Daily Defender News
A cross-product view of Microsoft Defender changes related to Endpoint protection.
The Windows Defender Antivirus documentation now lists `DefenderSessionHelper.exe` in the Details tab for Microsoft Defender Clipboard Protection, with Processes and Services marked N/A. The page date and reviewer metadata were also updated.
The macOS 101.26082.0012 release adds EDR support for configuring AI agent runtime protection, plus Bluetooth permission and antivirus health reporting improvements, accessibility updates, reliability fixes, and performance fixes.
The documentation now covers Windows, Linux client and server, macOS, Android, and iOS offboarding. It also distinguishes subscription-wide Azure server offboarding from manual individual-server offboarding and clarifies that offboarding does not uninstall software.
The Defender for Endpoint What's New page now lists macOS release version 20.126082.12.0 as GA and links to its enhancements and features.
The page now links new deployments to server onboarding guidance and on-premises server connections to Defender for Servers, including automatic or manual deployment options and onboarding verification.
The documentation now lists Linux release 101.26091.0003, including updated release, engine, and signature versions. It also documents a libcurl 8.22.0 upgrade addressing CVE-2026-9546 and stronger quarantine authorization and path protections.
The article now distinguishes automatic Azure offboarding, Defender for Servers coverage changes, manual endpoint offboarding, and endpoint software removal. It adds preparation steps, verification guidance, package-handling details, and method-specific procedures for Linux and Windows.
The documentation now clarifies that the mobile threat defense connector is the Defender for Endpoint–Intune integration, separates assignment steps, and refers to the automatic-launch control as a switch.
The page now lists supported Defender configuration areas, clarifies the onboarding and Managed Google Play prerequisites, and updates the Intune policy creation link and wording.
The page revises privacy wording, terminology, punctuation, and descriptions of collected data. The required-data list no longer includes basic browser information.
The page now describes the refreshed Android interface, including dashboards, feature tiles, alert cards, and the Device Protection feature card. It also clarifies the separate feedback and log-submission flows and updates screenshot descriptions, wording, and formatting.
The documentation adds Platform 4.18.26090.9, Engine 1.1.26090.9, and security intelligence 1.461.1.0 release details, including automatic protection-engine refresh, improved update reliability, ASR path handling, and policy-exclusion retention.
The article title, metadata links, and wording were updated. Examples of fileless-malware techniques were rephrased, and the PowerShell guidance paragraph was removed.
The page updates headings, links, portal navigation wording, and instructions for connecting Defender for Endpoint to Intune and creating Android app protection policies.
The Client Analyzer feedback page now uses direct links to the Microsoft Defender portal and centralized feedback platform, with minor title and wording updates.
The page title and description were refined, screenshot captions now describe each image, and wording and punctuation were clarified throughout the report guidance.
The page received wording, formatting, and accessibility edits. It clarifies when automated investigation and remediation can start, links to its overview, refines alert-severity descriptions, and updates the screenshot text.
The October 2026 entry replaces the previous Preview listing for vulnerability assessment of applications installed via the Microsoft Store, including Microsoft Teams.
The page updates capitalization, expands MSSP to “Managed Security Service Provider,” refines wording, and adds metadata links. The tenant-specific portal URL and access instructions remain documented.
The article received clearer wording, standardized terminology and formatting, revised examples, and updated link text.
The page title and description were refined, and explanations of real-time protection, hybrid detection, cloud protection, and detection engines were reworded for clarity. The description now highlights client and cloud engines, machine learning, and behavior monitoring.
The page updates heading capitalization, formats navigation paths and code blocks, and restructures the supported operating systems section for clearer presentation.
The page title was capitalized consistently, explanatory text was split for readability, and the two inspection approaches—Agent-native event inspection and Network inspection—are now named explicitly.
The page title capitalization changed, its description now covers viewing, organizing, and managing alerts and investigating threats involving devices, files, and users, and its metadata links were updated.
The page was updated with revised metadata, clearer On/Off selection steps, an endpoint screenshot, and added guidance explaining that scoped device group correlation can produce separate incidents for Global SOC users.
The page received capitalization and wording edits, revised onboarding guidance for local scripts and Intune, an updated Intune enrollment link, and clearer Microsoft 365 Lighthouse wording.
The guide was revised for capitalization, grammar, image description, list and link formatting, and clearer references to Microsoft Intune.
The article title and headings were updated, browser enforcement wording was clarified, setup examples and policy instructions were streamlined, and two ontology links were added.
The article refreshes terminology, links, permission formatting, navigation instructions, and screenshots for submitting files and file hashes through the Defender portal.
The article’s title, descriptions, navigation steps, severity explanations, and attack-disruption text were revised. The incident screenshot can now be opened in a lightbox.
The article’s title, wording, formatting, and links were revised. Guidance on next-generation protection, firewall policies, controlled folder access, and attack surface reduction was reorganized and simplified.
The page title capitalization was standardized, the “Weaknesses” description was simplified, and the Vulnerability Management link was reformatted.
The page title and description were updated, the description now covers product updates and feature-availability changes, and several release-note entries and links were reworded.
The documentation now clarifies that the DeviceTagging registry key supports only one tag in the Group value. Tags assigned through other methods aren't written there, so the registry value may not show all tags on a device.
The documentation now lists onboarding, security reporting, and iOS TVM as Mobile TVM service uses. It also warns that restrictive Conditional Access policies can disrupt these flows and recommends excluding the service from those policies.
The article now lists firewall and proxy URLs needed to onboard and maintain Microsoft Defender for Endpoint devices on Android and iOS, covering commercial and US Government cloud environments.
The article now uses broader descriptions of inspection points, streamlines explanations of agent-native and network inspection, updates discovery terminology, and removes the explicit event-point list and vendor links.
The documentation states that Defender surfaces supported AI agents and MCP servers after observing activity on onboarded devices. An installed agent may not appear until it becomes active; the guidance also adds comparing query results with the discovery support matrix.
The documentation now states that Defender lists a local AI agent after observing activity on an onboarded device; installation alone does not guarantee discovery. It also clarifies that the inventory is not a complete software inventory and references the support matrix for coverage details.
A new Learn article documents supported local AI agents, MCP server discovery, and runtime protection scenarios, with support listed separately by operating system and configuration. It also explains that discovery depends on observed agent activity.
The release page now lists Android version 1.0.9330.0101, released September 30, 2026, with performance improvements and general bug fixes.
The documentation explains that disabling Defender for Servers automatically offboards eligible servers. It also describes exclusions, processing times, verification, retry behavior, and what happens when the plan is re-enabled.
The page now describes bringing Defender for Endpoint and Defender for Servers together in the Microsoft Defender portal for Azure and on-premises servers. It covers server asset views, investigations, hunting, RBAC, and device groups.
The page received updated internal links, title capitalization, wording, punctuation, and terminology. A navigation section was removed, while the role-assignment instructions remain focused on the Microsoft 365 and Entra admin centers.
The page title and headings were capitalized consistently, and periods were added to two troubleshooting list items and their linked reference.
The page title and description were updated, wording and link formatting were refined, and the Related resources section was removed.
The guide has revised wording and capitalization, linked portal references, punctuation, and formatting for the Intune enrollment option.
The Linux deployment article now explains how to embed the tenant-specific onboarding file in a golden image, keep `mdatp` stopped during image creation, and start Defender on clones only after their final hostname is set. It also adds onboarding and health verification steps.
The Defender Endpoint What's New entry now links to the preview-specific Microsoft Store applications section.
The page now states that administrators can add a user and purchase additional licenses, with a link to related Microsoft 365 guidance. Titles, punctuation, and image description text were also updated.
The page title and description were updated, and wording throughout the article was revised for clarity, including role guidance and steps for reviewing incidents and releasing contained devices.
The page updates its title and wording, simplifies the introduction and license-review step, and links directly to the Microsoft Defender portal.
The article was revised with clearer descriptions of device groups, updated terminology, and refreshed create/edit policy instructions and formatting.
The article updates wording, image text, punctuation, and navigation links, including direct links to the Microsoft 365 admin center and Purchase services page. Placeholder direct URLs for the Devices page were removed.
The page updates portal links, changes “details flyout” to “details pane,” improves punctuation and phrasing, and revises antivirus mode descriptions and terminology.
The article updates wording, links, step references, and portal terminology such as “flyout pane.” Instructions continue to cover firewall policies, custom rules, profiles, and the 150-rule limit.
The overview now has revised introductory and capability descriptions, clearer image text, corrected grammar, and improved table and footnote formatting.
The page now frames prerequisites around subscriptions, user accounts, browsers, and client operating systems, with clearer wording and links for accounts, permissions, operating systems, Microsoft Entra ID, and Conditional Access.
The page now presents Microsoft 365 Lighthouse guidance for CSPs and MSPs, links directly to the Lighthouse portal, updates the screenshot text, and removes the separate “Learn more” section and links.
The documentation now covers centrally scheduled Linux antivirus scans through managed JSON and Defender Portal policies, expanded detection of critical Node.js, Python, and Java libraries, a libcurl 8.20.0 security update, and Windows Antivirus August 2026-2 details and fixes.
The FAQ title capitalization, sentence punctuation, and wording were updated, including a change from “via” to “by.”
Updated capitalization, wording, links, punctuation, footnote formatting, and troubleshooting instructions on the Defender for Business mobile threat defense page.
The article now uses clearer wording for device replacement and retirement, inactive-device status, data retention, and exposure-score treatment. It also standardizes platform labels, portal links, and package and script instructions.
The page now uses formatted links and more concise, consistent wording throughout its report descriptions and instructions.
The page title, description, and several guidance phrases were revised, including wording about videos, customer portal access, and Defender for Endpoint API integrations.
The page title was capitalized consistently, “Microsoft Defender portal” was shortened to “Defender portal,” and “flyout” was clarified as “flyout pane.”
The article’s title capitalization, punctuation, portal references, and settings-table wording were updated. Microsoft Defender portal references are now clickable links.
The article now clarifies when to use the Defender portal or Intune admin center, adds links to both portals, and improves wording, formatting, and policy-setting descriptions.
The article received clearer wording, corrected action-list formatting, updated Action Center links, and two related-concepts links.
The documented device requirement now includes Windows Server 2022 and Windows Server 2025. The local exclusion guidance also clarifies that local administrator-defined antivirus exclusions are not honored by default and can be enabled through Defender or Intune policy.
The page title and wording were updated, the introductory “What to do” section was removed, and guidance for alert, vulnerability, and user-assignment rules was simplified.
The article title, description, wording, image text, lists, and portal links were updated. Guidance on reviewing and editing policies in the Defender portal or Intune remains central.
The documentation now more clearly explains policy priority, how to change the order of custom policies, and that only the highest-priority applicable policy is applied.
The page updates portal capitalization, links the first portal reference directly to security.microsoft.com, and clarifies wording and punctuation in navigation descriptions.
The page title, description, headings, tables, and references now use “Configuration protection” instead of “Controlled configuration.” The documented enforcement behavior and rules were correspondingly renamed.
The documented installer changes to version 2.26.921.1. The page also expands guidance for identifying Windows hosts, classic WSL devices, and WSL container devices in the Defender portal, and updates the screenshot and setup instructions.
The documentation now lists support for WSL containers (WSLc), extending Defender for Endpoint protection to WSLc workloads and providing visibility into their activity.
Cloned Linux virtual machines are now correctly identified as unique Defender for Endpoint devices. SIGILL crashes on processors without SSE4.1 support were fixed, along with general reliability improvements.
Support for Microsoft Defender for Endpoint on Amazon Linux 2 (ARM64) will retire on October 31, 2026. After this date, no updates or support will be provided. Organizations must identify affected devices, prevent upgrades beyond version 101.25122.0004, and migrate to a supported Linux distribution before the deadline.
Microsoft Defender for Endpoint on Linux now requires allowlisting new service URLs specific to tenant types for delivering internal configuration updates, feature rollouts, and critical issue mitigations. This update is available worldwide, with no change to user experience, and ensures devices receive the latest features and optimizations.
The superscript asterisk was removed from the `nfs4` entry in the Linux preferences documentation.
The filesystem entries on the Linux prerequisites page were redistributed between the two table columns; the listed entries remain unchanged.
The article now provides workflows for identifying detection sources, classifying and suppressing alerts, reviewing remediation, configuring exclusions, submitting files, and investigating suspected false negatives. Definitions, response guidance, links, and metadata were also updated.
The page now emphasizes identifying the capability causing unwanted behavior and uses clearer links for viewing ASR detections and configuring exclusions. Documentation metadata was also updated.
The documentation now links the “industry-best” detection and blocking statement to the Defender XDR top-scoring industry tests page.
The AMSI on Microsoft Defender Antivirus article now points to the updated App Control for Business and AppLocker overview path.
The new documentation explains how Intune can assign Microsoft Defender for Endpoint as the Android Enterprise Mobile Threat Defense application. The role helps block force-stop and app-data clearing, and automatically exempts Defender from battery optimization on Android 14 and later. It lists prerequisites and supports COBO and COPE enrollment scenarios.
The Android documentation now links to the specific Network protection configuration section when explaining where related events can be viewed.
The Android privacy documentation now links to a revised Microsoft Defender for Endpoint privacy article for Android and iOS.
The page now lists licensing, onboarding, and portal-permission prerequisites. It also updates queries for identifying unmanaged devices, their discovering onboarded devices, and recent network connections.
The article now states that basic permissions are for existing Defender for Endpoint customers, with full access assigned through Security Administrator and read-only access through Security Reader. It also adds Microsoft Graph PowerShell role and delegated-permission prerequisites and notes that new customers use unified RBAC.
The page now uses updated Microsoft Support URLs for the Windows 10 KB4493441 and KB4493464 references and a local link for PUA protection.
The table entry describing the No automated response (no automation) level was revised.
The article now explains real-time detection, dynamic analysis, response and remediation, and identifies Antimalware and Network protection features that depend on behavior monitoring. It also updates configuration-tool guidance and adds verification and performance-troubleshooting context.
The page was updated with synchronization and formatting changes while retaining the existing guidance on cloud analysis, sample-submission options, and data handling.
The investigation package guidance now links to the collection instructions using the relative `respond-machine-alerts.md` path and anchor.
The article now lists key advanced features, adds clearer enable/disable instructions, and refines guidance for EDR in block mode, file blocking, and duplicate device records. Metadata was also updated.
The documentation now says users need at least Alerts (manage) permission in the Defender portal before beginning. It also simplifies scan performance guidance and clarifies passive-mode wording.
The article now includes an mdatp_managed.json example and expanded CLI examples for adding and removing extension, file, folder, and process exclusions. It also clarifies the difference between antivirus (epp) and global exclusions, including their EDR impact.
The page updates metadata and wording, removes the mitigation decision table and post-exclusion performance comparison guidance, and clarifies EICAR testing and threat allow-list commands.
The article now links to the current Defender for Endpoint overview, uses clearer wording for remediated threats, and introduces the steps for configuring device groups and automation levels in the Defender portal.
The article now explains how block at first sight works, lists its required conditions—cloud protection, automatic sample submission, and current Defender updates—and documents coverage for downloaded executable and nonportable files. It also adds Configuration Manager to the supported management tools and includes updated links and visuals.
The article now explicitly describes enabling Conditional Access for Microsoft Defender for Endpoint with Microsoft Intune and Microsoft Entra ID, and refers to the Microsoft Defender for Endpoint compliance policy evaluation integration. The page date and authoring metadata were also updated.
The page updates wording for customizing standard discovery and monitoring networks, and adds a direct link to the Monitored networks section for the advanced hunting query.
The article now lists both required Group Policy settings by name, identifies the WinHTTP proxy command’s scope, and explains that resetting it removes the proxy and returns to direct connectivity.
Administrators can use Intune app configuration policies and the `DefenderPreview` key to enable preview functionality in the production Microsoft Defender mobile app for selected Android and iOS users.
The Central Store for Group Policy Administrative Templates link now points to the Microsoft Learn troubleshooting page.
The network protection prerequisite now links to a different support article for obtaining the antimalware platform update.
The article now states that Group Policy is the only supported method for configuring local override policies. It clarifies the configuration steps, supported tools for users, and local-versus-global exclusion list merge behavior.
The page now focuses on configuring always-on protection, identifies supported management tools, adds Intune and Configuration Manager prerequisites, and updates the Intune procedure and links.
The article now clarifies the 10-second default, 50-second extension limit, required prerequisites, Windows Server notes, and the Microsoft Intune Antivirus policy configuration path.
The article now provides clearer GPMC navigation, updated links, the full policy path, guidance for older Windows policy names, and instructions for configuring the setting locally with Local Group Policy Editor.
The documentation now provides separate Group Policy and Intune configurations for running a quick scan after a VM misses two consecutive scheduled scans, and notes that catch-up scans use additional CPU.
The article now links to newer Windows 10 and Windows 11 Group Policy reference spreadsheets, provides expanded GPMC navigation and setting-edit steps, and adds guidance for Local Group Policy and legacy policy names.
The documentation now describes creating antivirus policies in Intune, adds Windows Server devices managed through Defender for Endpoint security settings management, and notes that Windows 10 support is not guaranteed after October 14, 2025.
The page metadata was updated, and the instructions now more clearly state that enabling Microsoft Defender for Cloud Apps integration allows Defender for Endpoint to use cloud app discovery signals and begin forwarding them immediately.
The guide was retitled and restructured. It now covers protection, privacy, file scanning, device tagging, vulnerability assessment, sign-out controls, custom indicators, and web protection through Microsoft Intune, with updated licensing and platform-limit details.
The documentation now describes scanning documents, archives, and scripts in addition to APKs, with Intune Managed apps configuration steps. It also clarifies support for enrolled and unenrolled devices.
The documentation now explains proxy handling for Linux package managers, distinguishes global settings from command-only settings, and clarifies runtime proxy configuration through the mdatp CLI or managed JSON configuration.
The article now explicitly covers cloud-delivered protection, provides more specific ValidateMapsConnection, MAPS, certificate/TLS, timeout, and proxy/CRL troubleshooting guidance, and updates related links and headings.
