← Previous week
Week in brief

Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR leads 4 Defender updates

Week of 17 August 2026 recorded 4 tracked Microsoft Defender documentation changes and 4 relevant Message Center announcements. The most active areas were Defender XDR.

  • Microsoft Purview introduces AI-generated summaries and categorizations for DLP alerts within Microsoft Defender XDR, aiding security analysts in triage. The Data Security Triage Agent can be deployed from Defender XDR, with management in Purview. Rollout starts April 2026 (preview) and August 2027 (GA). Existing policies remain unchanged.

  • Microsoft Defender Unified RBAC will auto-enable on tenants starting late September 2026, completing by December 2026. It unifies access management across Defender and Sentinel workloads, importing existing roles with a 30-day notification period before activation. Opt-out is available post-activation; other Microsoft permissions remain unchanged.

  • Microsoft Edge will retire support for Windows Information Protection (WIP) and Microsoft Defender Application Guard (MDAG) by late September 2026. Organizations using these on Windows 10 must migrate to Microsoft Purview solutions and Edge's built-in security features, as these capabilities are already removed in Windows 11 version 24H2.

  • Microsoft Defender for Office 365 will localize the default "Mark and notify" email template based on users' Outlook language settings, improving clarity in user-reported message notifications. Rollout starts June 2026 worldwide, completing by September 2026. No action is required; admins may inform users and review settings.

For Defender administrators

Review the linked Microsoft Learn changes that apply to your managed platforms, policies, applications, and rollout plans. The archive preserves the source diff for verification.

This period briefing was assembled from the tracked Microsoft Learn and Message Center changes.

Updates this week

2

Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR

New

Microsoft Purview introduces AI-generated summaries and categorizations for DLP alerts within Microsoft Defender XDR, aiding security analysts in triage. The Data Security Triage Agent can be deployed from Defender XDR, with management in Purview. Rollout starts April 2026 (preview) and August 2027 (GA). Existing policies remain unchanged.

17 August 2026
Message CenterMC1255406 on mc.merill.net ↗Major updatePlan for change
1

Microsoft Edge: Retirement of Windows Information Protection (WIP) and Microsoft Defender Application Guard (MDAG)

New

Microsoft Edge will retire support for Windows Information Protection (WIP) and Microsoft Defender Application Guard (MDAG) by late September 2026. Organizations using these on Windows 10 must migrate to Microsoft Purview solutions and Edge's built-in security features, as these capabilities are already removed in Windows 11 version 24H2.

21 August 2026
Message CenterMC1459132 on mc.merill.net ↗Major updatePlan for change
1

Tenant will be auto-enabled into Microsoft Defender Unified RBAC

New

Microsoft Defender Unified RBAC will auto-enable on tenants starting late September 2026, completing by December 2026. It unifies access management across Defender and Sentinel workloads, importing existing roles with a 30-day notification period before activation. Opt-out is available post-activation; other Microsoft permissions remain unchanged.

19 August 2026
Message CenterMC1457836 on mc.merill.net ↗Major updatePlan for change