Microsoft Defender daily update for 23 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 22 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Edge: Retirement of Windows Information Protection (WIP) and Microsoft Defender Application Guard (MDAG) leads 2 Defender updates

21 August 2026 recorded 2 tracked Microsoft Defender documentation changes and 2 relevant Message Center announcements. The most active areas were Defender XDR.

Defender XDR · Endpoint protection Microsoft Edge: Retirement of Windows Information Protection (WIP) and Microsoft Defender Application Guard (MDAG)

Microsoft Edge will retire support for Windows Information Protection (WIP) and Microsoft Defender Application Guard (MDAG) by late September 2026. Organizations using these on Windows 10 must migrate to Microsoft Purview solutions and Edge's built-in security features, as these capabilities are already removed in Windows 11 version 24H2.

Defender XDR · General Microsoft Defender for Office 365: Localized default mark and notify email template

Microsoft Defender for Office 365 will localize the default "Mark and notify" email template based on users' Outlook language settings, improving clarity in user-reported message notifications. Rollout starts June 2026 worldwide, completing by September 2026. No action is required; admins may inform users and review settings.

Microsoft Defender daily update for 20 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Tenant will be auto-enabled into Microsoft Defender Unified RBAC

19 August 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · Identity protection Tenant will be auto-enabled into Microsoft Defender Unified RBAC

Microsoft Defender Unified RBAC will auto-enable on tenants starting late September 2026, completing by December 2026. It unifies access management across Defender and Sentinel workloads, importing existing roles with a 30-day notification period before activation. Opt-out is available post-activation; other Microsoft permissions remain unchanged.

Microsoft Defender daily update for 18 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR

17 August 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · General Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR

Microsoft Purview introduces AI-generated summaries and categorizations for DLP alerts within Microsoft Defender XDR, aiding security analysts in triage. The Data Security Triage Agent can be deployed from Defender XDR, with management in Purview. Rollout starts April 2026 (preview) and August 2027 (GA). Existing policies remain unchanged.

Microsoft Defender daily update for 16 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 15 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

New Defender for Identity health alert for missing domain controller network traffic leads 2 Defender updates

14 August 2026 recorded 2 tracked Microsoft Defender documentation changes and 2 relevant Message Center announcements. The most active areas were Defender XDR.

Defender XDR · Incidents and response New Defender for Identity health alert for missing domain controller network traffic

Microsoft Defender for Identity now includes a health alert for missing domain controller network traffic, helping administrators detect traffic collection issues affecting visibility. The alert appears in sensor health tabs, requires no pre-rollout action, and guides troubleshooting if triggered after rollout. No impact on end users or compliance.

Defender XDR · Identity protection New Defender for Identity health issue for missing Windows events from a domain controller

Microsoft Defender for Identity now includes a new sensor health issue, "No Windows events received from domain controller," to alert administrators of missing Windows events. This improves visibility into event collection gaps affecting detections. It is available now, requires no pre-rollout action, and helps identify domain controller issues.

Action required: Update Microsoft Defender for Endpoint Android App

13 August 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · Endpoint protection Action required: Update Microsoft Defender for Endpoint Android App

Update Microsoft Defender for Endpoint Android to version 1.0.9107.0101 or later by mid-September 2026 to avoid disruption in mobile threat protection due to infrastructure changes. Administrators should verify and update devices and inform users managing their own updates. No other configuration changes are needed.

Microsoft Defender daily update for 12 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Troubleshoot Network Extension (NetExt) issues in Defender for Endpoint on Mac leads 5 Defender updates

11 August 2026 recorded 5 updated Microsoft Defender documentation changes. The most active areas were Endpoint.

Endpoint · Troubleshooting Troubleshoot Network Extension (NetExt) issues in Defender for Endpoint on Mac

Updated Microsoft Defender documentation in defender-endpoint/mac-troubleshoot-netext-mde.md.

Endpoint · Troubleshooting Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS

Updated Microsoft Defender documentation in defender-endpoint/mac-support-perf.md.

Endpoint · Endpoint protection Configure and validate exclusions for Microsoft Defender for Endpoint on macOS

Updated Microsoft Defender documentation in defender-endpoint/mac-exclusions.md.

Endpoint · Troubleshooting Overview for how to troubleshoot performance issues for Microsoft Defender for Endpoint on macOS

Updated Microsoft Defender documentation in defender-endpoint/mac-support-perf-overview.md.

Endpoint · Troubleshooting Troubleshoot system extension issues in Microsoft Defender for Endpoint on macOS

Updated Microsoft Defender documentation in defender-endpoint/mac-support-sys-ext.md.

Safe Links About

10 August 2026 recorded 1 updated Microsoft Defender documentation change. The most active areas were Office 365.

Office 365 · Email and collaboration Safe Links About

Updated Microsoft Defender documentation in defender-office-365/safe-links-about.md.

Microsoft Defender daily update for 9 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 8 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 7 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender for Office 365: AIR Investigation Experience Improvements

6 August 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · General Microsoft Defender for Office 365: AIR Investigation Experience Improvements

Microsoft Defender for Office 365's AIR experience will add a manual refresh button, replacing auto-refresh, and simplify investigation names by removing email subjects and UPNs. These changes improve performance, reduce network activity, and support data minimization. No admin action is required, but workflow updates are recommended.

Microsoft Teams: Report security concerns in Teams meetings leads 3 Defender updates

5 August 2026 recorded 1 updated Microsoft Defender documentation changes and 2 relevant Message Center announcements. The most active areas were Defender XDR, Endpoint.

Defender XDR · General Microsoft Teams: Report security concerns in Teams meetings

Microsoft Teams will introduce a "Report a meeting" feature starting August 2026, allowing users to report suspicious or malicious activity during meetings. Reports help security teams investigate threats via Microsoft Defender and Teams admin center. The feature is enabled by default, with administrative controls and data collection for security investigations.

Defender XDR · General Microsoft Teams: Users can report security concerns in group calls

Microsoft Teams will introduce a "Report a call" feature for group calls, allowing users to report suspicious calls from call history. Administrators can review reports in Teams admin center and Microsoft Defender. The feature rolls out from August to October 2026 and is enabled by default.

Endpoint · Endpoint protection Use Intune Config Manager Microsoft Defender Antivirus

Updated Microsoft Defender documentation in defender-endpoint/use-intune-config-manager-microsoft-defender-antivirus.md.

Microsoft Defender daily update for 4 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender for Office 365: Enhancing how we handle promotional mail leads 2 Defender updates

3 August 2026 recorded 1 updated Microsoft Defender documentation changes and 1 relevant Message Center announcement. The most active areas were Office 365, Defender XDR.

Defender XDR · Email and collaboration Microsoft Defender for Office 365: Enhancing how we handle promotional mail

Microsoft Defender for Office 365 will tag promotional emails as “promotions” and can auto-move them to a Promotions folder, learning user preferences over time. Public preview starts mid-April 2026; general availability begins late July 2026. Admins can configure settings, and users can train the system by moving messages.

Office 365 · Email and collaboration Tenant Allow Block List Email Spoof Configure

Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-email-spoof-configure.md.

Microsoft Defender daily update for 2 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 1 August 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Get Vulnerability By Id leads 2 Defender updates

31 July 2026 recorded 2 updated Microsoft Defender documentation changes. The most active areas were Office 365, Endpoint.

Endpoint · Endpoint protection Get Vulnerability By Id

Updated Microsoft Defender documentation in defender-endpoint/api/get-vulnerability-by-id.md.

Office 365 · Email and collaboration Tenant Allow Block List About

Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-about.md.

Microsoft Defender daily update for 30 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Action Required: Defer Upgrade to Microsoft Defender for Endpoint on Linux Build 101.26052.0009

29 July 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · Endpoint protection Action Required: Defer Upgrade to Microsoft Defender for Endpoint on Linux Build 101.26052.0009

The upgrade to Microsoft Defender for Endpoint on Linux build 101.26052.0009 for FIPS-enabled RHEL 8 and 9 devices has been paused due to issues. The message is now outdated and can be disregarded. No action is needed if already upgraded without problems.

Email Authentication Arc Configure

28 July 2026 recorded 1 updated Microsoft Defender documentation change. The most active areas were Office 365.

Office 365 · Email and collaboration Email Authentication Arc Configure

Updated Microsoft Defender documentation in defender-office-365/email-authentication-arc-configure.md.

Migrate from Advanced Threat Analytics (ATA) to Microsoft Defender for Identity leads 2 Defender updates

27 July 2026 recorded 1 updated Microsoft Defender documentation changes and 1 relevant Message Center announcement. The most active areas were Identity, Defender XDR.

Identity · Identity protection Migrate from Advanced Threat Analytics (ATA) to Microsoft Defender for Identity

Updated Microsoft Defender documentation in defender-for-identity/migrate-from-ata-overview.md.

Defender XDR · Email and collaboration MDO Encrypted email attachment protection

Microsoft Defender for Office 365 will introduce an opt-in Safe Attachments policy to quarantine emails with password-protected attachments that cannot be scanned. Administrators can control release, users can self-release with passwords, and the feature supports various file types. Rollout begins August 2026 worldwide.

Microsoft Defender daily update for 26 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 25 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Purview | Insider Risk Management triage agent summaries available in Microsoft Defender

24 July 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · General Microsoft Purview | Insider Risk Management triage agent summaries available in Microsoft Defender

Microsoft Purview Insider Risk Management triage agent summaries will appear in Microsoft Defender alerts, providing AI-generated insights to streamline investigations. This feature rolls out from mid-August to December 2026, enabling easier alert review without changing existing configurations. No action is needed if prerequisites are met.

Microsoft Defender daily update for 23 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Zero Hour Auto Purge

22 July 2026 recorded 1 updated Microsoft Defender documentation change. The most active areas were Office 365.

Office 365 · Email and collaboration Zero Hour Auto Purge

Updated Microsoft Defender documentation in defender-office-365/zero-hour-auto-purge.md.

Microsoft Defender daily update for 21 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Integrate Qualys data connector in Microsoft Security Exposure Management leads 290 Defender updates

20 July 2026 recorded 11 new, 267 updated, 12 removed Microsoft Defender documentation changes. The most active areas were Endpoint, Office 365, Sentinel.

Exposure Management · Developer and API Integrate Qualys data connector in Microsoft Security Exposure Management

Updated Microsoft Defender documentation in exposure-management/Qualys-data-connector.md.

Endpoint · Incidents and response Use Microsoft Defender for Endpoint sensitivity labels to protect your data and prioritize security incident response

Updated Microsoft Defender documentation in defender-endpoint/information-protection-investigation.md.

Defender XDR · General AI agent posture risk in Microsoft Defender (Preview)

Added Microsoft Defender documentation in defender-xdr/security-for-ai/ai-agent-risk-assessment.md.

Office 365 · Email and collaboration Get Started with Defense In-Depth Configuration for Email Security

Updated Microsoft Defender documentation in defender-office-365/step-by-step-guides/defense-in-depth-guide.md.

Business · Endpoint protection Assign security roles and permissions in Microsoft Defender for Business

Updated Microsoft Defender documentation in defender-business/mdb-roles-permissions.md.

Microsoft Defender daily update for 19 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 18 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 17 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Create Custom Rbac Roles

16 July 2026 recorded 1 updated Microsoft Defender documentation change. The most active areas were Defender XDR.

Defender XDR · General Create Custom Rbac Roles

Updated Microsoft Defender documentation in defender-xdr/create-custom-rbac-roles.md.

Codename MDASH Overview leads 86 Defender updates

15 July 2026 recorded 18 new, 68 updated Microsoft Defender documentation changes. The most active areas were Endpoint, Exposure Management, Office 365.

Exposure Management · Vulnerabilities and exposure Codename MDASH Overview

Added Microsoft Defender documentation in exposure-management/ai-code-security-overview.md.

Defender for Cloud · Cloud and workloads Review and remediate SQL vulnerability assessment findings

Updated Microsoft Defender documentation in defender-for-cloud/sql-azure-vulnerability-assessment-find.md.

Office 365 · Email and collaboration Optimize and correct threat policies with configuration analyzer

Updated Microsoft Defender documentation in defender-office-365/step-by-step-guides/optimize-and-correct-security-policies-with-configuration-analyzer.md.

Vulnerability Management · General Fixed Reported Inaccuracies

Updated Microsoft Defender documentation in defender-vulnerability-management/fixed-reported-inaccuracies.md.

Identity · Identity protection Migrate from sensor v2.x to sensor v3.x

Updated Microsoft Defender documentation in defender-for-identity/deploy/migrate-to-sensor-v3.md.

Microsoft Defender daily update for 14 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 13 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 12 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Microsoft Defender daily update for 11 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.

Develop Microsoft Sentinel Advanced Security Information Model (ASIM) parsers leads 744 Defender updates

10 July 2026 recorded 47 new, 650 updated, 47 removed Microsoft Defender documentation changes. The most active areas were Defender XDR, Sentinel, Office 365.

Sentinel · Cloud and workloads Develop Microsoft Sentinel Advanced Security Information Model (ASIM) parsers

Added Microsoft Defender documentation in sentinel/normalization-develop-parsers.md.

Exposure Management · Developer and API Integrate the Armis OT data connector in Microsoft Security Exposure Management

Added Microsoft Defender documentation in exposure-management/armis-data-connector.md.

Unified SecOps · Incidents and response Migrate Microsoft Sentinel incident creation rules to alert grouping in Microsoft Defender

Added Microsoft Defender documentation in unified-secops-platform/migrate-sentinel-incident-creation-rules-alert-grouping.md.

Defender XDR · Incidents and response Accessing incident notifications and DENs using Graph security API

Added Microsoft Defender documentation in defender-xdr/defender-experts/defender-experts-hunting-graph-api.md.

Defender for Cloud · Cloud and workloads Manage Security Incidents

Updated Microsoft Defender documentation in defender-for-cloud/incidents.md.

Microsoft Defender for Office 365: Prompt injection protection for email

9 July 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · Email and collaboration Microsoft Defender for Office 365: Prompt injection protection for email

Microsoft Defender for Office 365 introduces prompt injection protection to detect and block malicious email content targeting AI assistants. High confidence threats are auto-quarantined. Available to Plan 2 and Microsoft 365 E5 users, enabled by default from early July 2026. No action required; review workflows and inform teams.

Run Analyzer Linux leads 2 Defender updates

8 July 2026 recorded 2 updated Microsoft Defender documentation changes. The most active areas were Endpoint, Office 365.

Endpoint · Endpoint protection Run Analyzer Linux

Updated Microsoft Defender documentation in defender-endpoint/run-analyzer-linux.md.

Office 365 · Email and collaboration Quarantine Shared Mailbox Messages

Updated Microsoft Defender documentation in defender-office-365/quarantine-shared-mailbox-messages.md.

Upcoming change to Microsoft Defender for Endpoint Advanced Hunting: removal of SMB signature data

7 July 2026 recorded 1 tracked Microsoft Defender documentation change and 1 relevant Message Center announcement. The most active areas were Defender XDR.

Defender XDR · Hunting and detection Upcoming change to Microsoft Defender for Endpoint Advanced Hunting: removal of SMB signature data

Starting July 13, 2026, Microsoft Defender for Endpoint will remove SMB signature inspection events from Advanced Hunting to improve performance. Queries using these events will stop working; users should update them to filter SMB traffic by port 445 in DeviceNetworkEvents before July 1, 2026.

Advanced Hunting Microsoft Defender leads 7 Defender updates

6 July 2026 recorded 7 updated Microsoft Defender documentation changes. The most active areas were Endpoint, Business, Defender XDR.

Defender XDR · Hunting and detection Advanced Hunting Microsoft Defender

Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-microsoft-defender.md.

Business · Architecture and deployment Mdb Onboard Devices

Updated Microsoft Defender documentation in defender-business/mdb-onboard-devices.md.

Endpoint · Endpoint protection Defender Deployment Tool Windows

Updated Microsoft Defender documentation in defender-endpoint/defender-deployment-tool-windows.md.

Endpoint · Endpoint protection Microsoft Defender Antivirus Ring Deployment Group Policy Network Share

Updated Microsoft Defender documentation in defender-endpoint/microsoft-defender-antivirus-ring-deployment-group-policy-network-share.md.

Office 365 · Email and collaboration Tenant Allow Block List Teams Domains Configure

Updated Microsoft Defender documentation in defender-office-365/tenant-allow-block-list-teams-domains-configure.md.

Microsoft Defender daily update for 5 July 2026

No substantive Microsoft Defender documentation changes were detected for this report.