching groups, and refreshing after changes.
customer intent: As a security operations center leader, I want to learn about the services and features available in the Microsoft Defender portal f…
General
The overview page was revised to describe automatic attack disruption as containing attacks, limiting lateral movement, and reducing impact. The page date and authoring metadata were also updated.
customer intent: To learn how to create, delete, import, and edit roles in the unified role-based access control in Microsoft Defender multitenant ma…
General
The article updates navigation labels, clarifies and renumbers role and assignment steps, adds screenshot descriptions, refreshes metadata, and includes related-content links.
Defender Portal
General
The overview now refers to Microsoft Threat Intelligence and describes capabilities in Microsoft Defender XDR and Microsoft Sentinel that aggregate and enrich threat data from multiple sources.
Defender Xdr Portal
General
The documentation now refers to “Defender XDR” instead of “Defender for XDR” in the automated investigation and response description.
Deploy Microsoft Security Services for Unified Security Operations
Architecture and deployment
The article’s title, metadata, and wording were updated to clarify deployment planning, Microsoft security services, Sentinel workspace and resource-group guidance, and RBAC recommendations.
Devices in multitenant management
General
The page heading changed from “Devices” to “Devices in multitentant management.”
How Microsoft names threat actors
General
The page adds Frontier Blizzard, Storm-2581, and Storm-3127; updates several Storm group classifications to financially motivated; and revises links to Defender XDR threat analytics and Microsoft Graph Threat Intelligence APIs.
Hunting Overview
Hunting and detection
The overview replaces the Infrastructure chaining entry with a Threat analytics link for tracking emerging threats and reviewing Microsoft threat research and insights. The reactive hunting table formatting was also adjusted.
Microsoft Defender portal implementation guide for MSSPs
General
The page now explains that available email and collaboration capabilities depend on using Microsoft Entra B2B or GDAP. It adds notes on B2B Exchange RBAC limitations and GDAP workload and role requirements, and updates the email-management examples.
Microsoft Sentinel Onboard
Architecture and deployment
The page date and onboarding wording were updated to point readers to feature documentation and service-specific prerequisites for unified security operations.
Mto Cross Cloud
General
The article now explicitly names the MFA trust setting, distinguishes home and target tenant configuration, adds section anchors, and clarifies terminology for added cross-cloud tenants.
Mto Endpoint Security Policy
Endpoint protection
The article now includes a prerequisite reminder, clearer instructions for viewing policies in Intune, and links to related multitenant management content. Documentation metadata was also updated.
Plan
Architecture and deployment
The overview now uses “Microsoft Threat Intelligence” and links to its Defender XDR page and getting-started guidance instead of the previous Defender Threat Intelligence references.
Plan an incident response workflow in the Microsoft Defender portal
Incidents and response
Updated punctuation, list formatting, wording, role-based guidance formatting, and the link text for alert correlation and incident merging documentation.
Set up Microsoft Defender multitenant management
General
The requirements page now instructs readers to verify tenant access with Microsoft Entra B2B, clarifies related-link titles, standardizes note formatting, and updates metadata.
Threat Intelligence Overview
Fundamentals
The page now uses relative paths for its screenshots, updates terminology and the Microsoft Threat Intelligence link, and replaces two related links with a Threat analytics link in Microsoft Defender XDR.
Use workbooks in multitenant management
General
The article was rewritten with clearer steps for opening Workbooks and using the Situational Awareness workbook. It also clarifies tenant selection and current workbook limitations.
View and manage incidents and alerts in Microsoft Defender multitenant management
General
The article now more clearly explains viewing and managing incidents and alerts across tenants. Status changes, classification, tagging, and comments can span tenants, while assigning multiple incidents or alerts is limited to items from the same tenant.
Zero Trust
General
The linked topic changed from “What is Microsoft Defender Threat Intelligence (Defender TI)?” to “What is Microsoft Threat Intelligence in Microsoft Defender XDR?” with a new destination URL.
How Microsoft names threat actors
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.
Mto Endpoint Security Policy
Endpoint protection
Updated Microsoft Defender documentation in unified-secops-platform/mto-endpoint-security-policy.md.
Submission Guide
Endpoint protection
Updated Microsoft Defender documentation in unified-secops-platform/submission-guide.md.
Configure delegated access with governance relationships for multitenant organizations (preview)
General
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Connect Microsoft Sentinel to the Microsoft Defender portal
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Create and manage tenant groups in Microsoft Defender multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-tenant-groups.md.
Deploy
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/overview-deploy.md.
Endpoint security policies in multitenant management
Endpoint protection
Updated Microsoft Defender documentation in unified-secops-platform/mto-endpoint-security-policy.md.
Manage tenants in other Microsoft cloud environments
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-cross-cloud.md.
Manage unified role-based access control in multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-urbac.md.
Migrate Microsoft Sentinel incident creation rules to alert grouping in Microsoft Defender
Incidents and response
Added Microsoft Defender documentation in unified-secops-platform/migrate-sentinel-incident-creation-rules-alert-grouping.md.
Plan an incident response workflow in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in unified-secops-platform/plan-incident-response.md.
Reduce Risk Overview
Vulnerabilities and exposure
Updated Microsoft Defender documentation in unified-secops-platform/reduce-risk-overview.md.
Set up Microsoft Defender multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-requirements.md.
Use Microsoft Sentinel situational awareness workbooks in multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-workbooks.md.
View and manage incidents and alerts in Microsoft Defender multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-incidents-alerts.md.
Connect Microsoft Sentinel to the Microsoft Defender portal
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
How Microsoft names threat actors
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Create and manage tenant groups in Microsoft Defender multitenant management
General
Added Microsoft Defender documentation in unified-secops-platform/mto-tenant-groups.md.
Mto Overview
Fundamentals
Updated Microsoft Defender documentation in unified-secops-platform/mto-overview.md.
Mto Overview
Fundamentals
Updated Microsoft Defender documentation in unified-secops-platform/mto-overview.md.
Mto Tenant Groups
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-tenant-groups.md.
Mto Tenant Groups
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-tenant-groups.md.
Mto Tenant Groups
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-tenant-groups.md.
Mto Tenant Groups
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-tenant-groups.md.
Mto Tenant Groups
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-tenant-groups.md.
Mto Distribution Profiles
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-distribution-profiles.md.
How Microsoft names threat actors
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.
Advanced hunting in Microsoft Defender multitenant management
Hunting and detection
Updated Microsoft Defender documentation in unified-secops-platform/mto-advanced-hunting.md.
Content distribution in multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-distribution-profiles.md.
customer intent: As a business decision maker for a security operations center, I want to learn about the case management tools available in the Micr…
General
Updated Microsoft Defender documentation in unified-secops-platform/cases-overview.md.
customer intent: As a security operations center business decision maker, I want to learn about the tools available to detect threats in Microsoft's…
General
Updated Microsoft Defender documentation in unified-secops-platform/detect-threats-overview.md.
Customer intent: As a security operations center business decision maker, I want to learn about the tools available to respond to threats automatical…
General
Updated Microsoft Defender documentation in unified-secops-platform/respond-threats-overview.md.
customer intent: As a security operations center leader, I want to learn about the services and features available in the Defender portal to help me…
General
Updated Microsoft Defender documentation in unified-secops-platform/overview-defender-portal.md.
customer intent: As a security operations center leader, I want to learn about the services and features available in the Microsoft Defender portal f…
General
Updated Microsoft Defender documentation in unified-secops-platform/overview-unified-security.md.
customer intent: To learn how to create, delete, import, and edit roles in the unified role-based access control in Microsoft Defender multitenant ma…
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-urbac.md.
Endpoint security policies in multitenant management
Endpoint protection
Updated Microsoft Defender documentation in unified-secops-platform/mto-endpoint-security-policy.md.
Identities
General
Updated Microsoft Defender documentation in unified-secops-platform/multitenant-identities-inventory.md.
View and manage incidents and alerts in Microsoft Defender multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-incidents-alerts.md.
What's new for Microsoft unified security operations
General
Updated Microsoft Defender documentation in unified-secops-platform/whats-new.md.
Playbook Mssps
General
Removed Microsoft Defender documentation in unified-secops-platform/playbook-mssps.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Defender Portal
General
Updated Microsoft Defender documentation in unified-secops-platform/overview-defender-portal.md.
Connect Microsoft Sentinel to the Microsoft Defender portal
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Plan
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/overview-plan.md.
Governance Relationships
Identity protection
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Governance Relationships
Identity protection
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Governance Relationships
General
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Governance Relationships
Identity protection
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Governance Relationships
Identity protection
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Mto Workbooks
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-workbooks.md.
Microsoft Threat Actor Naming
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.
Configure delegated access with governance relationships for multitenant organizations
General
Added Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Configure delegated access with governance relationships for multitenant organizations
General
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Gov Support
General
Updated Microsoft Defender documentation in unified-secops-platform/gov-support.md.
Governance Relationships
General
Updated Microsoft Defender documentation in unified-secops-platform/governance-relationships.md.
Gov Support
General
Updated Microsoft Defender documentation in unified-secops-platform/gov-support.md.
Gov Support
General
Updated Microsoft Defender documentation in unified-secops-platform/gov-support.md.
Microsoft Threat Actor Naming
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.
How Microsoft names threat actors
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.
Connect Microsoft Sentinel to the Microsoft Defender portal
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Deploy
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/overview-deploy.md.
Gov Support
General
Updated Microsoft Defender documentation in unified-secops-platform/gov-support.md.
Manage security operations cases natively in the Microsoft Defender portal
General
Updated Microsoft Defender documentation in unified-secops-platform/cases-overview.md.
Manage tenants in other Microsoft cloud environments
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-cross-cloud.md.
Microsoft Threat Actor Naming
General
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-threat-actor-naming.md.
Mto Distribution Profiles
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-distribution-profiles.md.
Mto Endpoint Security Policy
Endpoint protection
Updated Microsoft Defender documentation in unified-secops-platform/mto-endpoint-security-policy.md.
Mto Overview
Fundamentals
Updated Microsoft Defender documentation in unified-secops-platform/mto-overview.md.
Mto Requirements
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-requirements.md.
Multitenant Identities Inventory
Identity protection
Updated Microsoft Defender documentation in unified-secops-platform/multitenant-identities-inventory.md.
Plan
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/overview-plan.md.
Plan an incident response workflow in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in unified-secops-platform/plan-incident-response.md.
Playbook Managed Security
General
Updated Microsoft Defender documentation in unified-secops-platform/playbook-managed-security.md.
Respond Threats Overview
Fundamentals
Updated Microsoft Defender documentation in unified-secops-platform/respond-threats-overview.md.
Mto Workbooks
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-workbooks.md.
Mto Workbooks
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-workbooks.md.
Defender Portal
General
Updated Microsoft Defender documentation in unified-secops-platform/overview-defender-portal.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.
Mto Workbooks
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-workbooks.md.
Mto Workbooks
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-workbooks.md.
Workbooks in multitenant management
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-workbooks.md.
Manage security operations cases natively in the Microsoft Defender portal
General
Updated Microsoft Defender documentation in unified-secops-platform/cases-overview.md.
Manage tenants in other Microsoft cloud environments
General
Updated Microsoft Defender documentation in unified-secops-platform/mto-cross-cloud.md.
Multitenant Identities Inventory
General
Updated Microsoft Defender documentation in unified-secops-platform/multitenant-identities-inventory.md.
Plan an incident response workflow in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in unified-secops-platform/plan-incident-response.md.
Microsoft Sentinel Onboard
Architecture and deployment
Updated Microsoft Defender documentation in unified-secops-platform/microsoft-sentinel-onboard.md.