The table no longer includes the Preview label or prerelease notice. It adds physical access, removable media, and risky AI usage fields, while removing several URL, email, file-path, workload, and Cloud App Alert fields.

The page now lists Agent 365 agent threat detection as Preview, tooling-server real-time protection as GA, and the Security Copilot Threat Hunting Assistant as GA under its updated name.

The documentation now lists the `RiskScore` and `AssignedRoles` columns, and clarifies that data for Entra managed identities is excluded. The article date was also updated.

The table documentation removes the Preview label and prerelease notice and adds the `PolicyInfo` and `Policies` columns.

Microsoft Defender documentation now includes a tutorial for using Intel explorer to search CVEs, IP addresses, and domains and review related threat intelligence.

The replacement of AADSignInEventsBeta is now scheduled for October 19, 2026, with queries migrated automatically. Custom detections require no changes, and several field definitions and schema fields were updated.

The replacement date for AADSpnSignInEventsBeta moved to October 19, 2026. Queries will migrate automatically, custom detections need no changes, and several fields are now documented.

The article now explains pulling incidents through REST APIs and streaming event data through Azure Event Hubs to supported SIEM platforms. It also clarifies terminology for Splunk CIM mapping and the ArcSight SmartConnector, which replaces the retired FlexConnector.

The capability is deprecated effective September 1, 2026, closed to new enablement, and existing coverage ends at the organization’s next renewal. Microsoft Defender Experts MDR Plan 2 is the stated replacement.

The documentation date and metadata were updated, and descriptions and links for detection, protection, investigation, response, and Copilot metrics were clarified.

The article now uses more specific wording for creating access groups, connected organizations, resource catalogs, access packages, and reviewing access requests. Documentation metadata was also updated.

The documentation now states that real-time protection evaluates tool invocations and responses from Agent 365 agents using Work IQ MCP or customer MCP tools onboarded to Agent 365. The default rule audits activity, while custom rules can block matching actions. It also lists expanded threat-detection examples, including prompt injection, secret leakage, and suspicious IP access.

The page updates references from Microsoft Defender XDR to Microsoft Defender, including the learning path title and pilot-and-deploy guidance.

The page now refers to Microsoft Defender instead of Microsoft Defender XDR in links and labels for the overview, threat analytics, learning paths, and unified RBAC.

The page’s table of contents, section heading, description, and linked article now use “Threat Hunting Assistant” and point to the corresponding assistant documentation.

The documentation now states that Security Delivery Experts are included for services licensed for at least 1,500 seats, replacing the previous 500-device threshold.

The playbook now refers to Microsoft Defender instead of Microsoft Defender XDR when describing consolidated visibility into impacted or at-risk assets, and updates the linked article title accordingly.

The page now describes automatic device isolation for Microsoft Defender for Endpoint-managed end-user workstations and identifies it as in preview. It adds prerequisites, safeguards, exclusion guidance, and clearer Sense Agent and connector setup instructions.

The documentation now labels Copilot Studio agent protection as Preview and describes protection for Foundry agents, covering user requests, agent responses, tool invocations, and tool responses.

The page now clarifies that activating Defender unified RBAC for Email & collaboration imports only actively assigned source roles and role groups. Unassigned built-in roles and groups are not imported, and the permission mapping tables were revised.

The article title, headings, descriptions, and deployment references were updated from Microsoft Defender XDR to Microsoft Defender. Threat intelligence wording and tutorial links were also revised, along with metadata and the publication date.

The scoping guide now documents applying scope tags through Azure Monitor data collection rules (DCRs), including CI/CD workflows. It also updates prerequisites, requires Data Operations (Manage) and Alerts (Manage) for Table Management, and clarifies subscription requirements and rule timing.

The article clarifies resource provider registration, app and service principal creation, client-secret handling, namespace settings, resource ID retrieval, and event hub choices.

The documentation adds Plan 2 prerequisites covering endpoint, email, identity, cloud workload protection, Sentinel ingestion and connectivity, access permissions, 90-day retention, and UEBA. It also updates data storage, retention, deletion, and GCC availability details.

The documentation now explains how to use Copilot in Defender on the Threat analytics, Intel profiles, and Intel explorer pages, including prompts, built-in actions, and saved chat sessions.

The article now provides clearer steps and prerequisites for editing, deleting, and exporting roles. It also highlights that deleting an active workload role removes its assigned user permissions and clarifies export behavior for newer tenants.

The page broadens references from Microsoft Defender XDR to Microsoft Defender, clarifies that audit logs can be searched in the Defender or Purview portals, updates navigation and retention guidance, and removes the PowerShell query example.

The page updates headings, anchors, wording, and tag-color descriptions. It also notes that alert suppression is incompatible with custom detections and recommends fine-tuning them to avoid false positives.

The DeviceInfo table reference now documents the DeviceRoles string column, including JSON-formatted roles, confidence levels, and last-seen times. It also includes minor formatting and wording updates.

The article now explains exclusion policies, adds permission requirements for device and identity exclusions, clarifies policy application and IP exclusion steps, and recommends excluding specific assets rather than opting out entirely.

The documentation now explains the 0–100 reputation score, its Malicious, Suspicious, Neutral, and Unknown ranges, scoring inputs, and infrastructure data sources including passive DNS, port scans, web crawling, and reverse DNS.

The documentation now labels required products explicitly, clarifies that the recommended agent identity is a service principal, and adds more detail on obtaining a Microsoft Graph token, registering the service principal, and verifying it.

The playbook now uses Microsoft Defender branding, updates its date, and revises the ransomware signal table to include Defender for Cloud Apps for email or cloud-app exfiltration and Defender for Endpoint for endpoint file encryption. Related API, Sentinel integration, and queue references were also renamed.

The documentation now states that a built-in alert tuning rule will take effect in early October 2026. In Microsoft Defender XDR, affected DLP signals will appear as behaviors instead of alerts, so they will not generate alerts or enter the incident queue, but will remain available for advanced hunting.

The documentation now consistently refers to the Indicators tab, clarifies that access is available to verified customers, simplifies the verification steps, and updates related-content formatting.

The guidance now explains that administrators can select an existing tag or create a new one, and warns that deleting a dynamic rule removes it and may affect tag or device value assignments. Turning off the rule stops it from applying while retaining it.

The page now uses “Microsoft Defender” instead of “Microsoft Defender XDR” throughout and replaces the automatic response description with a linked explanation of automatic attack disruption, including signal correlation and containment actions.

The FAQ now distinguishes Plan 1 from Plan 2, including Sentinel requirements, supported third-party sources, Sentinel deployment responsibilities, and incident coverage. Plan 2 extends coverage to supported third-party sources but does not manage the customer’s Sentinel deployment.

The page replaces “Microsoft Defender XDR” with “Microsoft Defender” in integration links, feature descriptions, headings, and learning-path text. The documented settings path remains **Settings > Microsoft Defender XDR**.

The documentation now links directly to agent identity, role, feedback, and removal tasks, and presents a warning that removing the agent deletes stored feedback and stops triage of new incidents while retaining incident history.

The page now refers to Microsoft Defender instead of Microsoft Defender XDR across licensing, access, browser, government-customer, integration, and overview references.

The article now includes a clearer introduction, an updated Microsoft Sentinel connector link, revised SOAR terminology, and a KQL query for finding a specific DLP alert by SystemAlertId and correlating it with CloudAppEvents activity.

The documentation now states that unpublished Foundry agents, including playground-only agents, aren't supported for threat detection and links to publishing guidance. It also updates terminology and metadata.

The page refreshes metadata and clarifies permission prerequisites, Defender unified RBAC role terminology, activation instructions, and the relationship between imported roles and their source roles.

The page now links to the Microsoft Defender Action center and clarifies that **Apply to X more instances of the selected quarantined file** is used before selecting **Undo**. The documentation date was also updated.

The page date and wording were refreshed, and the settings section was renamed to “Change automated investigation settings” with an updated anchor and additional learning link.

The documentation now consistently refers to email notifications, clarifies that severity filters can be set for each service or detection source, and refines the instructions for creating rules and opening incidents from notification emails.

The page replaces Microsoft Defender XDR with Microsoft Defender in its descriptions, licensing notes, role guidance, and workload activation instructions. The page date was also updated.

References to Microsoft Defender XDR Unified RBAC were updated to Microsoft Defender Unified RBAC throughout the Secure Score permissions guidance.

The article’s metadata and several passages were updated, including clarification of the SOC Oversight team’s role and streamlined wording for use-case workflow and testing guidance.

The article was updated with a new introductory description and additional explanations for the taskkill.exe process-stop and cipher.exe multi-drive data-deletion queries. The publication date was also updated.

The article was updated with a new date, clearer incident-lifecycle wording, a Microsoft Defender portal access note, expanded KQL terminology, and more precise instructions for exporting an Incident report as a PDF from the Copilot side panel.

The page now explicitly names the Incident correlation default setting and clarifies that individual analytics rules can override it with the `#INC_CORR#` description tag. Microsoft Sentinel Contributor role wording and page metadata were also updated.

The article now uses “Defender” instead of “Defender XDR” in relevant introductory and enterprise IoT text, and adds a named anchor to the section heading.

The article now explains how to explore and act on query results containing Microsoft Sentinel data, including linking results to incidents and taking response actions. It also adds inline inspection guidance and updates wording and formatting.

The documentation now lists alerts from Defender for Endpoint, Office 365, Cloud Apps, Identity, and onboarded Microsoft Sentinel sources. It also clarifies that data availability depends on deployed services and accessible Sentinel workspaces, and recommends joining AlertEvidence with AlertInfo by AlertId for alert metadata.

The documentation now states that AlertInfo can contain Microsoft Sentinel alerts associated with incidents when Sentinel is onboarded to the Defender portal. Data availability depends on deployed Defender services and accessible Sentinel workspaces.

The page date changed from June 15 to July 2, 2026. The “See also” section was renamed “Related content” and given a direct anchor.

The article’s metadata was updated, and the instruction about providing feedback when merging incidents was reworded to emphasize its value for improving alert correlation.

The page metadata was refreshed, the device timeline reference was clarified, and the Copilot feedback image description was updated.

The page metadata was updated, and its guidance now explicitly references threat intelligence, monitoring, and engineering and operations teams.

The FAQ now states that Plan 2 does not cover Microsoft Defender for Cloud workloads. It extends expert coverage to supported third-party, including multicloud, sources ingested through Microsoft Sentinel; the page metadata was also refreshed.

The article now documents selecting GDAP remote tenant groups for a custom role assignment. Members of selected groups inherit the configured permissions, data-source access, and applicable scopes.

The page date changed from June 15, 2026 to August 7, 2026. Links for Defender for Office 365 and Defender for Cloud Apps were updated to new URLs.

The documentation clarifies that custom activity data from Microsoft Sentinel must include a strong identifier combination for the host to be mapped and displayed in the Device Timeline.

The documentation now refers to these capabilities as being in Microsoft Defender instead of Microsoft Defender XDR and uses the complete link for automated investigation and response.

The documentation now says streaming data is available only for columns or fields that are generally available in Microsoft Defender, replacing “Microsoft Defender XDR.”

The documentation now specifies that custom activity data mapped from Sentinel to Microsoft Defender XDR must include either HostName plus NTDomain or HostName plus DnsDomain.

Microsoft Defender XDR will set Microsoft Purview DLP alerts as behaviors by default starting October 12, 2026, reducing alert volume while keeping DLP data accessible in Advanced Hunting and Purview. Administrators can disable this rule to retain DLP alerts in the Defender XDR incident queue.

The documentation now describes Rich insights and Query only modes, with Rich insights as the default. It updates mode-switching steps, notes that modes aren't available on non-primary workspaces, and explains that switching starts a new chat and clears the current conversation. It also documents support for queries spanning multiple tables.

The page now refers to Security Copilot’s Threat Hunting Assistant and explains how to run a generated query, add it to the editor for review, and view its logic. Screenshots, image descriptions, feedback wording, and the page date were also updated.

The documentation now clarifies migration queries from Microsoft Defender for Endpoint, including PowerShell technique filtering, AlertInfo and AlertEvidence joins, and entity filtering. It also updates the Microsoft Defender XDR setup link and publication date.

The documentation now labels AADSignInEventsBeta as deprecated and states that it will be replaced by EntraIdSignInEvents. Queries using the table will be migrated automatically on that date.

The table is now documented as deprecated and will be replaced by EntraIdSpnSignInEvents on October 19, 2026. Queries using it will be migrated automatically.

The page wording was revised to emphasize correct settings across data sources, and section headings now clearly describe enabling Windows advanced security auditing and installing the Defender for Identity sensor. Section anchors and the page date were also updated.

The documentation states that the Defender XDR advanced hunting API is transitioning to the Microsoft Graph security API, with retirement beginning in January 2026.

The Advanced Hunting EmailEvents page updated its ownership metadata and date, and changed the documented column reference for sender, recipient, delivery, threat, authentication, and policy fields.

The page now explains that token creation events initiated by lsass.exe can include access-token privilege context in AdditionalFields. It also refines guidance for investigating authentication activity and privileged logons.

The function returns behaviors whose UEBA insights match up to three entity or contextual filters within the same insight’s About array, using AND logic.

The documentation now covers disabling users and resetting user authentication directly from query results. It also specifies required SID columns and the AccountObjectId parameter for Microsoft Entra identities.

Documentation adds GetAnomalousBehaviorsByValue() for advanced hunting in Microsoft Defender XDR and Microsoft Sentinel in the Defender portal. It finds behaviors whose insights contain an exact entity or context value, with an optional insight-type filter.

The documentation now explains how to use this advanced hunting function to find UEBA behavior insights by entity or context type, optionally filtered by insight type. It includes syntax, parameters, return behavior, and query examples.

The new table documents Microsoft Teams call activity details, including timestamps, call and participant identifiers, activity types, scheduling information, and join links. It is populated by Microsoft Defender for Office 365.

The new reference describes a function that returns behaviors containing a HighVolumeAnomaly insight, which indicates unusually high activity compared with the behavioral baseline. It includes syntax, requirements, and a recent-behaviors query example.

The new reference explains how to invoke GetFirstSeenBehaviors() to return rows containing a FirstSeen insight, with an example using recent Microsoft Sentinel BehaviorInfo data.

The new reference page describes a no-parameter function that filters tabular input for rows containing an UncommonValue insight while preserving all columns. It includes a Microsoft Sentinel BehaviorInfo query example.

The documentation adds support for governance actions on supported SaaS identities returned by CloudAppEvents queries. Queries must include AccountObjectId, InstanceId, ApplicationId, AppInstanceId, and other required fields; unsupported actions or services produce no action.

The article now warns that deleting functions and saved queries is permanent, clarifies guidance for the `adx()`, `arg()`, and `workspace()` operators, updates menu image descriptions, and renames analytics rule section headings.

The page corrects the table name, clarifies that initiating-process signature fields do not describe the created process, and adds a Kusto query that joins DeviceFileCertificateInfo to retrieve signing details.

The documentation updates column names and data types, adds ReportId, TenantId, Type, SourceSystem, and TimeGenerated, and standardizes the table name and field descriptions.

Updated the publication date, clarified wording for the Run query and All filters controls, improved screenshot descriptions, and renamed the Related content section with an anchor.

The article adds stable anchors and clearer “Example chart” headings, refines query descriptions, identifies the newly added filter, and documents when the timeline appears: results must contain more than 40 events and a `Timestamp` or `timeGenerated` column.

The article now includes expanded configuration guidance for streaming Advanced Hunting events to Azure Event Hubs, portal steps for raw data streaming, and a JSON event-payload example. It also updates terminology and schema links.

The documentation now distinguishes 30-day native Defender XDR data retention from Microsoft Sentinel analytics-tier retention. It explains that onboarding a Sentinel workspace and configuring table retention can support longer retention, while streaming to external services remains another option.

The article date and wording were updated, with shorter instructions for running queries, confirming prerequisites, troubleshooting, creating alerts, viewing linked incidents, and filtering manually detected alerts.

The documentation now includes screenshots showing the Ask Defender Experts option on the Defender Experts overview page and in the message center. The page metadata and authoring identifier were also updated.

The page updates its date, clarifies when the EventType filter is available, and improves descriptions of EventType, sample-size, Edit in KQL, and generated KQL screenshots. It also specifies the file-name and SHA256 example when describing narrowed Emails & collaboration queries.

The page date moved to July 2, 2026. Wording now describes query sections as lists or groups, simplifies rename and delete instructions, updates the GitHub contribution link, and directs readers to threat analytics reports in the Defender portal.

The page title, publication date, screenshot descriptions, parameter wording, tabular-parameter text, and the “See also” heading were revised.

The article now covers reviewing, exporting, and customizing query results, including runtime and resource usage information and the Customize columns pane.

The Query history section was reworded for clarity, with an updated date and new section anchor. It continues to describe rerunning past queries, retaining up to 30 queries from the last 28 days, and using or editing queries.

The prerequisites now document storage locations for hunting, reporting, and operational data; retention of up to 90 days after subscription expiry and deletion within 30 days after termination; and availability for eligible GCC customers through Defender Experts Hunting for Gov.

The article now explicitly covers viewing, editing, running, enabling, disabling, and deleting custom detection rules, along with reviewing triggered alerts and response actions. Headings, an anchor, and the publication date were also updated.

The schema reference now lists CallActivityEvents, corrects the FileMaliciousContentInfo link, and standardizes the GraphAPIAuditEvents name.

The article now includes an updated section heading, refreshed screenshots and image descriptions, clearer guided-tour wording, and a new publication date.

The article now uses clearer terms for the advanced hunting schema and time zone settings, identifies the Get started pane on the Advanced hunting page in the Microsoft Defender portal, and fixes link wording. The article date was updated to July 2, 2026.

The article date was updated, and explanatory text was revised to clarify extracting the account name from recipient email addresses and checking logon activity on a recipient's device after ZAP processing.

The table documentation now describes ImageDigest, Region, and HostName, including their meanings for container image, cluster region, and node hostname data.

The documentation now specifies that `ConfigurationId` is identified within a benchmark and benchmark version, and documents the `ConfigurationBenchmarkVersion` field.

The documentation date changed to July 2, 2026, and the wording now specifies that the associated incident includes the entity.

The explanation now explicitly describes the difference between average daily use and top daily use; the example values remain 75% and 100%. The document date was updated to July 2, 2026.

The Advanced Hunting schema now describes ConfigurationId as identifying a configuration within a specific benchmark and benchmark version.

The documentation now states that a newly created Microsoft Sentinel function in Log Analytics can take up to 20 minutes to appear in advanced hunting.

The supported table list now spells `ABAPAuditLog_CL` correctly, fixing a missing “L.”

The article was rewritten for clarity, explicitly states that Security Copilot access is required, and clarifies that resolving an incident before report generation helps capture all actions. Links, metadata, and descriptions were also updated.

The article now labels supported alert types more clearly, separates prerequisite guidance by alert category, updates RBAC terminology and links, and renames feedback guidance links. It also clarifies that existing Phishing Triage Agent users can enable additional alert types through configuration.

The documentation now refers to Microsoft Defender instead of Microsoft Defender XDR in descriptions of Security Copilot-powered incident summaries and Defender correlation capabilities.

The article now explains MFA fatigue, clarifies query descriptions and alert references, and adds a Kusto query to check whether MFA strong authentication requirements were removed from Microsoft Entra ID accounts.

The page title and description now refer to Microsoft Defender XDR, setup step numbering was corrected, and a warning explains that deleting a notification rule permanently stops its future email notifications.

The page updates wording, metadata, and investigation guidance. Sample queries are now described as covering new connector creation, connector-to-mail-flow correlation, and external domain detection, with added admin logon checks.

The playbook now presents alert-review steps as a numbered sequence, clarifies terminology for the forwarding user and recipient lists, and refines investigation and remediation wording. Metadata and the documentation date were also updated.

The article now notes that some default alert policies contain filters not shown in the Microsoft Defender portal. These filters can affect whether activities match conditions and trigger alerts, and the article provides a PowerShell command to view them.

The article adds a permissions prerequisite, clarifies how to open the move panel and select alerts, and updates wording around feedback and saved moves.

The article now clarifies the Related incident step, adds navigation support, updates the date and metadata, and provides additional incident-management references.

The playbook now more explicitly covers true and false positives, compromised accounts, rules without filters, activity before suspicious rules were created, and related alerts. Metadata and the publication date were also updated.

The page title and headings now explicitly reference Microsoft Defender XDR. An Overview section and an anchor for the available playbooks section were added, and the publication date was updated.

The article’s date was updated, wording was refined, an investigation-steps introduction was added, and references to Advanced hunting and business email compromise were made clearer.

The article updates its date and wording, and adds clearer instructions for the investigation queries. Administrators are told to set the `ip_address` variable, use an eight-hour lookback, and review legacy-protocol indicators, successful sign-ins, and related cloud app activity.

The page adds introductory steps for opening and using Action center, updates the source-details heading and anchor, reformats the remediation-actions link, and refreshes the publication date.

The article now uses clearer terminology for investigating suspicious rule parameters, identifying the IP involved in inbox rule creation, and remediating account compromise. Its metadata and publication date were also updated.

The documentation explains that lastUpdateTime identifies incidents changed after creation. It also states that severity may change when alerts are added or removed, and that the incident resource does not provide severity-change history.

The documentation now states that the incident list defaults to incidents from the last week instead of the last six months. The listed 30-day option was removed.

The overview title, descriptions, headings, and references now use “Microsoft Defender” instead of “Microsoft Defender XDR.”

The article replaces references to Microsoft Defender XDR with Microsoft Defender across headings, descriptions, integration guidance, and the Defender portal link.

The article now uses Microsoft Defender instead of Microsoft Defender XDR in its deployment workflow, headings, integration instructions, and descriptions of signal correlation and Sentinel integration.

The article replaces several references to Microsoft Defender XDR with Microsoft Defender in its introduction, deployment workflow, signal-correlation guidance, management location, and next-step heading.

The article now refers to “Microsoft Defender” instead of “Microsoft Defender XDR” in its introduction, headings, deployment table, signal-sharing description, and next-step section.

The article now describes dedicated Microsoft Defender XDR trial lab or pilot setup, including tenant provisioning and subscription activation. References to the pilot guide and configuration phases were updated to use “Microsoft Defender,” and metadata was refreshed.

The page date and authoring metadata were updated, and descriptions of SOC device monitoring and readiness-assessment guidance were reworded for clarity.

The page now explains coverage task ranking fields, observed-application filtering, and the On-premises identities panel, including sensor onboarding, activation, migration metrics, and related actions. SaaS panel guidance was also updated.

The page now documents connector-dependent remediation actions, including that Confirm safe resets both the identity risk score and Microsoft Entra risk level. It also expands the identity timeline to include sign-ins, audit events, risk signals, Conditional Access evaluations, correlated accounts, and additional data tables.

The template was revised with clearer wording and added guidance for prerequisites, user validation, containment, MFA review, impact assessment, remediation, recovery, and prevention of recurrence.

The article updates its title and terminology, clarifies Okta and Microsoft prerequisites, and specifies that the saved token is used when creating an integration profile in the Defender portal. The prerequisite link text and documentation metadata were also updated.

The page now highlights Defender for Identity data enrichment, advanced hunting for policy changes, and undoing shielding actions. It also clarifies alert investigation steps and refines the example scenario.

The article now refers to required RBAC permissions, expands OData, and documents relative lookback and date-parameter queries for Microsoft Graph alert and incident data. It also updates wording and metadata.

The documentation now refers specifically to user accounts and service principals for Contributor role assignments, clarifies the trusted Microsoft services setting, and adds guidance for interpreting blob event records and querying their schema.

The documentation now explains that incident properties, including severity, may change after creation. Applications should poll `lastUpdateTime` and compare current values with retained values; severity cannot be filtered server-side.

The streaming API documentation now refers to configuring Microsoft Defender, instead of Microsoft Defender XDR, to stream Advanced Hunting events to Azure Event Hubs or Azure storage.

The documentation now says the alerts API works across all Defender products, replacing “all Defender XDR products.” The migration link is unchanged.

Microsoft Secure Score will add four new AI-readiness recommendations for device security in Microsoft Defender for Endpoint, focusing on TPM 2.0, VBS, HVCI, and LAPS. These will help identify and remediate devices lacking key protections, rolling out from early to late September 2026 with no action required to receive them.

The documentation now directs users to check the Threat intelligence section when an emailed threat analytics report is missing from Threat analytics.

The article now explains how to switch to and from the Security Analyst Agent through the More actions menu, notes that switching resets the conversation, adds a Sentinel Log Analytics investigation prompt, and reorganizes report interpretation guidance.

The page now explains that Plan 1 covers Microsoft Defender workloads, while Plan 2 includes Plan 1 and extends expert-led detection, investigation, response, and threat hunting to selected non-Microsoft telemetry collected in Microsoft Sentinel.

The overview now states that Plan 2 extends expert triage and investigation to supported third-party sources ingested through Microsoft Sentinel, in addition to Microsoft Defender workloads.

The Defender XDR documentation now uses updated relative links for Security Copilot threat intelligence guidance and the “Use threat intelligence” page.

The documentation now provides direct navigation and toggle-based steps for deactivating workloads, including confirmation and the resulting **Not Active** status.

The article’s wording and structure were revised to explain container threat investigation, response actions, incident-graph hunting, supported network-plugin checks, permissions, and threat analytics reports. The publication date and authoring metadata were also updated.

Microsoft Defender for Office 365 will introduce prompt injection protection for email, detecting and quarantining malicious content targeting AI assistants. Rolling out from July to October 2026, it affects organizations with Defender Plan 2 or Microsoft 365 E5, enabling automatic high-confidence threat quarantine by default with no required action.

The troubleshooting page now links to prerequisites and clearer Azure portal destinations, corrects the Option 3 wording, and documents required URL parameters. It also warns that removing the application configuration temporarily prevents file submission until consent is restored.

The documentation now covers Windows and macOS, adds agent risk and configuration details, and clarifies licensing: Defender for Endpoint Plan 2 supports discovery and hunting, while risk insights and recommendations require Microsoft 365 E7 or Microsoft Agent 365 with Defender for Endpoint Plan 2.

The article now documents four antivirus enforcement levels, including audit mode (Preview), states that passive is the default, and adds a command to verify the active level. Audit mode requires Defender for Endpoint version 101.26062.0007 or later.

The page now lists Linux memory scanning, WSL container plug-in support, Linux audit modes, Linux offboarding API support, Store application vulnerability assessment, the Linux Deployment Tool, and macOS releases, with Preview or GA status.

The documentation now describes creating antivirus policies in Intune, adds Windows Server devices managed through Defender for Endpoint security settings management, and notes that Windows 10 support is not guaranteed after October 14, 2025.

The guide was retitled and restructured. It now covers protection, privacy, file scanning, device tagging, vulnerability assessment, sign-out controls, custom indicators, and web protection through Microsoft Intune, with updated licensing and platform-limit details.

The page now documents configuration through multiple management methods, default mitigations, audit mode, XML export, and staged testing. It also states that EAF and IAF are deprecated and incompatible with .NET Framework 2.0 and 3.5 applications.

The article was retitled and restructured to cover evaluating Microsoft Defender Antivirus and Windows protection features through endpoint security policies in the Defender portal. It now provides clearer prerequisites, including onboarding and security settings management requirements, and notes that Intune enrollment is not required.

The article now provides updated GPMC navigation, uses “Security Intelligence Updates” terminology, notes older Windows naming, and adds detailed editing steps plus local Group Policy guidance.

The article now covers migrating Windows Server 2012 R2 and 2016 from MMA to the unified Defender for Endpoint solution. It clarifies that manual steps apply to Configuration Manager versions earlier than 2207, while version 2207 and later can automate deployment and upgrades, and it updates prerequisites and download instructions.

The article adds an Overview heading, updates metadata, and revises wording describing device risk, compliance assessments, and policy application.

The article now provides detailed steps for configuring security intelligence update day, interval, and time settings through Group Policy, including current and legacy policy paths and local Group Policy guidance.

The guide adds clearer sections and anchors for migrating Windows 10/11, Windows Server, VDI devices, and deployment methods such as local scripts, Group Policy, Intune, and Configuration Manager.

Starting with release 101.26062.0005, Defender for Endpoint on Linux verifies the antivirus engine signature before loading it. The offlineDefinitionUpdateVerifySig setting is deprecated and no longer has any effect.

The article now states that basic permissions are for existing Defender for Endpoint customers, with full access assigned through Security Administrator and read-only access through Security Reader. It also adds Microsoft Graph PowerShell role and delegated-permission prerequisites and notes that new customers use unified RBAC.

The article refreshes links and updates the Group Policy procedure to use current GPMC navigation and the Microsoft Defender Antivirus > Security Intelligence Updates path. It also documents older policy naming and paths.

The page clarifies per-program registry settings, XML deployment through PowerShell, Group Policy, and MDM, policy-removal behavior, and resetting settings with the Windows Security Baselines XML. It also adds links and mitigation-specific introductory sections.

The documentation now describes scanning documents, archives, and scripts in addition to APKs, with Intune Managed apps configuration steps. It also clarifies support for enrolled and unenrolled devices.

The article now provides updated GPMC navigation for configuring security intelligence updates from Microsoft Update and while on battery power, plus notes for older policy names and local Group Policy configuration.

The article now lists key prerequisites, clarifies the mirror-server and macOS update flows, improves script descriptions and links, and explains how to verify the configured offline update source.

The article adds clearer audit-mode guidance, default mitigation tables, deprecated program-setting details, compatibility notes, configuration instructions, and updated PowerShell examples.

The article updates Windows Security and PowerShell instructions, clarifies the `-System` scope and `-Remove` behavior, and explains that audit-only ACG monitoring logs policy violations without blocking execution.

The article now links to prerequisites and machine-type migration steps, clarifies Defender for Endpoint integration opt-ins, and updates Azure Arc and multicloud connector guidance.

The guide now documents using `CRON_TZ`, verifying Defender cron jobs through `mdatp` log entries, managing jobs with Chef, and common crontab operations. Warnings were added for commands that remove crontab entries.

The page now uses current Microsoft Support links for Windows Update, User Account Control, user accounts, Microsoft account security, and Microsoft Defender.

The documentation now notes up to two hours of policy-enforcement latency, audit-only policies, possible delays during policy or group changes, and risks of blocking the “Uncategorized” category. It also names dashboard cards and updates the SmartScreen link.

The documentation refreshes notification and RBAC descriptions, clarifies portal links, and separates permission prerequisites for editing and deleting rules from the procedure steps.

The documentation introduces controlled configuration as a capability built on tamper protection and notes that the existing tamper protection setting in management experiences is being renamed to controlled configuration.

The article adds clearer GPMC navigation steps, updates the GPMC and Windows Security links, and refreshes its publication date. The note about legacy Windows Defender Antivirus policy names remains included.

The Phase 2 migration page was retitled, its date and metadata were updated, migration diagram labels were clarified, Step 3 was renamed to cover onboarding and protection settings, and a Group Policy link was corrected. Additional anchors and clearer exclusion wording were added.

Updated metadata, reorganized the MMA retirement text, and added a Related content section introducing resources for planning and executing migration to Microsoft Defender for Endpoint.

The documentation states that Device Health deprecation begins in mid-July 2026 and completes by late July 2026. Starting in late July, the Device Health (iOS Update) recommendation card will no longer appear.

The page now clarifies that excluded devices may take up to 10 hours to disappear from vulnerability management data, while restored data may take up to 8 hours to reappear after exclusion stops.

The page adds explicit Windows Security steps for turning tamper protection on or off, corrects a permissions typo, and clarifies the Security intelligence version 1.287.60.0 or later guidance for non-Microsoft security products and enterprise scripts.

Updated links now point to revised Zero Trust, Group Policy, WDAC, and vulnerable driver block-list documentation locations.

The documentation now states that Endpoint security policy management cannot be used on devices with an MMA-delivered sensor. On Windows 7 SP1 and Windows Server 2008 R2 SP1, only Microsoft Defender Antivirus policy is supported.

The article now explains that Phase 1 preparation includes licensing, portal access, network connectivity, and performance baselines before Defender for Endpoint setup and onboarding. The wording and metadata were also updated.

The article now points to updated Windows Defender Application Control and Windows Security app settings URLs, with minor accompanying text synchronization.

The article now lists `*.definitionupdates.microsoft.com` over port 443 as an optional alternate location for Microsoft Defender Antivirus security intelligence updates. The update also refreshes metadata and adds a recent-changes note.

The page now uses updated Microsoft Support, .NET, scan guidance, and Windows Security configuration framework links.

The article was updated with refreshed metadata, a corrected installer-script link, and clearer wording about which non-Microsoft antivirus and System Center Endpoint Protection migration steps the script automates.

The page date and custom metadata were updated, and wording around the Intune security baselines FAQ link was refined.

The article date and authoring metadata were updated, terminology was refined to “tamper-protected security settings,” and the additional-information section heading was shortened.

The page description now points to web protection reports in the Microsoft Defender portal and mentions threat detection metrics and summary views. The Domains section wording and page metadata were also updated.

The article now points to an updated Windows Security Protection History URL and removes the Microsoft Volume Licensing Reference Guide link.

The page now uses repository-relative links for Defender Antivirus compatibility and cloud-delivered protection guidance, and points sample submissions to the Microsoft Security Intelligence submission portal.

The documented `status` example remains `RemediationRequired`; only the documentation line was synchronized.

The contextual exclusions note now uses a different Microsoft Support URL for the Windows Security app.

The Windows Firewall link in the Microsoft Defender Antivirus documentation was changed to a new documentation path. The surrounding guidance remains unchanged.

The migration guide now links Microsoft Defender for Endpoint to the relative `microsoft-defender-endpoint.md` page instead of `/windows/security/threat-protection`.

Administrators can use Intune app configuration policies and the `DefenderPreview` key to enable preview functionality in the production Microsoft Defender mobile app for selected Android and iOS users.

The documentation describes audit mode for Defender for Endpoint on Linux, which detects and alerts on tampering with Defender assets or processes without blocking activity. It applies to eligible Insiders-Slow devices meeting specified agent, connectivity, distribution, and kernel requirements.

The page is now labeled Preview and adds Intune and alert-review permission prerequisites, clarifies PowerShell mode commands, and updates deployment and alert-investigation guidance.

The page title, Windows Server onboarding wording, scan guidance, preview section text, headings, anchors, and related-content label were updated.

The guide now more clearly describes the managed JSON configuration, preview protections, diagnostic-log resources, and the information to submit through the MDSI or Microsoft Defender portal.

The page title no longer includes “preview.” The command-line section gained an anchor, clearer heading, updated metadata, and identifies `mdatp` as the Microsoft Defender for Endpoint command-line tool.

The page now notes that some device versions still require legacy or expanded URL lists and clarifies that specific client executables, including MsSense.exe and MsMpEng.exe, must be permitted.

The page removes the note about the Microsoft Defender 365 Unified RBAC preview and clarifies that Microsoft Entra roles can grant Defender for Endpoint permissions.

The documentation now describes Dynamic Preview Rings, which let admins enable preview features in the production Defender app for selected users. The DefenderPreview setting defaults to 0 and can be set to 1.

The article now provides workflows for identifying detection sources, classifying and suppressing alerts, reviewing remediation, configuring exclusions, submitting files, and investigating suspected false negatives. Definitions, response guidance, links, and metadata were also updated.

The new documentation explains how Intune can assign Microsoft Defender for Endpoint as the Android Enterprise Mobile Threat Defense application. The role helps block force-stop and app-data clearing, and automatically exempts Defender from battery optimization on Android 14 and later. It lists prerequisites and supports COBO and COPE enrollment scenarios.

The article now explains how block at first sight works, lists its required conditions—cloud protection, automatic sample submission, and current Defender updates—and documents coverage for downloaded executable and nonportable files. It also adds Configuration Manager to the supported management tools and includes updated links and visuals.

The page now focuses on configuring always-on protection, identifies supported management tools, adds Intune and Configuration Manager prerequisites, and updates the Intune procedure and links.

The article now clarifies the 10-second default, 50-second extension limit, required prerequisites, Windows Server notes, and the Microsoft Intune Antivirus policy configuration path.

The new article describes cloud-managed Defender Antivirus policy as the authoritative configuration source, overriding Group Policy, scripts, Configuration Manager, and local changes. It lists prerequisites, supported platforms, covered settings, exclusions, and enforcement behavior.

The page now lists July and August 2026 releases for Windows Antivirus, Android, iOS, macOS, and Linux. It also refreshes Windows update-history links and removes the displayed Windows KB links.

The archive metadata date was updated to August 25, 2026. Release tables were reformatted, KB5005292 links were updated, and the “What’s new” heading was adjusted.

The article now documents daily quick-scan states, valid times from 0 to 1380 minutes, the 120-minute default, and a noon example. It also updates weekly scan guidance, supported OS wording, and configuration links.

The article now specifies supported Windows versions, Microsoft Defender Antivirus requirements, Windows Server management options, licensing considerations, and recommends testing audit mode before block mode.

The article now provides more detailed GPMC navigation and setting-editing methods, notes the legacy “Windows Defender Antivirus” path name, and adds local Group Policy Editor guidance.

The article now documents WSL container (WSLc) support, including WSL 2.9.5+, compatible plug-in installation, registration, and HealthCheck validation. It also updates the standard installer details, onboarding path, and prerequisites.

The article now provides clearer steps for app registration, app permissions, OAuth 2.0 client credentials authentication, consent, token retrieval and validation, and authenticated API requests.

The documentation now specifies Windows devices and Microsoft Defender Antivirus platform version 4.18.2106.6 or later, revises the rollout channel descriptions and policy paths, and warns that MDM and Group Policy settings can conflict for Defender settings.

The article now includes an mdatp_managed.json example and expanded CLI examples for adding and removing extension, file, folder, and process exclusions. It also clarifies the difference between antivirus (epp) and global exclusions, including their EDR impact.

The article now states that Group Policy is the only supported method for configuring local override policies. It clarifies the configuration steps, supported tools for users, and local-versus-global exclusion list merge behavior.

The article now explicitly describes enabling Conditional Access for Microsoft Defender for Endpoint with Microsoft Intune and Microsoft Entra ID, and refers to the Microsoft Defender for Endpoint compliance policy evaluation integration. The page date and authoring metadata were also updated.

The Linux-on-SAP guidance was revised, including terminology and supported-distribution wording. The explicit requirement for Microsoft Defender for Endpoint build 101.24082.0004 or later is no longer present.

The article now provides clearer GPMC navigation, separates MAPS configuration steps, adds local Group Policy guidance, and updates the MAPS/cloud-delivered protection note and links.

The article now provides clearer GPMC navigation, updated links, the full policy path, guidance for older Windows policy names, and instructions for configuring the setting locally with Local Group Policy Editor.

The article adds a note that live response may be restricted on high-value assets according to their selective response actions. It also refreshes investigation, live response, package-content, and metadata wording.

The article now explains real-time detection, dynamic analysis, response and remediation, and identifies Antimalware and Network protection features that depend on behavior monitoring. It also updates configuration-tool guidance and adds verification and performance-troubleshooting context.

The article now lists key advanced features, adds clearer enable/disable instructions, and refines guidance for EDR in block mode, file blocking, and duplicate device records. Metadata was also updated.

The article now provides expanded guidance for onboarding, antivirus and EDR settings, notifications, Microsoft AutoUpdate, permissions, system extensions, network extensions, and deployment profiles. It also clarifies GUI and legacy configuration methods, schema usage, and required bundle and socket-filter values.

The article now lists the Intune navigation path, policy type, platform, profile, CFA settings, and Add/Import examples for protected folders and allowed applications.

The article now links to newer Windows 10 and Windows 11 Group Policy reference spreadsheets, provides expanded GPMC navigation and setting-edit steps, and adds guidance for Local Group Policy and legacy policy names.

The article clarifies local VPN behavior, open-network alert changes, privacy controls, jailbreak compliance, sign-out settings, and device tagging. It also separates instructions for enrolled and unenrolled devices and improves section headings and links.

The article now provides clearer guidance for enterprise administrators using JAMF or Intune, including plist structure, scan-exclusion fields, threat actions, device tags, and recommended profiles. Section anchors and metadata were also updated.

The article updates Group Policy Management Console navigation, expands the steps for enabling **Convert warn verdict to block**, adds Local Group Policy Editor guidance, and refreshes supporting links and page metadata.

The article now includes current links, clearer GPMC navigation and editing steps, a note about updating Administrative Templates when the setting is unavailable, legacy policy-path naming guidance, and Local Group Policy instructions.

The article now provides revised GPMC navigation steps, clearer protection-level descriptions, an RSOP caution, and instructions for configuring the setting locally with gpedit.msc.

Background file downloads now use `getfile`; the US Government `library` limit is documented as 5 MB by default, with higher limits available through support. Command guidance and links were also clarified.

The article now explicitly covers cloud-delivered protection, provides more specific ValidateMapsConnection, MAPS, certificate/TLS, timeout, and proxy/CRL troubleshooting guidance, and updates related links and headings.

The article now includes an overview, more explicit PowerShell commands for applying and verifying mitigation policies, and steps for converting EMET XML profiles and applying self-hosted XML settings.

The article now explicitly covers approving system extensions, granting Full Disk Access through Privacy Preferences Policy Control, and configuring network extensions. It also clarifies code requirements and commands for validating and signing configuration profiles.

The article now provides expanded steps for locating and editing the setting in Group Policy Management Console, including the full navigation path and alternative edit methods. It also documents configuring the setting locally with the Local Group Policy Editor.

The article adds examples of calendar invitations, attached emails, nested attachments, QR code phishing, and CAPTCHA-gated phishing, and updates its reference links and wording.

The page now lists licensing, onboarding, and portal-permission prerequisites. It also updates queries for identifying unmanaged devices, their discovering onboarded devices, and recent network connections.

The documentation now uses a local link, updates the URL precedence example, clarifies network protection logging, and restates that policy changes can take up to 48 hours to apply, usually under two hours.

The instructions now explain that the setup script excludes c:\demo from Microsoft Defender Antivirus. They direct users to run the test file from a nonexcluded folder when testing for a CFA block or detection, and clarify where to run and delete copies afterward.

The article now links directly to parameter tables and Intune/Jamf examples, clarifies the sample configurations, and adds clearer guidance for using mdatp commands to configure and list scheduled scans.

The page updates protection-download links, clarifies firmware and rootkit coverage, revises offline-scan instructions, and adds a warning that initiating a scan immediately restarts the endpoint.

Updated section titles, anchors, wording, metadata, and publication date in the Microsoft Configuration Manager deployment guide.

The page was updated with synchronization and formatting changes while retaining the existing guidance on cloud analysis, sample-submission options, and data handling.

The page updates metadata and wording, removes the mitigation decision table and post-exclusion performance comparison guidance, and clarifies EICAR testing and threat allow-list commands.

The guidance now specifies that assigned Microsoft Entra groups must already have RBAC roles. It also clarifies matching conditions and notes that configuration changes may take several hours to propagate.

The article now uses clearer headings and wording for Enrollment Invitations and Prestage Enrollments, and provides more precise steps for installing the CA certificate and MDM profile. Updated anchors and metadata were also added.

The compatibility table now separates Smart App Control from Defender Antivirus state and documents additional combinations, including hybrid mode and revised passive or disabled states with third-party antivirus. The page also updates catch-up quick scan guidance, Smart App Control wording, and Endpoint DLP links.

The article’s wording and section labels were revised. The CDN endpoint row is now labeled Mac instead of Common (Mac/Linux), MMA entries use a relative onboard-server.md link, and the Microsoft 365 unified domains note was removed.

The documentation now says users need at least Alerts (manage) permission in the Defender portal before beginning. It also simplifies scan performance guidance and clarifies passive-mode wording.

The article now explains that custom rules capture endpoint events beyond default telemetry and send them to Microsoft Sentinel. It also adds clearer guidance for querying custom event tables, monitoring performance, editing rules, and enabling or disabling them.

The guidance now explicitly describes block mode, expected verification values, browser test behavior, and cleanup steps on Windows, macOS, and Linux.

The documentation now explains proxy handling for Linux package managers, distinguishes global settings from command-only settings, and clarifies runtime proxy configuration through the mdatp CLI or managed JSON configuration.

The article was retitled and its instructions now explain how to connect Power BI to the Advanced Hunting API and OData API, including what each example query retrieves.

The page adds prerequisite guidance and platform-specific procedures, clarifies the Windows test command and completion message, updates the Linux test-script link text, and refines exclusion guidance.

The article adds guidance for devices that do not fully support streamlined connectivity, describes URL coverage across scenarios, and clarifies that Defender static IP ranges do not replace access to SmartScreen, Windows Update, or certificate-revocation services.

The documentation now provides separate Group Policy and Intune configurations for running a quick scan after a VM misses two consecutive scheduled scans, and notes that catch-up scans use additional CPU.

The Windows deployment-tool page now includes the streamlined connectivity SSL inspection requirement and replaces DefenderDTconfig.txt with MdeConfig.txt/MDEConfig.txt in its instructions. Prerequisite links were also refreshed.

The article clarifies RBAC role and Microsoft Entra ID group terminology, updates the role-assignment reference, and adds guidance for reviewing and managing MSSP access requests in My Access.

The investigation guidance now notes that some response actions may be unavailable or grayed out for high-value assets because permissions are set during onboarding. Firewall audit links were also updated, and the document date was refreshed.

The article now provides revised GPMC navigation steps, uses an updated Microsoft Learn link, and notes that older Windows versions may label the policy as Windows Defender Antivirus.

The documentation now lists three ways to offboard a Linux server, adding the Offboard machine API for automation.

The article now clarifies how to create the notification flow, filter by the `lastSeen` property, prevent duplicate alerts, and apply the one-hour offboarding interval from seven days ago.

The article now explicitly explains creating certificate-based indicators to allow or block signed applications, adds steps from the Settings page, updates the cloud protection link, identifies the Microsoft Defender for Endpoint evaluation pipeline, and expands the IoC wording.

The Defender for Endpoint government documentation updates KB reference URLs for supported Windows versions and Windows Server 2019 entries.

The page now cautions that registry keys are for viewing only and that changing them does not affect whether tamper protection applies to exclusions. It also adds a related-content link.

The article now explicitly names Enable headless UI mode and identifies Allow users to pause scan as unsupported on Windows 10. Related policy-setting references and article metadata were also updated.

The onboarding guidance adds a streamlined-connectivity requirement to bypass inspection for the specified endpoint domain and clarifies proxy and IP-allowlist options.

The documentation warns that the setup script excludes `c:\demo` from Microsoft Defender Antivirus. Testers must copy and run `CFAtool.exe` from a folder that is not excluded so the expected CFA block or detection occurs.

The page now emphasizes identifying the capability causing unwanted behavior and uses clearer links for viewing ASR detections and configuring exclusions. Documentation metadata was also updated.

The article now lists both required Group Policy settings by name, identifies the WinHTTP proxy command’s scope, and explains that resetting it removes the proxy and returns to direct connectivity.

The page updates metadata, clarifies that the Device Health report corresponds to the Device health and compliance dashboard in the Microsoft Defender portal, and adds a See also section.

The instructions now identify the Virus & threat protection screen, file selection dialog, and Accessibility list, and add an anchor to the mdatp health output section. Page metadata was also updated.

The article now includes a prerequisite reminder and clarifies that the sample protection-history output confirms AMSI detected and blocked the test payload. Minor wording and metadata were also updated.

Updated links for broad-channel releases, Endpoint DLP, Windows lifecycle information, installation-image updates, and EDR Sensor updates. The platform-update postponement wording was also revised.

The overview now describes protection against web, network, and app-based threats, notes the separate Android Mobile Threat Defense role, and documents scanning for non-APK files such as documents, archives, and scripts.

The article now explains that the PowerShell test verifies whether a recently onboarded device reports correctly to Defender for Endpoint and that the command simulates a malicious download-and-execute pattern. It also updates the supported operating systems wording and metadata.

The documented response changed from HTTP 200 OK to HTTP 201 Created. Several Windows update links were also updated to current support URLs.

The article now includes an Overview section, clearer setup guidance, an updated Windows support link, and clarifies that the displayed results are from a test scan. Metadata and the publication date were also updated.

The documentation now directs administrators to sign in to Jamf Pro and open the Computers area before configuring device groups. Related wording, link text, and metadata were updated.

The article now links to the current Defender for Endpoint overview, uses clearer wording for remediated threats, and introduces the steps for configuring device groups and automation levels in the Defender portal.

The documentation now uses updated Microsoft Support URLs for KB4515384, KB4537818, KB4537795, and KB4537816 in Windows version and prerequisite references.

The page now identifies the Indicators page path for editing, deleting, and importing indicators, and clarifies the sample CSV location, category formatting, and MITRE technique guidance.

The article now explicitly explains how to turn tamper protection on or off tenant-wide in the Microsoft Defender portal. It also updates the supported operating systems link, renames the considerations section, and refreshes metadata.

The article now explicitly lists the simplified Defender for Endpoint domains, clarifies OneDsCollector URL-level consolidation, and updates links to Azure service tags and the client analyzer.

The documentation now uses revised Microsoft Support URLs for KB references covering Windows Server 2019–2025 and Windows 10/11 versions.

The page now uses WDSI threat-description URLs for five malware entries and updates the Microsoft Defender Offline support link.

The page updates instructions for downloading the Client Analyzer, specifying HardDrivePath, and locating HTTP status code information. It also clarifies that Defender for Endpoint falls back to direct connectivity when the configured telemetry proxy cannot be reached.

The page now uses updated Microsoft Support URLs for the Windows 10 KB4493441 and KB4493464 references and a local link for PUA protection.

The page updates wording for customizing standard discovery and monitoring networks, and adds a direct link to the Monitored networks section for the advanced hunting query.

The guide’s date and custom metadata were updated, and wording for configuring capabilities and running detection tests was revised.

Updated the publication date and authoring metadata, renamed the device discovery link, clarified the Plan 2 wording, and expanded “AH” to “Advanced Hunting.”

The article title and wording were updated, including a more specific description of cloud-based file inspection and the **Content analysis** setting label. Metadata was also refreshed.

The page now reminds administrators to verify environment requirements before configuring gradual rollout and identifies Group Policy, Microsoft Intune, and PowerShell as supported configuration tools. Terminology and metadata were also updated.

The Defender for Endpoint documentation now includes guidance that organizations using Defender for Endpoint on servers may qualify for discounts when also using Microsoft Defender for Servers. The page date was updated.

The page now describes using Microsoft Safety Scanner for manual malware scans and reversing changes made by identified threats. It also updates the SHA-2 requirements, troubleshooting, and malware-removal links.

The article now uses a "Create device groups in Jamf Pro" heading and explains that groups organize macOS devices and target Defender for Endpoint configurations and policies. Metadata was also updated.

The page metadata was updated, and the instructions now more clearly state that enabling Microsoft Defender for Cloud Apps integration allows Defender for Endpoint to use cloud app discovery signals and begin forwarding them immediately.

The article now says to use Event Viewer and filter for Event ID 1125 to review blocked apps, and specifies that the prerequisite guidance applies when malicious sites are not detected. The publication date and custom metadata were also updated.

The exploit protection article now links to a revised EMET guidance page and updated previous-version Windows mitigation documentation.

The article now directs admins to select devices from file and IP address views and delete tags from the device page.

The suppression rules article now includes instructions for viewing a suppression rule’s details. Its publication date and custom metadata were also updated.

The article now links readers to the Library management page and explicitly lists available actions: upload, refresh, view details, view, analyze, download, delete, and filter files. Metadata was also updated.

The setup guide now points to revised Microsoft Learn URLs for Windows Defender Firewall best practices and three Application Control topics.

The page date was updated to August 11, 2026, and navigation entries were added for Linux devices and API-based offboarding.

The article now explicitly states that web threat protection is enabled when network protection or Microsoft Defender SmartScreen is enabled, with direct links to both settings.

The documentation now lists new SHA-256 checksums for the analyzer ZIP files and uses direct `./` command syntax to run the support tools.

The article metadata was refreshed and new introductory text now summarizes web threat protection, web content filtering, custom indicators, browser support, and policy precedence.

The archived Android support entry now links to the Privacy controls overview section instead of the previous anchor.

The ComputerSid description now identifies the Microsoft Entra group object ID as the supported Entra identifier, replacing the broader reference to an Entra object or Object ID.

The documentation now covers just-in-time registration scenarios where Company Portal is not required and notes that the device must be registered. Metadata and the publication date were also updated.

The page now links to updated WDAC, SmartScreen, and Windows Update documentation locations.

The API reference now documents `rbacGroupNames` as `String[]` and `generateAlert` as `Boolean`. The 400 Bad Request description was also clarified.

The alert review page’s introductory text now links to “Investigate alerts in Microsoft Defender for Endpoint.” The page date and custom metadata were also updated.

The data collection analyzer table now uses updated links for MpCmdRun.exe and Endpoint DLP, and the -v entry includes additional troubleshooting examples such as Cloud Protection reporting and Platform Update failures.

The article’s two links to Microsoft Defender SmartScreen documentation now use the updated documentation path.

The article now uses repository-relative links for Microsoft Defender for Endpoint and Next-generation protection guidance.

The host firewall reporting documentation now links the Audit Filtering Platform Packet Drop and Connection references to their previous-versions URLs.

The API documentation now uses revised Microsoft Support URLs for the Windows 10 version 1803 and 1709 prerequisite KB articles.

The page now links to the revised Microsoft Defender Application Guard documentation path and the updated Microsoft Support page about phishing protection.

The documentation updates the Windows client and server version table, including references for Windows 11, Windows 10, and Windows Server 2025 through 2016.

The documentation now links the “industry-best” detection and blocking statement to the Defender XDR top-scoring industry tests page.

The AMSI on Microsoft Defender Antivirus article now points to the updated App Control for Business and AppLocker overview path.

The Android documentation now links to the specific Network protection configuration section when explaining where related events can be viewed.

The Android privacy documentation now links to a revised Microsoft Defender for Endpoint privacy article for Android and iOS.

The table entry describing the No automated response (no automation) level was revised.

The investigation package guidance now links to the collection instructions using the relative `respond-machine-alerts.md` path and anchor.

The Central Store for Group Policy Administrative Templates link now points to the Microsoft Learn troubleshooting page.

The network protection prerequisite now links to a different support article for obtaining the antimalware platform update.

The demonstration app reputation article now links to the updated Microsoft Defender SmartScreen documentation path.

The documentation now links to a different Microsoft Support page for folders that should be excluded when using file-level antivirus protection in SharePoint.

The FAQ now states that Group Policy has no configuration user interface for device control policy groups and rules, but administrators can configure them using the related .admx and .adml files.

The Windows 21H2/SV1 row retains the requirement for build 22000.593 or later, but its Microsoft Update Catalog link now points to KB5011563.

The page’s Microsoft Update Catalog URL changed from a search for “KB4052623 update” to “KB4052623.”

The page removes the offline PDF download reference and revises the PowerShell download description to identify it as a script that enables the guide’s settings.

The Defender for Endpoint iOS privacy page now points to an updated Microsoft Support article covering common privacy questions for Android and iOS mobile devices.

The performance overview now directly links to real-time protection statistics guidance for identifying files and processes that trigger scans.

The guidance now refers to the MDM console’s **Device Management** option instead of **Profiles** when locating configuration profiles.

The documented Set-MpPreference command now uses `$true` instead of `1` for the CheckForSignaturesBeforeRunningScan parameter.

The page now links “Application Control for Windows” to the `/app-control-for-business/appcontrol` documentation path instead of the previous WDAC path.

The documentation now states that the updated “Configure performance mode status” template is available only after installing the Administrative Templates for Windows 11 2024 Update (24H2).

The minimum requirements page now links to the Microsoft Defender Antivirus updates document using a relative link.

The Linux network protection documentation now links to a different Microsoft Defender SmartScreen documentation page while retaining the existing description of blocking outbound HTTP(S) traffic to low-reputation sources.

The network protection for macOS page now links to the updated Microsoft Defender SmartScreen documentation URL.

The Defender documentation now links to the archived Windows Server 2012 R2 and 2012 guidance for creating a Group Policy Object.

The article now links to a different Microsoft Support page for known tech support scam numbers and popular web scams.

The UEFI scanning documentation updated its reference describing how Windows Defender System Guard helps protect against firmware attacks and secure-boot threats.

The unwanted software guidance now links to the updated Microsoft Support URL for troubleshooting unsuccessful threat removal.

The incident queue now displays incidents from the last week by default instead of the last six months, with the newest listed first.

The Geographic data section now links to /compliance/regulatory/offering-ISO-27001 instead of the previous compliance URL.

The commercial device connectivity documentation now notes that, beyond the listed URLs, some environments might also need to allow URLs from the Microsoft 365 unified domains list.

The documentation now notes that access may also be needed for URLs listed under Microsoft 365 Unified Domains, in addition to the URLs in the existing table.

The documentation fixes spelling errors in the descriptions for the minimum-requirement and external-dependency options.

The documentation corrects “memory manger” to “memory manager” and adjusts spacing before an ellipsis in the mitigation description.

The guidance now notes that the issue can occur when automatic attack disruption triggers full isolation. Administrators can define an isolation exclusion rule to use selective isolation instead.

The page heading no longer includes “(preview),” note formatting was updated, and a screenshot showing successful deployment tool events was added.

The documentation now describes onboarding and offboarding Windows 10 and Windows 11 devices with Intune, adds Intune licensing and Endpoint Security Manager prerequisites, updates links, and notes that diagnostic reporting frequency is deprecated in Intune EDR policies.

The documentation now requires completing Phases 1 and 2 first, adds macOS and Linux prerequisites for detection tests, clarifies ForceDefenderPassiveMode usage and commands, and links to troubleshooting if antivirus remains passive after uninstalling a non-Microsoft solution.

The Microsoft Defender Antivirus reporting documentation now points to an updated Security auditing reference URL.

The documentation recommends onboarding servers through Defender for Servers Plan 2, notes automatic Defender for Endpoint extension onboarding for supported Azure and Azure Arc machines, and identifies standalone server licenses as alternatives.

The guide now expands APK terminology, refreshes metadata, and clarifies descriptions for Intune synchronization, the Google Play testing link, and prerelease-version screenshots.

The page adds licensing details for standalone, Microsoft 365 E3, and server deployments, and updates links for Windows Firewall and Application Control documentation.

Several prerequisite links were updated, including links for the February 2018 update rollup, telemetry update, .NET Framework, and Endpoint Protection anti-malware platform update.

The documentation received a minor formatting change with one line removed.

The troubleshooting article now links to a revised Microsoft Support page for resolving Windows Update problems.

The page’s FIPS reference, metadata, registration error text, and sign-in remediation wording were updated.

The documentation now explains that enabling Disable Catchup Full Scan disables catch-up scans after missed scheduled full scans, while disabling it enables them.

The page received updated metadata and date information, and its troubleshooting-mode operation headings were rewritten for clarity.

The troubleshooting page now uses local Markdown links for compatibility, real-time protection, and cloud-delivered protection references.

The Live Response troubleshooting page now links to revised Windows Push Notification Services overview and firewall configuration URLs. The MPNS public IP ranges link was removed.

The troubleshooting article now points to the Engage Center and the new Volume Licensing support page for both cases.

The article no longer includes the entry showing the default ProductAppDataPath and its Windows Defender registry location.

The troubleshooting page corrects the `ProductAppDataPath` registry value from `Microsft` to `Microsoft` in the Windows Defender data path.

The page now details precedence among local settings, Group Policy, MDM, and Configuration Manager, including the MDMWinsOverGP setting and OMA-URI. It also updates Intune navigation and explains per-rule exclusions.

The documentation now warns that the setup script excludes `c:\demo` from Microsoft Defender Antivirus scanning. Administrators must copy ASR test files to a folder not excluded by Defender Antivirus or ASR rules before opening or running them, then delete the copies afterward.

Starting with platform version 4.18.26060, using the Unblock option to override an ASR rule in Warn mode requires administrator approval. Per-ASR rule exclusions should be used for persistent exceptions.

The Attack Surface Reduction overview now uses revised links for Microsoft Defender Application Guard, WDAC, and Windows Firewall documentation.

Three ASR rule entries now use relative links to the cloud-delivered protection documentation.

The page now states that the Defender for Endpoint advanced hunting API is old and limited, and is transitioning to the Microsoft Graph security API, which offers broader data coverage, improved consistency, and better scalability.

The documented supported platforms now include macOS 14 and later and supported Linux distributions, alongside the existing Windows versions. On Windows, the API still stops the sensor without removing registry onboarding information.

The article now describes creating Power Automate flows with the Microsoft Defender for Endpoint connector, including workflows triggered by events or alerts. Wording and metadata were also refreshed.

The documentation now states that after two missed scheduled quick scans, a catch-up scan runs when the device powers on or resumes from sleep or hibernation, rather than when someone signs in.

The page now uses updated report and section names, describes monitoring sensor health, antivirus status, OS platforms, and Windows version trends, and clarifies Current state and filter behavior across all three cards.

The article now clarifies how to enable or disable the eBPF supplementary event provider, verify AuditD rules after reboot, check kernel prerequisites, handle the RHEL 8.1 with SAP warning, and interpret eBPF statistics.

The client analyzer overview now links unexpected Endpoint Data Loss Prevention behavior to the `/purview/endpoint-dlp-learn-about` page instead of the previous `/microsoft-365/compliance/endpoint-dlp-learn-about` path.

The article adds specific steps for configuring Microsoft Defender Antivirus remediation settings through Intune and the Microsoft Defender portal, including policy type, platform, template, and configuration settings.

The stop-and-quarantine-file API documentation now uses a repository-relative link to the Microsoft Defender Antivirus compatibility page.

Three related links now point to updated Microsoft Learn and Microsoft Support URLs for sensitivity labels and DLP conditions.

The documentation now lists Security Operator alongside Global Reader and Security Reader for read-only and preview/download access to quarantined messages. It also documents handling of encrypted Safe Attachments items and clarifies that Get-QuarantineMessage permission properties reflect the executing user.

The documentation improves wording and formatting for Nested app authentication, Integrated apps navigation, app-registration deletion, and FAQ guidance on deprecation, client updates, and add-in removal.

The guide now explicitly covers Microsoft Defender for Office 365 deployments used alongside non-Microsoft email filtering. It adds prerequisites, clarifies built-in protection and Enhanced Filtering guidance, and updates links and operational recommendations.

The article now refers to the SCL=-1 rule as the “bypass spam filtering” mail flow rule throughout Step 3, including pilot-group exceptions and rule conditions. The article date and supporting link text were also updated.

The page now links to the Microsoft Defender for Office 365 overview and getting-started deployment guide.

The page now places the link to “Order and precedence of email protection” under a dedicated Related content heading.

The migration guide’s setup and onboarding navigation entries were synchronized in the documentation.

A footnote was revised for organizations using a non-Microsoft security service or device before Microsoft 365. It references ARC and Enhanced Filtering for Connectors and advises checking service availability.

A new article explains how to use Exchange Online PowerShell to inventory Send As and Send on behalf permissions and map delegated From addresses to outbound spam policies.

The documentation explains that the message’s From address selects the outbound spam policy, while the authenticated user accumulates recipient counts for Send As and Send on behalf messages.

The documentation no longer states that the report is in preview, unavailable to some organizations, and subject to change.

The page now explains automation execution, including schedule eligibility, run creation, technique and payload selection, user assignment, region-aware delivery, and delivery batches. It also documents supported scenarios and limitations, such as one payload per run and no guarantee of maximum randomized runs.

The page date was updated to 08/03/2026, and vendor-specific ARC sealer mappings, header examples, and PowerShell configuration steps for Proofpoint, Mimecast, Barracuda, Sophos, and IIJ were removed.

The documentation changed its wording from “Exchange 2016 and Exchange 2019” to “Exchange 2016 and later” when describing message modifications that can affect DKIM.

The documentation now explains quarantining password-protected attachments that cannot be scanned, including release workflows, just-in-time rescanning, file-type exclusions, password limitations, and advanced hunting.

The documentation now states that bulk messages automatically receive the Promotions tag. Enabling Bulk moves enabled routes bulk mail that would otherwise reach the Inbox to the Promotions folder, and user folder actions inform future message handling. The previous rule that added the Bulk tag is no longer required; transport rules can exclude specific senders or recipients.

The article now explains that users can provide an attachment password for Safe Attachments rescanning. Safe files are released; malicious or unscannable files remain quarantined. It also documents the one-attempt limit, portal-only release flow, and password safety guidance.

The page now explains that SCL no longer determines spam verdicts or final actions in cloud organizations. It directs admins to use header values such as CAT and DIR, while describing SCL uses for mail flow rules and on-premises Exchange.

The page updates headings and submission instructions, formats notes consistently, documents language selection for default automatic notification templates, and adds related links.

The article’s summary label and exploit lists were reformatted, and “may need” was changed to “might need” in the investigation guidance.

The overrides details table was retitled, given a section anchor, reformatted, and updated with revised wording and links, including the SCL -1 mail flow rule explanation.

The page now documents the Block unscanned attachments option, exclusions for specific file types, quarantine policy selection, and the EnableBlockingEncryptedAttachments PowerShell parameter.

The article now describes how ASF settings mark messages as Spam or High confidence spam, clarifies matching .biz and .info URLs, and updates wording for Test mode, sensitive words, and SPF hard fail settings.

The documentation now explains that IP Allow List bypasses and SCL 0 are inputs rather than guaranteed final filtering decisions. It also clarifies how to add IP entries and links to mail flow rule guidance.

The article now clarifies that Safe Senders entries do not determine the final spam verdict and that malware, high-confidence phishing, and other detections take precedence. It also reorganizes prerequisites and refreshes PowerShell formatting and wording.

The page now explains quarantine policies for Safe Attachments scanning and blocked encrypted attachments, documents related PowerShell parameters and default-policy behavior, and clarifies Get-QuarantineMessage permission properties.

The documentation now explains that SCL does not determine spam identification or actions in cloud organizations, and clarifies SFV:SKI, SFV:SKN, and SFV:SKS values and their filtering causes. It also updates bulk-mail and formatting details.

The Teams submission steps were lightly reworded, and the documentation now states that reporting requires users with online Teams mailboxes and an Exchange Online reporting mailbox. On-premises mailboxes aren't supported. A related submissions link was also added.

The guide replaces SCL-based guidance with spam verdict and category values such as SFV:SPM, CAT:SPM, and CAT:HSPM. It also updates BCL examples, remediation steps, and mail-flow rule guidance.

The article updates permission and portal navigation formatting, adds the Teams senders table’s Value column, and renames the closing section to Related content.

The article explains that hosted mailboxes use the blocked mailbox UPN, while nonhosted senders use their sending SMTP address when viewing details or removing a restricted sender.

The documentation now lists three scenarios where the tip isn’t stamped: S/MIME-signed messages, messages delivered after an SCL -1 bypass rule, and messages sent to mailboxes created less than seven days ago.

Updated the landing page article to say built-in templates are localized into more than 12 languages, use “selecting” instead of “clicking” for checkbox actions, and format related links as list items.

The documentation now explains email clustering for SecOps mailboxes and phishing simulations, how Explorer filter exclusions behave, and how pending actions affect remediation status.

The guide now bolds the product area for three roles and adds links to the Microsoft Defender for Office 365 overview and getting-started guide.

The page updates its description of outbound spam handling, records the 2021 history of the Automatic system-controlled forwarding setting, refreshes metadata, and adds links about delegated From addresses and Send As/on behalf permissions.

The guide now states that Defender for Office 365 Plan 2 detects prompt injection content in inbound email, replacing the previous reference to Plans 1 and 2. Examples were reformatted and the article date was updated.

The documentation now includes steps for connecting the Microsoft Defender XDR connector in Microsoft Sentinel to stream Microsoft Defender for Office 365 email event data into a SIEM.

The page now recommends Off for automatic forwarding in Standard and Strict profiles. It also adds guidance for blocking unscanned encrypted attachments, excluded attachment types, and quarantine policy when the Safe Attachments response is Block.

The documentation now states that reporting mailboxes cannot be distribution groups or external/on-premises mailboxes. It also notes that default investigation-result emails are localized to each recipient’s preferred language.

The article now documents `SFV:SKN` as an example for messages where a mail flow rule skips spam filtering, and adds a related-content link. The page date was also updated.

The settings article now links to getting started, phishing simulation, and simulation automation guidance.

The documentation now states that users can manage quarantined messages sent to shared mailboxes without automapping. Access through quarantine notifications requires an enabled quarantine policy, notification access, and Full Access permissions to the shared mailbox.

The documentation now states that default automatic notification templates use each user’s preferred Outlook language and are enabled automatically when automatic notifications are turned on. Custom admin-configured templates are unaffected.

The payload automations article now uses streamlined navigation and deletion instructions and renames a related link to “Reports for Attack simulation training.”

The training campaigns page now links to the getting-started guide and deployment considerations FAQ.

The page date and terminology were updated, “High confidence spam” formatting was standardized, a Mail flow rules in Exchange Online link was added, and one SCL guidance paragraph was commented out.

The article now defines spam and high-confidence spam by the filtering verdict instead of fixed SCL ranges. It also updates the MarkAsSpamBulkMail explanation and publication date.

The page now links to guidance for searching audit log events in Microsoft Defender XDR.

A Related content section now links to the Message Trace FAQ in Exchange Online.

The page now documents that messages quarantined by Safe Attachments policies with unscannable encrypted attachments are retained for 30 days. Admins can release them without a password, while users can provide the password to rescan their own messages.

The article date was updated to July 22, 2026, and a video was added covering how users report suspicious email, attachments, and Teams messages to Microsoft.

The documentation now states that Advanced Delivery applies only when simulation messages traverse the transport pipeline. Direct Injection messages bypass the pipeline and are not covered by the policy.

The login pages documentation now labels the phishing simulation link “Simulate a phishing attack with Attack simulation training.” The linked page remains the same.

The campaigns documentation now explains that `SFV:SKS` means a message was marked as spam before spam filtering, either by an Exchange mail flow rule that set the SCL or by a spam decision from on-premises Exchange in a hybrid environment.

The article date was updated and now links to instructions for using mail flow rules to bypass spam filtering, while directing administrators to use the documented conditions and actions to safely allow senders.

The documentation now states that automatic “Mark as and notify” emails using the default template are localized according to users’ Outlook language settings. Admin-configured custom templates are unaffected.

The FAQ now explains that delivery uses each recipient’s mailbox time zone with “not before” logic. Recipients receive simulations at the scheduled local time and never earlier.

The “Completed | Spam” definition now says similar items are more likely to be identified by spam filtering and handled according to anti-spam policies, replacing the previous SCL-threshold blocking wording.

The documentation now states that tenant allow/block list entries apply to messages from both internal and external senders, with special handling for internal spoofing scenarios.

The documentation link label changed from “Microsoft Defender for Office 365” to “Microsoft Defender for Office 365 overview”; the linked page is unchanged.

The article corrects punctuation in the example about routing email through a non-Microsoft protection service before delivery to Microsoft 365.

The App Guard for Office installation guide now uses an updated Microsoft Support URL for verifying that KB4571756 is installed.

The documentation now states that messages pass through anti-spam and anti-phishing filtering, removing the broader “content filtering” wording.

The outbound spam protection documentation now links to guidance explaining how outbound spam policy limits apply to Send As and Send on behalf permissions.

The documentation now states more clearly that campaign-based remediation can affect messages older than 48 hours, typically within a few hours to a few days after delivery.

The compromised email account article no longer includes the sentence introducing related guidance resources.

The article now uses “spam filtering” and “spam verdict” terminology instead of focusing on SCL overrides. Its guidance and table clarify the effects and limitations of mail flow rules, IP Allow List entries, and Outlook Safe Senders, including the on-premises SCL context.

The article was retitled and updated with 5.7.520 troubleshooting keywords. It clarifies the history and current behavior of Automatic - System-controlled forwarding and revises the policy-outcome table.

The NDR 5.1.8 reference link was updated, and links were added for Send As and Send on behalf limits and delegated From address inventory.

The migration document updates terminology, anchors, and metadata. It now identifies the SCL -1 mail flow rule as the bypass spam filtering mail flow rule while retaining the instruction to turn it off without deleting it.

The article removed the “Additional threat hunting and response capabilities” heading, its introductory text, and its anchor, replacing them with a “Related content” heading.

The Microsoft Entra permissions description was clarified, and a Related content link was added for managing incidents and alerts in Microsoft Defender XDR.

The page adds assessments for privileged external or guest accounts, WriteDACL permissions on sensitive groups, and highly privileged service accounts. It also updates anchors and removes “(Preview)” from several existing assessment headings.

The documentation now covers eligible domain controllers and non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers. Activation on the latter servers is in preview and currently requires manual activation; automatic activation and migration aren't supported.

Documentation now describes a Security recommendations (Preview) view for scoped users on domain pages. Users can access it from the Identity dashboard and review recommendation names, statuses, update times, details, and remediation guidance.

The article now describes connecting SailPoint Identity Security Cloud through the Defender portal API connector, updates role-based access terminology, and instructs administrators to create a dedicated SailPoint user before generating a personal access token.

The article date and metadata were updated, an explicit dashboard heading was added, and the risky lateral movement path table entry was synchronized.

The documentation now describes Microsoft Defender for Identity assessments for Okta, CyberArk Identity, and SailPoint Identity Security Cloud, including connection prerequisites and revised remediation guidance.

The hybrid security posture assessments page now documents the assessment for privileged SaaS accounts outside identity-provider control, including its impact and implementation steps. Other edits update headings, formatting, metadata, and links.

The article now explains that remediation actions depend on the connector managing an identity and includes connected apps through Microsoft Defender for Cloud Apps. Enable is listed for CyberArk Identity, SailPoint Identity Security Cloud, and Salesforce, while Force password change is listed for Microsoft Entra ID as well as Active Directory.

Migration is unsupported on non-domain-controller servers running AD FS, AD CS, or Microsoft Entra Connect, while domain controllers running these roles are included. RPC auditing is automatic from sensor 3.0.8, and v3.x updates through Windows Update without the v2.x delayed-update option. Readiness reasons now appear in the Sensors page tooltip.

The August 2026 documentation describes automatic auditing for eligible AD FS, AD CS, and Microsoft Entra Connect servers running sensor v3.x, sensor version 2.255.19295.47272, Windows Server 2025 domain controller migration to sensor v3.x, and migration-readiness reasons on the Sensors page.

The documentation now includes domain controllers running AD FS, AD CS, or Microsoft Entra Connect, and states that v3.x sensors update through Windows Update. It also clarifies that the per-sensor Delayed update option applies only to v2.x sensors and expands migration-state descriptions.

The page now describes six assessment categories, clarifies AD CS and Microsoft Entra Connect sensor prerequisites, and updates formatting, images, and related-content navigation.

The page adds entries for AADInternals private-key extraction, malicious or suspicious MFA-method registration, and updates several existing alert descriptions. It removes entries for Honeytoken Activity, stolen session-cookie replay, suspicious Entra device join or registration, and adds guidance on Classic versus Defender-format alerts and alert tuning.

The article now provides clearer guidance for viewing, filtering, investigating, classifying, and managing alerts in the Microsoft Defender portal, with updated headings, navigation links, terminology, and alert-layout descriptions.

The article now uses a shared ATA end-of-life notice, adds a Defender for Identity prerequisites link, identifies the final ATA release, and updates product names and links to Microsoft Defender.

The article title, wording, and screenshot descriptions were updated. It now explicitly introduces configuring a dedicated gMSA action account and clarifies the security rationale for separating action and Directory Service accounts.

The alerts documentation now explains that some vulnerability alerts may still trigger after the relevant security update. When all affected systems are patched, applicable alerts have Low severity and may show patch status in the evidence. Documentation for Group Policy Tampering was also added.

The article now uses Microsoft Defender terminology, clarifies sensitive, Exchange server, and honeytoken tagging guidance, and notes that Entra ID and SailPoint Identity Security Cloud roles are used for sensitive entity tagging.

The page now explicitly identifies the ESC11, insecure IIS endpoints/ESC8, and ESC7 assessments, clarifies the AD CS sensor prerequisite, and presents the testing warning as a caution callout.

The page now clarifies supported SIEM event types, required message syntax, and examples for RSA Security Analytics, MicroFocus ArcSight, Splunk, and QRadar, including required CEF keys and timestamp guidance.

The page now explains that sensor versions can contribute to either classic or Defender-format alerts. During the transition, detections may appear in both lists with different names; Detection source identifies the format. Tuning and exclusions are format-specific.

The page now refers to Microsoft Defender instead of Microsoft Defender XDR and updates the alert-tuning description to say it improves threat detection coverage throughout your system.

The page now states that the assessment identifies servers without a Defender for Identity sensor and helps you unde… It also updates the metadata date and changes the advanced hunting link text from Microsoft Defender XDR to Microsoft Defender.

The page now refers to Microsoft Defender instead of Microsoft Defender XDR for automatic PAM-managed identity tagging and password resets for high-risk privileged accounts.

The guidance changes references from Microsoft Defender XDR to Microsoft Defender and updates the Security operations overview link.

The article was retitled and expanded with guidance for adding, editing, and removing account correlation rules, plus a settings screenshot and clearer license and role prerequisites.

The documentation now explicitly instructs administrators to create a custom Okta role named Microsoft Defender for Identity, assign it with the Read-Only Administrator role, and remove Super Admin after confirming both roles are assigned.

The documentation now states that sensor v3.x can be used in preview on eligible AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. Sensor v2.x procedures remain documented for other applicable servers.

The Defender for Identity–CyberArk Identity article updates its prerequisites and RBAC terminology. It now states that users tagging identities as privileged accounts in the Microsoft Defender portal must also have the Privileged Cloud Auditors role.

The page title and heading were updated to remove the “Preview” label. The documentation date and custom metadata were also updated.

The instructions now cover multi-domain and multi-forest deployments, require Enterprise Admin permissions when using a root-level group and single gMSA, and document KDS root-key replication timing and group-scope options.

The documentation now describes automatic Windows event auditing for sensor v3.x on domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers. Sensor v2.x and opted-out v3.x deployments still require manual configuration. AD CS requires an existing CA audit filter.

The installation page now clarifies sensor package download steps, formats endpoint lists, and adds tables and examples for silent and proxy installations. It also updates the post-installation next steps.

The guide now requires at least one connected, healthy Defender for Identity sensor version 2.x to receive RADIUS accounting events. It also reiterates that FIPS environments aren't supported and updates Microsoft Defender terminology and navigation.

The documentation now explains how to use the deployment executable to configure or clear an authenticated proxy, including the required URL and credentials, and how to test connectivity afterward.

The page now prominently warns that deleting the sensor removes the v3.x sensor software and stops monitoring on the domain controller. Steps, images, headings, and numbering were also reformatted.

The documentation now states that existing exclusions do not automatically carry over when detections move to the Microsoft Defender XDR detection engine. Once moved, those exclusions stop applying and previously suppressed alerts can reappear.

The article now explains manual account linking and automatic correlation through account correlation rules, including the Microsoft Defender portal path and a link to the rule-management procedure.

The page now uses Microsoft Defender naming, refreshed navigation wording, and updated SIEM guidance that instructs automation authors to use the permanent externalId field. The event-collection link text was also updated, and the TLS certificate tip was removed.

The article now identifies two affected alerts involving the ADFS and Configuration containers, clarifies that the issue affects sensor v3.x environments, and adds a Microsoft Defender portal resolution path.

The article now refers to the alert details side pane, identifies Defender for Identity as the capability tuned by alert classification, and clarifies the tabs and Related Entities data in exported Excel alert reports. The metadata and date were also updated.

The guide’s title and metadata were updated, and its incident-triage guidance was streamlined. It continues to recommend reviewing the Global and Sensor Health Issues tabs and setting up service-issue email notifications.

The article adds context for Configuration-container auditing, clarifies the no-traffic alert wording, and makes minor metadata and RPC audit text updates.

The guide’s title, description, date, heading, and authoring metadata were updated. The Test-MDIConfiguration guidance was shortened while retaining its purpose and warning about incorrect audit policies.

The article now opens with an Overview section, with minor wording updates. Its publication date and custom metadata were also updated.

Updated the page metadata, corrected the Step 3 heading level, and clarified wording for selecting a subscription and verifying forwarded events.

The prerequisites page now recommends sensor v3.x for Windows Server 2019 or later and clarifies that CPU, memory, and disk requirements are additional to resources used by the operating system and domain controller services.

Updated the page title capitalization, publication date, custom metadata, and Persona formatting. An incomplete “For more information, see:” line was removed.

The article title and wording were refreshed, and it now explains that workspace details and the workspace name are available on the About page in Microsoft Defender. The workspace name is used for proxy or firewall configuration.

The page title, publication date, and custom metadata were updated. Wording about configuring and running custom detection rules was streamlined, including how they trigger alerts and response actions.

The article title, publication date, authoring metadata, and wording introducing related articles were updated.

The page title was clarified, the publication date and metadata were updated, and the introduction now links directly to connectivity test procedures.

The Defender for Identity reports article updates its metadata and clarifies that administrators should repeat the linked report-scheduling steps to change scheduled times or recipients.

The page date changed to July 23, 2026, and wording was corrected and clarified, including “non-human” and examples of high-value targets.

The page metadata was updated, and the testing example now explicitly refers to verifying that assessments appear as expected.

The monitored activities page now refers to Microsoft Defender’s Advanced Hunting page instead of Microsoft Defender XDR’s Advanced Hunting page; the link destination is unchanged.

The role-groups documentation was updated for permissions to perform Defender for Identity response actions, including the custom Response (manage) role and listed Microsoft Entra roles.

The documentation explains that custom classification rules can identify service accounts Defender for Identity does not detect automatically, such as accounts using an `srv` prefix.

The documentation now covers v3.x sensors on non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers. Activation there is in preview, requires manual activation, and does not support automatic activation or migration.

The article now more clearly describes using the sizing tool, reviewing prerequisites, following the tool’s steps, and using manual sizing guidance when the tool is unavailable.

The deployment article now states that VPN integration and syslog notifications require the v2.x sensor on applicable domain controllers; these features aren't supported by v3.x.

The page’s publication date and custom metadata were updated. It also includes a warning that reverting to default is irreversible and discards threshold-level changes.

The page now uses clearer descriptions of sensor and deployment logs, including their locations, archived-file handling, and troubleshooting use cases.

The Microsoft Sentinel integration page now states that SIEM agents are deprecated and that the Microsoft Sentinel integration (Preview) remains supported. It also adds a dedicated integration section.

The documentation now describes a DLP to Purview migration tool, including prerequisites, supported SharePoint and OneDrive policies, migration steps, and unsupported scenarios. Existing file policies have a January 6, 2027 deadline for migration to maintain coverage.

The article now emphasizes SSPM recommendations organized into 12 metrics, adds prerequisite guidance, and updates instructions for accessing, prioritizing, and tracking recommendations in the Defender portal.

The article now requires a supported on-premises security appliance to be configured and available before importing a block script. It also clarifies unsanctioned-app blocking across integrations and governance-action precedence.

The page now links to prerequisites, clarifies the required Workday security-group permission, and explicitly lists the API values to enter during connector setup. Headings, anchors, and related links were also refined.

The article now uses clearer wording for Dropbox risks, connector APIs, governance actions, and unauthenticated users, and adds sections on threats and best practices.

The article now refers to the Zendesk environment, adds navigation anchors, identifies OAuth credential creation in Zendesk for the connector, and clarifies the SaaS security posture management and rate-limit sections.

The article updates its date and metadata, replaces “Microsoft Defender XDR” with “Defender portal,” and clarifies wording about app scoring, parameter weights, and follow-up guidance.

The page now clarifies that enabling customer-managed data encryption is available only in the Microsoft Defender portal, updates screenshot descriptions, labels the disabling-encryption note as a warning, and improves the key-rotation section heading and anchor.

The article title and description now emphasize integrations with threat intelligence, MDM/MTD, and UEBA solutions. It also clarifies the UEBA and Microsoft Entra ID Protection context for risky-user policies and adds a support heading.

The documentation now consistently refers to policy violations and clarifies that administrators should determine appropriate remediation steps after suspending a user.

Updated metadata and introductory wording, expanded the related-information reference to SaaS security posture management and Microsoft Secure Score, and added a lead-in to the connection steps.

The article now describes using basic and advanced filters on the Discovered apps page, including filtering by risk score, category, compliance, and usage. App-tag wording and document metadata were also updated.

The page now links “Microsoft Defender Portal” to https://security.microsoft.com and updates its metadata, including the date and authoring tag.

The page now says analysts hunt “in” all Microsoft Defender XDR workloads and refers to protecting cloud apps in Microsoft Defender. The support link remains unchanged.

The article now documents that Teams or Teams-integrated functionality launched from a proxied Gmail session might not be supported. It recommends accessing Teams directly instead.

The documentation states that existing Defender for Cloud Apps SIEM agents continue functioning until November 2025. It also confirms that new SIEM agents cannot be configured and that Microsoft Sentinel agent integration remains supported in preview.

The page received revised descriptions of Egnyte monitoring, governance actions, and App Connector setup, plus an introduction to connection requirements. Documentation metadata was also updated.

The page now uses clearer wording for Microsoft Defender preview features, connected-app data permissions, and the green approved-app icon.

The article now more clearly explains that Microsoft Entra apps are automatically available for Conditional Access app control and can also be manually onboarded. It also simplifies the prerequisite and setup-link wording and updates metadata.

The documentation now explains the heuristic and machine-learning baselines, clarifies the seven-day learning period and dynamic threat detection model, updates navigation and terminology, and lists activity by terminated users as a detection.

The article now advises verifying licenses, administrative access, and app configuration before onboarding. It also specifies that catalog applications appear in the Connected Apps table on the Conditional Access App Control page.

The article adds descriptive tab headings and anchors, clarifies role and admin-consent terminology, expands Exchange Web Services (EWS), and standardizes descriptions of app detail tabs.

The guide now presents prerequisites for accessing and editing Manage admin access, clarifies steps for adding admins and MSSPs, and states that Microsoft Entra roles already granting Full access cannot be overridden.

The article now documents a 1-year default API-key validity, recommends refreshing keys every six months, and adds an 8,000-events-per-minute limit alongside the 1,000-requests-per-minute limit. Connection steps and monitored Atlassian services are also clarified.

The article now uses clearer headings and navigation anchors, improves wording and screenshot text, and adds steps for editing user-defined policies plus a link to investigate generated alerts.

The article now covers file and session policy scenarios, explains when the Data Classification Service inspects file content, and clarifies steps for sensitivity-label filters, governance actions, and GDPR-related data types.

The article now uses clearer MITRE ATT&CK tactic terminology, names specific detections, and clarifies learning periods and B-TP examples for anomalous locations and impossible travel alerts.

The article now provides expanded guidance for configuring privacy groups, granting admins permission to view private activities, and viewing those activities in the activity log. Wording, headings, image descriptions, anchors, and audit-log explanations were also refined.

The documentation now states that the Activity performed by terminated user policy requires Microsoft Entra ID as the identity provider and that Mural audit-log ingestion is delayed by 48 hours. It also includes wording, heading, and navigation updates.

The Ubuntu deployment article now more clearly documents the root-access prerequisite, collector configuration steps, status verification, and related wording and navigation updates.

The article now explains that administrators should stop and remove the existing Docker container before redeploying or replacing a log collector, with a warning that removal is permanent. It also updates wording, image descriptions, and metadata.

The documentation clarifies Windows Docker-based deployment steps, including rerunning LogCollectorInstaller.ps1, the Docker Desktop WSL 2 message, and separate Syslog and FTP forwarding guidance. Screenshot descriptions and prerequisite wording were also updated.

The article now uses clearer file-policy terminology, adds updated limitation structure and screenshot text, and directs administrators to Policies > Policy management in the Microsoft Defender portal to review violations.

The page now includes a requirements section, updated screenshots and setting names, clearer scoped-profile instructions, clarified Microsoft Defender for Business device-group behavior, and revised related-content navigation.

The Box protection documentation now requires a Box Admin account or a fully privileged Co-Admin account for the connection.

The Defender for Cloud Apps GCP protection page was refreshed with clearer descriptions, an updated section anchor, and more explicit setup instructions for the service account email, Organization ID, and JSON private key file.

The documentation now distinguishes Salesforce Shield requirements for SSPM versus other integrations, and adds Salesforce and Event Manager setup steps before connecting Defender for Cloud Apps.

The article now links to prerequisites, adds context about protecting the ShareFile environment, and provides clearer steps for creating API keys and configuring the connector.

The page adds a prerequisite reminder, updates headings, and provides more descriptive text for Smartsheet setup screenshots. Documentation metadata was also updated.

Updated metadata, link labels, wording, screenshot descriptions, and the Policies overview report heading and anchor.

The article clarifies Cloud Discovery navigation, integration context, network-event descriptions, and unsanctioned-app investigation steps. Headings, portal terminology, metadata, and screenshot descriptions were also updated.

The article adds Microsoft Entra integration and connection-prerequisite guidance, refines threat-related wording, and clarifies that the service principal API must be enabled for Malware detection and response support. Logs may take 24–72 hours to arrive afterward.

The article now uses clearer terminology, adds prerequisite guidance, and includes a tip and updated screenshot description for the Microsoft Entra username enrichment option.

The article now explains how to view and use the Cloud application accounts inventory, investigate accounts, filter by account type, and take actions. It also updates headings, anchors, screenshot descriptions, and metadata.

The article updates headings, links, wording, and metadata, and now explicitly instructs administrators to sign in with a mapped DocuSign account that has Account Admin permissions before collecting connector values.

Updated the Okta integration article with clearer section headings, connection instructions, service-account and API-token guidance, support wording, and screenshot text.

The page now includes clearer advanced-options setup guidance, prerequisites and deployment references, container-preserving token renewal instructions, updated Defender portal terminology, and expanded Syslog troubleshooting guidance.

The article now explains that selecting “Tag app as unsanctioned” automatically blocks access when the policy matches, and defines app tags as labels for filtering and targeting discovered apps.

The article now includes a pre-deployment licensing section and clearer deployment instructions, along with wording, image-description, metadata, and formatting updates.

The page adds a reminder to confirm required licenses, clarifies deployment instructions, updates the section heading, and improves the setup screenshot description.

The article was rewritten for clearer wording, updated to refer consistently to Workplace by Meta, added a threats introduction, and clarified API connector and Secure Score guidance. Its metadata and section anchor were also updated.

The page updates metadata, clarifies unsanctioning and blocking discovered apps, restates the discovered-subdomain support cutoff, renames the cloud discovery data section, and reformats related links.

The article now uses clearer terminology, describes regular expressions for content inspection and file policies, and highlights supported syntax, limitations, and examples. Link labels, headings, and metadata were also updated.

The article now explains creating and managing app permission policies to control OAuth app behavior, including notifications, permission investigation, and approval or banning. It also notes that OAuth app policies trigger alerts only for policies authorized by users in the tenant.

The documentation now states that queries return up to 1,000 results by default and can be edited to return up to 100,000 rows. Results exceeding 64 MB may be partial and trigger a notification; these limits do not apply to app governance.

The guide now explicitly lists alert categories from Initial Access through Impact, clarifies discovery-alert descriptions, and streamlines links and remediation instructions.

The Protect AWS page received clearer wording, a renamed section with an HTML anchor, updated connector API guidance, and minor credential wording changes. Page metadata was also updated.

The article now more clearly explains connecting Asana through the App Connector API, configuring activity-monitoring policies, automating governance actions, and collecting the Asana access token and workspace ID.

The page now has clearer section titles and anchors, updated metadata, and more precise wording about when to open a support ticket and how such tickets are reviewed.

The guide updates metadata, clarifies licensing, prerequisite, and role headings, and revises references from Microsoft Defender XDR to the Defender portal and Microsoft Defender.

The article now provides more detail on viewing access through app tabs, including Microsoft Entra apps, and simplifies the examples and instructions for configuring the built-in policy or creating a custom policy.

The article now identifies “Grant permission” as one-time administrator consent, clarifies that content and metadata are inspected by default, and adds guidance for configuring file policies that inspect protected files.

The page now clarifies role restrictions, that malware governance actions apply only to connected apps, and that Microsoft Entra synchronization can revert the Suspend user or other affected governance actions. It also refines OAuth permission guidance and wording.

The article now explicitly describes prerequisites and deployment steps, and clarifies that unsanctioned apps are blocked according to settings in the Zscaler portal.

The article now focuses its description on investigating app activities, activity types, and event filters. It also updates screenshot text, adds anchors for user and IP address insights, and refreshes metadata.

The page now names three disabled policies, clarifies detection coverage for overprivileged and highly privileged apps, adds a sensitive-data access description, and updates a link title.

The article’s metadata and wording were updated, including guidance on activity visibility, unusual-behavior detection, governance actions, and Secure Score recommendations.

The article now more clearly describes defining IP ranges, assigning categories and custom tags, using built-in tag IDs, and creating tags. It also updates terminology, metadata, and image alt text.

The documentation now highlights that using **Remove all tags** removes the **Custom app** tag, while retaining instructions for filtering custom apps by that tag. Wording around custom apps was also clarified.

The page now provides clearer descriptions of unfamiliar locations and impossible travel detections, ransomware coverage, governance actions, and Microsoft Threat Intelligence.

The page now uses a clearer custom-alerts heading and explains that alerts apply when policy-defined activities are detected. It also clarifies that the affected user can be suspended and adds a related-policy reference lead-in.

The article now includes expanded introductory guidance, clearer wording for saved organization-wide alert defaults, updated metadata, and more descriptive screenshot alt text.

Starting in August 2026, new Defender for Cloud Apps customers will have unified RBAC automatically enabled, providing centralized role and permission management across Microsoft Defender products.

The page now refers to the Defender portal Alerts and Incidents pages, clarifies which approval, ban, notification, and permission-revocation procedures apply to Salesforce and Google Workspace, and improves screenshot descriptions.

The article now explains continuous log uploads to Cloud Discovery, uses a clearer setup heading, and clarifies that administrators should consider container, firewall, and syslog changes when checking log status.

Updated the publication metadata, clarified the session policy guidance and link title, improved the screenshot description, and added a Get help heading.

The article now explains activity filters, saved queries, investigations, and exports in more detail. It also identifies App connector and App connector analysis as Source filter options and updates screenshot descriptions and metadata.

The documentation now clarifies the suitcase indicator, states that Endpoint DLP takes priority when the same context and action overlap, and explains that users may switch browsers when policy or operating system compatibility prevents in-browser protection.

The article now more clearly describes using sensitivity labels to classify, protect, and investigate files, including sensitivity-label scans, direct file labeling, and automatic labeling policies. The title, metadata, and file-drawer screenshot description were also updated.

The page now includes a licensing prerequisite and introductory instructions for deploying the Defender for Cloud Apps and Open Systems integration. Metadata was also updated.

Updated the GitHub Enterprise Cloud section heading and anchor, clarified the connector setup step, refined best-practice wording, and refreshed the GitHub OAuth access link.

The article now uses a clearer prerequisites link, adds a named anchor, renames the “Main threats” section to “Main threats to your Miro environment,” and introduces a table of supported governance actions.

The article was updated with a new section anchor, a clearer heading and introductory wording, and a prompt to review a prerequisite before connecting Defender for Cloud Apps to OneLogin.

The documentation now uses clearer wording for finding unused apps and managing unused or expiring credentials, adds an example image of app hygiene policy conditions, and updates metadata.

The page now uses a more specific heading and anchor for importing a user group from a connected app, and clarifies the Salesforce standard profiles link text. Documentation metadata was also updated.

The page title now identifies Defender for Cloud Apps, removal steps explicitly refer to the collector container, and the deployment section directs administrators to choose a guide for their platform.

The article now explicitly describes creating a snapshot report by manually uploading firewall or proxy traffic logs to validate the log format and gain initial cloud app visibility before using the automatic log collector.

The page metadata was updated, and the integration section now introduces prerequisites and describes the integration’s capabilities more clearly.

The article title and terminology were refined, and the masking instruction now explicitly states that selecting the checkbox unmasks the last four characters of a match. Metadata was also updated.

The page now introduces the steps for connecting Azure to Defender for Cloud Apps, refreshes best-practice link wording, and updates its metadata.

The documentation now expands IdP terminology, clarifies the Webex connection description, and specifies that the default event scan period is three months. Extending it requires a Cisco Webex Pro license and a support ticket.

The page’s update date and authoring metadata were revised, while the OAuth scope list and scan-process guidance were synchronized.

The documentation now clarifies that include rules exclude groups outside the included group, that scoping in the example rules does not affect other apps, and that the account-correlation workaround applies when account ID formats differ.

The page date and authoring metadata were updated. Wording now identifies Defender for Cloud Apps as generating reports from anonymized data and states that each username resolution action is recorded in the portal’s Audit log.

The page now describes customizing end-user email notifications with HTML templates, branding, titles, and content placeholders, and notes supported notification types and differences from admin notifications. It also updates the sample-template wording and page metadata.

The page date changed to August 7, 2026. The documented list now retains only app metadata associated with a known phishing campaign; three other examples were removed.

The getting-started guidance now directs Defender for Endpoint users to the Defender portal, rather than Microsoft Defender XDR, to turn on the required setting.

The overview now says to use app governance with Defender for Cloud Apps in the Defender portal instead of Microsoft Defender XDR.

The procedure now refers to the Defender portal, points SSO configuration details to step 8, adds a “Before you begin” section, and formats the support link as a tip.

The instructions now specify using the AD FS SingleSignOnService Location from the federation metadata and explicitly require a Microsoft Defender for Cloud Apps license. They also clarify which values are needed when configuring the relying party trust.

The procedure now more clearly explains that administrators should copy the SSO URL and attributes, then enter them in the IdP’s custom app configuration steps.

The article updates its metadata and clarifies setup instructions, including where the IdP SSO URL, signing certificate, Defender for Cloud Apps SSO URL, and attribute values are used in later steps.

The page now states that the Defender for Cloud Apps SAML certificate is valid for one year and requires a new certificate after expiration.

The article now more clearly covers supported connectors, scanning and data collection, connector management, prerequisites, and connector-specific guides. Wording, headings, navigation, and metadata were also updated.

The article now describes scanning and retrieving large volumes of activity data, clarifies pagination wording, and reorganizes the next-steps links under Related content.

The article now provides clearer coverage of Data Enrichment API operations, Python CSV synchronization, pagination using `nextQueryFilters`, deletion behavior, and Defender for Cloud Apps support.

The documentation now explains that the uploadedStreams response provides stream IDs for subsequent queries, identifies the relevant id properties, and clarifies how to retrieve app IDs and apply filters.

The article now has an Overview section and revised wording explaining visibility into OAuth apps that access Microsoft Graph and other APIs. It also clarifies that the Permissions tab lists Graph and non-Graph API permissions.

The page description now explains SSPM assessment of SaaS configurations, recommendations in Microsoft Security Exposure Management, and OAuth application risk visibility. Screenshot wording and publication metadata were also updated.

The page adds optional instructions for creating a non-admin ServiceNow user with custom read ACLs and a shared role. It also clarifies 90-day token rotation and adds an Australia-specific Scope Restriction instruction.

The Attack Paths documentation now warns that disabling an OAuth application can disrupt services and remove access for dependent users and services. It also updates headings, terminology, and page metadata.

The article now distinguishes Microsoft Entra device conditions from client-certificate options and specifies uploading root or intermediate CA certificates before creating policies based on Device tag or Valid client certificate.

The article was retitled and updated with clearer Microsoft Purview Information Protection setup ordering, an Identity Inventory irreversibility warning, refreshed links, and wording corrections.

The article now covers investigating behaviors from both Defender for Cloud Apps and Defender for Cloud. It documents the BehaviorInfo and BehaviorEntities tables, BehaviorId joins, and adds context for sample investigation queries.

The documentation now explicitly requires creating a Defender for Cloud Apps API token before creating playbooks and using that token in the connection’s authentication settings.

The guide now explains how to determine whether Conditional Access App Control or Defender for Endpoint caused a block, and how to use sign-in logs, the Defender activity log, policy settings, and the Admin View toolbar to investigate.

The guide updates its date, adds navigation anchors, clarifies the Azure Marketplace listing and DevOps onboarding prerequisites, and reorganizes GitHub and Azure DevOps scan configuration and verification instructions.

The documentation adds separate steps for reviewing and remediating findings and names the relevant AKS, EKS, and GKE recommendations. EKS and GKE recommendations are marked Preview.

The documentation now covers Event Hubs prerequisites, consumer groups, tenant-level policy behavior, QRadar storage configuration, and Splunk Microsoft Entra authentication, including use of the client-secret value and the Data Receiver role.

The documentation reiterates that AI model scanning is in preview, included with the Defender for AI Services plan, and has no additional scanning charge during preview; related threat protection costs may still apply.

The guidance identifies classic Vulnerability Assessment and Advanced Threat Protection APIs, explains the move from database-level to server-level configuration, and provides a read-only PowerShell script to find affected SQL Database, Managed Instance, and Synapse resources.

The documentation announces that classic Defender for SQL Vulnerability Assessment and Advanced Threat Protection APIs will retire on August 16, 2027, alongside updates covering CVE queries, storage malware scanning, AWS/GCP identity assessments, GuardDuty coverage, and Cosmos DB availability.

Defender for Cloud has completed the transition from grouped recommendations (sub-assessments) to individual recommendations. Grouped recommendations were deprecated on July 31, 2026; individual recommendations are now the current posture model.

The instructions now explain how to open vulnerability summaries from SQL server or database resources, use Resource Health to start scans, and review findings from the Microsoft Defender for Cloud page. Screenshots, links, and metadata were also updated.

The article now explains how to migrate existing disable rules to exemptions and includes a Standard Assignments REST API example for vulnerability-based exemptions matching CVE ID, severity, and CVSS score.

The article updates scanning prerequisites, changes the review workflow to use Recommendations > Vulnerabilities with filtering and resource grouping, and adds an Azure Resource Graph query for software update recommendations.

The documentation now directs administrators to the Recommendations page, filter Scanner to SQL Vulnerability Assessment, and use the selected recommendations view. The Resource Graph Explorer example now queries assessments, filters by scanner, and uses updated result fields.

The documentation now describes the Log Analytics (MMA) agent as retired in November 2024, updates affected Defender for Servers features, and clarifies replacement recommendations and onboarding guidance.

The documentation now states that APIs for classic vulnerability assessment configuration, along with classic Defender for SQL Advanced Threat Protection APIs, will be retired on August 16, 2027. It links to migration guidance.

The page now clarifies that classic-plan users must migrate to access malware scanning, sensitive data threat detection, and per-storage-account pricing. It also expands instructions for excluding storage accounts, including tagging accounts and disabling protection with PowerShell or Azure CLI.

The article now organizes reporting capabilities, describes report sections more clearly, expands CNAPP, and documents environment requirements and report visibility options.

The page adds clearer prerequisites, updates the agentless scanning link, documents the full REST API endpoint with placeholder definitions and PUT/DELETE actions, and simplifies Inventory remediation steps.

The article was retitled and restructured with an overview, planning goals, clearer plan-specific data residency sections, and navigation anchors. Wording was also clarified around agents, extensions, SQL discovery, and AWS/GCP resource locations.

The article now uses clearer terminology for prerequisites, impacted assets, SDLC stage cards, missing data, setup guidance, and GitHub Advanced Security integration. It also adds an “Apply exemptions” section heading.

The article now focuses on identifying teams and ownership for multicloud security. It adds ownership-planning goals and best practices, updates section headings and anchors, and refreshes metadata.

The article now clarifies how to identify classic versus express configuration, adds explicit Azure portal steps for scan history and rules, and improves headings, wording, and section links.

The article now names the recommendation category tabs and explicitly labels the flat list, per-asset, and title views. It also refreshes transition wording, metadata, and related explanations.

The page now separates PowerShell and Azure portal setup paths, labels Splunk- and QRadar-specific guidance, updates reference links, and clarifies Microsoft Graph Security API alert streaming and related content.

The article updates guidance for reviewing SQL vulnerability assessment findings from Defender for Cloud or an individual resource page. It adds modern and legacy experience guidance, explains baselines, and directs administrators to use recommendation exemptions for findings they choose to ignore.

The article was revised for clearer wording, updated metadata, simplified prerequisite instructions, and refreshed links and step descriptions. The documented component combinations and recommendation workflow were clarified.

The page now uses the full Microsoft Cloud Security Benchmark name, adds clearer section headings and anchors, clarifies the enforcement timing and recommendation freshness interval, and explains that standard assignments in the selected scope align with the chosen recommendation setting.

The article updates terminology, clarifies the simulation flow and target machines, revises implementation details, and directs users to Security Alerts > Simulate Alerts with refreshed screenshots.

The article now provides clearer prerequisites and setup guidance for enabling scanning of AWS S3 buckets and RDS instances, with updated links and next-step navigation.

The article now explicitly covers migrating File Integrity Monitoring in Defender for Servers Plan 2 from MMA or AMA to Defender for Endpoint. It clarifies migration steps, DCR removal, and the KQL query for changes from the last 14 days.

The page now explicitly states that moving to the new Defender for Storage plan cannot be reversed, expands the benefits description, clarifies policy behavior, and updates migration-method guidance and script references.

The documentation now more clearly explains prerequisites, required Azure roles, Defender CSPM expectations, and how to use and share query templates.

The incidents article now provides clearer steps for finding and managing incidents, improves screenshot descriptions, clarifies incident and alert wording, and updates the next-steps link.

The article now explains that Copilot generates pull requests to correct Infrastructure as Code misconfigurations, adds a before-you-begin section, clarifies the remediation steps, and emphasizes developer review before merging.

The article now clarifies that recommendation status may take several minutes to update, specifies the selected recommendation in Fix and script instructions, and updates remediation headings and wording.

Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. The documentation also adds Azure Database for PostgreSQL flexible server assessments and lists PostgreSQL and MySQL flexible servers as supported database types.

The documentation now explains installing the Microsoft Security DevOps extension, configuring YAML pipelines with static analysis tools, and publishing SARIF findings to Defender for Cloud. It also documents the optional SARIF SAST Scans Tab extension for displaying results in the pipeline’s Scans tab.

The page now describes running static analysis and security tools, adds scanner integration guidance, restructures prerequisites and setup headings, and updates links and metadata.

The article now focuses on determining permissions and access controls for multicloud deployments as part of CSPM and CWPP design. It adds an overview and sections for defining objectives and assessing requirements, with updated metadata.

The article title, headings, anchors, introductory text, diagram description, date, and metadata were updated. It now emphasizes identifying business requirements and planning goals for multicloud security.

The article was retitled and restructured with new overview and compliance-planning sections. It now explicitly covers assessing AWS and GCP compliance requirements and links to enhanced security features guidance.

The page now covers exporting both security alerts and recommendations as CSV reports, with separate procedures, a prerequisites section, and updated navigation metadata.

The article now has a clearer title and overview, explains express and classic configuration options, adds prerequisites, and notes that an initial scheduled scan must complete before findings appear.

The article now uses updated Defender Vulnerability Management terminology, clarifies Azure portal navigation and Auto deploy scope, and adds a more detailed Qualys/Rapid7 deployment script example with explicit parameters.

The article now more clearly explains how Defender for Cloud CSPM scans AI artifacts for known library vulnerabilities and how to use Cloud Security Explorer to find affected containers and Azure OpenAI code repositories. It also adds prerequisite guidance and corrects remediation links.

The article now describes adding end-user and application context to Azure AI API calls, clarifies misspelled UserSecurityContext fields, and adds supported API and SDK guidance. It also specifies that the parameters are unsupported with models deployed through the Azure AI model inference API.

The July 2026 changelog documents a transition from grouped SQL vulnerability recommendations to individual recommendations. Two existing recommendations are marked Deprecated.

The article now explains that it covers queries for vulnerable registry images and running Kubernetes workloads, with streamlined query descriptions and result-review steps. Its metadata date was also updated.

The page now warns that deleting a disable rule re-enables findings for the affected scope; suppressed findings reappear and affect secure score. It also adds related-content structure and updated metadata.

The page updates prerequisite wording and links, clarifies the procedure for existing Security Private Link resources, and explains that the DNS command verifies resolution to a private IP address.

The article now uses simpler wording and explicitly mentions adding a client secret, granting subscription access, and assigning Security Reader and Reader roles across relevant subscriptions. Metadata was also updated.

The article now identifies previously disabled and legacy subscriptions as cases requiring manual opt-in, adds a clearer subscription heading and links, and explains that the PUT request enables the `WDATP` setting through `Microsoft.Security/settings`.

The article now describes querying repository and package data in the cloud security graph, adds a prerequisite note, updates the heading anchor, and refreshes metadata.

The article now explicitly lists Defender for Cloud, Azure Copilot, and Security Compute Unit prerequisites, with updated link text and a revised “Next steps” anchor.

Updated the setup heading and anchor, clarified how vulnerability assessment findings are included, and specified export destinations and the separate CSV alert export guidance.

The Defender for Cloud Docker Hub vulnerability assessment page updates its date and metadata, clarifies the Azure subscription prerequisite, and adds an explicit step for onboarding a Docker Hub organization.

The article now describes how AWS and GCP onboarding creates security connectors and an IAM role, and clarifies assigning RBAC permissions to account or project connectors at subscription, resource group, or resource scope.

The page title and description now explicitly mention queries for software vulnerabilities in virtual machines and container images. Sign-in steps now refer to Microsoft Defender for Cloud in the Azure portal, and the page metadata was updated.

The documentation now includes sections for prerequisites and steps to onboard a JFrog Artifactory tenant. The page date and authoring metadata were also updated.

The article’s introduction, prerequisites wording, and “Next steps” heading were updated. The article date and authoring metadata were also refreshed.

The page title and heading now explicitly refer to virtual machines, and the guidance uses “recommendation exemptions” terminology. The prerequisite to review vulnerability assessment findings was also reworded and repositioned.

The documentation states that the current Microsoft Purview configuration method for Microsoft Foundry is being deprecated and links to a new configuration method.

The article’s date and authoring metadata were updated, introductory wording was revised, and the alerts section received a named anchor and a more specific heading: “Open SQL security alerts in Defender for Cloud.”

Updated the page date and authoring metadata, clarified the Azure account and Cloud Security Explorer instructions, and renamed the sample template link.

The documentation now explains that Defender for Cloud pull request annotations help identify and resolve security issues before code is merged in GitHub and Azure DevOps. It also updates wording, metadata, and related-content navigation.

The documentation now notes the transition from grouped recommendations to individual recommendations and explains that the Scanner filter can locate SQL Vulnerability Assessment recommendations in alerts and recommendations experiences. It also updates the changelog link.

The guide now explains that EICAR is a harmless standardized test file, clarifies the initial Sensitive Data Discovery scan wording, and fixes a link formatting issue. Metadata was also updated.

The page title and “Next step” heading were revised, a named anchor was added, and the publication date and metadata were updated.

The article now explains that findings can be identified, prioritized, and exported for sharing with data owners. It also expands abbreviations and product terminology for PaaS databases and Amazon S3 buckets.

The article now explains how to review, investigate, and remediate alerts, vulnerabilities, misconfigurations, and compliance findings, with links to dedicated review sections.

The article now uses simpler wording to explain summarizing Defender for Cloud recommendations with Microsoft Security Copilot, understanding risks, and deciding what to address first. The documented steps remain the same.

The article description now focuses on identifying SQL Server instances using the legacy Microsoft Monitoring Agent, deploying Azure Arc, and migrating to the updated agent. The pricing notice was also updated to call out possible migration-related pricing impact.

The page date and authoring metadata were updated, and the “Next step” heading was changed to “Next steps” with a named anchor added.

The article now introduces the steps for viewing and remediating registry image vulnerabilities, updates its date to July 3, 2026, and adds authoring metadata.

The page date was updated, and the introductory text now describes queries for checking container images and cluster nodes in clearer language.

The documentation now states that APIs for classic vulnerability assessment configuration and classic Defender for SQL Advanced Threat Protection will be retired on August 16, 2027, with migration guidance provided.

The deprecated grouped recommendation data is no longer available through the API. Azure portal and Azure Resource Graph updates may take several days. Related Defender for SQL Vulnerability Assessment recommendations were also released as generally available.

The Defender for SQL servers on machines page now links vulnerability assessment reports to the section for viewing vulnerabilities in graphical, interactive reports. The documented scan interval remains 12 hours.

The page now documents enabling antimalware through Defender sensor auto-provisioning, Helm for sensor 0.10.x or later, or the AKS preview API. It also updates prerequisites and removes earlier multicloud and `--antimalware` instructions.

A new page compares Defender for Cloud plan and feature support across Azure, AWS, and GCP, including GA, preview, and unsupported offerings with links to related documentation.

The reference page no longer lists recommendations for resolving vulnerability findings in SQL databases and SQL servers on machines, including their related policy links and high-severity labels.

The article’s wording and metadata were updated, the “Scanning tools” section was renamed “Supported scanning tools,” and the Template Analyzer license label was clarified.

The article now describes integrating 42Crunch audit and scan findings with Defender for Cloud, adds Azure DevOps configuration steps, and clarifies the DevOps connection requirement for viewing results. It also labels the integration as preview.

The page updates its date and metadata, clarifies GitHub Actions and Azure Pipelines setup headings and wording, refreshes links, and adds guidance for viewing imported findings.

Binary drift blocking now lists sensor version 0.10.2 or later for AKS and multicloud, and supports the multicloud ARC extension without specifying a preview release train. The documentation also warns that deleting a rule can change alerting or blocking behavior.

The article now clarifies prerequisites, enablement steps, the up-to-24-hour activation period, new preview recommendations, and where to find Defender for Cloud in the Azure portal. It also adds related-content links and updated metadata.

The documentation now links to the multicloud workload protection support matrix, describes Amazon RDS support without the preview label, and states that supported RDS databases include sensitive data discovery.

The support matrix combines binary drift detection and blocking into one GA capability for AKS, EKS, and GKE, and updates the listed sensor requirement and cloud availability. Azure Government and Azure operated by 21Vianet support are also clarified for selected entries.

The page date and authoring metadata were updated, the Mend.io account prerequisite and Azure portal link were reworded, and the section heading now reads “Connect Mend.io to Defender for Cloud.”

The support matrix changes an additional Defender for Azure Cosmos DB entry from NA to GA and updates the AI interactions link to a corrected Microsoft Purview anchor.

The article now details supported Azure, AWS, and GCP machines, Kubernetes coverage, capabilities by plan, scan limitations, unsupported configurations, permissions, and the 24-hour schedule. It also directs administrators to review coverage before enabling scanning.

The documentation now describes scanning specific blobs, files, containers, file shares, or path prefixes through the REST API, in addition to scanning an entire storage account. It also documents portal initiation and retry scenarios for individual objects.

Starting October 27, 2026, Foundational CSPM will be disabled by default for new Azure subscriptions. It remains free; existing subscriptions retain their current configuration, and AWS and GCP environments are unaffected.

The article now covers connected resources across Azure, AWS, and GCP; filtering, exporting, investigation, installed-application details, and Azure Resource Graph software inventory queries. It also clarifies summary metrics and assets outside configured cloud scopes.

The documentation adds commands and procedures for disabling Defender for Containers and removing Defender components, extensions, Azure Policy integrations, and related AWS or GCP resources from AKS, EKS, GKE, and Arc-connected clusters. It also adds checks to confirm plans, extensions, and Defender pods are removed.

The documentation states that starting August 6, 2026, Defender for Cloud will continue identifying overprovisioned AWS and GCP identities but will stop calculating and displaying detailed unused permission actions.

The documentation states that stale recommendations will be removed starting August 18 and adds instructions for enabling Serverless protection for Azure subscriptions and connected AWS accounts through Defender CSPM.

The article now provides clearer prerequisite, portal, PowerShell, CLI, ARM template, and Azure Policy guidance. It also explains how to verify protection status and use sample alerts to test alerting, automation, and notification pipelines.

The article now uses clearer alert descriptions, identifies sample alerts in delivery guidance, separates Defender for Endpoint prerequisites, and refines Windows and Defender for Containers testing instructions.

The article now clarifies enablement prerequisites and supported configuration methods, adds an overview of upload triggers and scanning stages, and updates links to costs, results, limitations, and privacy information.

The article now more clearly describes CSPM and CWPP dependencies for AWS and GCP resources, with reorganized sections for required components and expanded dependency headings. It also clarifies Microsoft Defender for Endpoint and Azure Policy for Kubernetes descriptions.

The page adds clearer section headings and navigation anchors, updates the video link text, and introduces prerequisite and creation guidance.

The page now uses revised wording for attack-path analysis, clarifies CSPM, agentless scanning, and container setup prerequisites, and streamlines investigation and remediation steps. It also adds a stable anchor for the remediation section.

The page now explicitly requires agentless scanning and Defender for Servers Plan 2 or Defender CSPM for EDR recommendation investigation and remediation. It also clarifies supported machine coverage and when Defender for Endpoint integration is available.

The article now provides platform-specific enablement guidance for AKS, EKS, GKE, and Azure Arc-enabled Kubernetes, uses clearer link names, and explains how to verify the plan using a subscription or connector.

The page now explains scanning an entire storage account or targeted items, including individual blobs, containers, and path prefixes. It also adds supported content types and sizes, limitations, privacy and regional processing details, and an additional investigation use case.

The article now uses clearer wording for checking supported EDR connections, agentless scanning, plan prerequisites, recommendations, and related content.

The documentation updates wording around activation, membership control, filters, globally visible assets, and the Cloud scopes tab. It also adds navigation anchors, clarifies the Azure portal section, and updates the document date.

The documentation now organizes prerequisites, expands the creation steps, clarifies the required HealthStatus query pattern, and adds REST and metadata examples for custom standards and policies.

The article now provides separate steps for reviewing exemptions from the Recommendations and Inventory pages, clarifies Resource Graph query guidance, and adds instructions for locating exemptions and cleaning up duplicates.

The article now uses clearer section headings, adds anchors for dashboard sections, refreshes wording, and updates the prerequisite link text and metadata.

The article now adds checks for the Databases plan and AWS connector health, lists supported database engines and deployment configurations, and provides linked error tables and troubleshooting scenarios.

The article description now references PowerShell and Azure Policy, code samples are labeled Bicep, the Terraform link wording was clarified, and deployment troubleshooting guidance was added.

The article now explains Azure Policy for Kubernetes more precisely, describes resource-exclusion parameters, clarifies recommendation-based installation by cluster type, updates deployment links, and adds compliant and intentionally noncompliant workload examples.

The article now clarifies Logic Apps navigation, legacy trigger guidance, DeployIfNotExist policy behavior, and data schema access. It also improves headings, links, screenshots, and accessibility text.

The article now documents enabling and requesting just-in-time VM access through Azure virtual machines in the Azure portal, PowerShell, and the Defender for Cloud REST API. It also clarifies that the PowerShell `-Name` parameter specifies the JIT policy name for each VM.

The article now more clearly describes OS baseline misconfiguration assessment and remediation, updates terminology and links, and adds a “Supported systems and requirements” section heading.

The page now focuses on enabling automatic registration for Defender for SQL Servers on Machines and provides separate procedures for multiple subscriptions and a single subscription.

The documentation now explains how to configure CloudTrail ingestion for Defender for Cloud when the AWS account is already connected to Microsoft Sentinel, using an SNS fan-out pattern, a dedicated SQS queue, and the required permissions.

The article now clearly covers connecting partner integrations to Defender for Cloud, adds a prerequisites introduction, and improves headings, anchors, links, and wording.

The article now describes mapping from CI/CD pipelines to registries and Kubernetes runtime, covers DevOps connectors, Docker labels, and GitHub attestations, and adds prerequisites and Azure portal verification guidance.

The article adds prerequisites, corrects a GitHub link, clarifies YAML steps for enabling IaC scanning, and explains where scan results appear with or without a GHAS license.

The page now explains how to create and validate a test file on a Linux VM and adds PowerShell steps for creating a Windows test file that triggers an agentless malware scanning alert.

The article received updated metadata, clearer prerequisite and integration link text, a named section anchor, and revised Azure portal wording.

The page now describes governance rules as automatically opening ServiceNow ITSM tickets for selected recommendations or severity levels. It also clarifies the ServiceNow permissions prerequisite, rule criteria, and next-step resources.

The article now presents prerequisites as a linked checklist and uses simpler wording for reviewing sensitive data findings, recommendations, and alerts. The publication date and authoring metadata were also updated.

The page now uses updated wording, a PostgreSQL example, a refreshed portal screenshot, updated metadata, and a renamed “Next steps” section anchor.

The page now clearly describes configuring File Integrity Monitoring in the Azure portal after enabling Defender for Servers Plan 2, using the Defender for Endpoint agent and agentless machine scanning. It also improves links, headings, and disablement instructions.

The article now uses clearer terminology for the Azure machine configuration extension, updates Windows and Linux baseline and support links, and adds anchors for key sections.

The article now covers verification across Azure VMs, Azure Arc-enabled VMs, and individual SQL server VMs. It adds an Azure Resource Graph query for finding unprotected Arc-enabled VMs and clarifies the Azure portal checks for protection status.

The article updates its metadata, clarifies the East US region requirement, and renames setup headings with anchor links, including “Enable Defender for SQL Servers on Machines” and “Select a Log Analytics workspace.”

The page now uses clearer wording for filtering, investigating, updating alert statuses, and finding related guidance. It also specifies that remediating an agent-based alert does not remediate its corresponding agentless alert until the next scan.

The documentation now details remediation options, links ABAC setup to scan results, clarifies Logic App and Event Grid Function App guidance, and explains using blob copy operations. It also adds guidance for allowing downstream applications to process blobs only after a clean scan result.

The article now explicitly covers assigning standards to Azure subscriptions, AWS accounts, and GCP projects, reviewing compliance assessments, and checking prerequisites. It also clarifies where the enabled standard appears in the Regulatory compliance dashboard.

The documentation now explains that Azure Lighthouse grants managing-tenant identities access to delegated resources without creating local users or role assignments in the managed tenant. It also states that the managed tenant’s Azure Activity Log records these actions and identifies the acting user.

The article now directs administrators to review prerequisites and enable sensitive data discovery before configuring settings. It also clarifies that supported types are a subset of Microsoft Purview’s built-in types and updates related wording and navigation.

The page now more clearly explains that updating the AWS stack creates or updates the CloudFormation template with required permissions, and that Defender for Cloud configures auditing automatically. It also refines sensitive data discovery wording and the next-step navigation.

The article now identifies whether each PowerShell example enables bulk SQL VM Agent registration, refreshes PowerShell links, and updates navigation metadata and wording.

The article now calls out prerequisites before verification or remediation, renames the **Fix option** to **Fix**, clarifies that updates are applied as a one-time fix, and simplifies navigation instructions and heading structure.

The article now includes prerequisites and steps for finding and remediating Docker host misconfigurations, along with updated wording and metadata.

The page date and authoring metadata were updated, and the guidance was rewritten for clarity. It still describes suggestions of up to three users based on control plane activity and assigning recommendations with notifications and due dates.

The article now introduces prerequisites, clarifies supported incident, change request, and problem ticket types, explains that deleting the integration removes associated assignments within up to 24 hours, and updates the next-steps heading and anchor.

The page now clarifies multicloud navigation, identifies the Defender for Storage resource-level override, adds a Defender for SQL resource-level section, and updates metadata and heading anchors.

The article adds a prerequisites section, clarifies the wording for node findings, updates the Next steps heading and anchor, and refreshes documentation metadata.

The documentation now recommends adding assets from onboarded Azure environments, using scripts for environments not yet onboarded such as AWS or GCP, and uploading the CSV generated by the script. It also adds guidance for manually adding a custom environment and clarifies the permissions overview.

The documentation now identifies Global Administrators as responsible for granting or requesting Azure permissions needed to view organization-wide Defender for Cloud information. It also clarifies the limited-view banner workflow and updates section headings and links.

The documentation now adds prerequisite and permissions guidance, an OCI artifact reference for the policy bundle, and clearer instructions for setting the Helm value that enables misconfiguration enforcement. It also explains the admission controller’s Audit-mode behavior.

The article was refreshed with corrected wording, clearer Defender for Cloud plan prerequisites, an updated Azure account link, and added guidance for reviewing and remediating malware alerts.

The article now uses updated metadata, clarifies that administrators should verify all machines are protected before enabling the plan, and adds a named anchor with a pluralized “Next steps” heading.

The page now explains what detection includes, how to interpret sensitivity findings in alerts, and how to align detection with Microsoft Purview settings. Its title, metadata, and next-steps heading were also updated.

The article now focuses on missing agentless scan results for GCP VMs when the Compute Storage resource use restrictions policy blocks access to required disk, image, or snapshot resources. It also clarifies that validation after a policy change can take up to 24 hours.

The article now explicitly covers OS baseline recommendations, adds prerequisite guidance, updates the Microsoft Monitoring Agent duplicate-recommendation guidance and link, and clarifies the use of Azure Resource Graph query interfaces.

The article now explicitly covers tracked file and registry changes, clarifies the Defender for Endpoint agent prerequisite, and expands the explanation of the Log Analytics agent/MMA terminology and previous experience option.

The article now links to prerequisites, changes the section heading to “Browse the software inventory,” and documents exporting filtered inventory to CSV and saving queries in Resource Graph Explorer.

The article now uses clearer descriptions, explicitly links to prerequisites for onboarding and API publication, and renames the section to “Next steps.”

The article now presents procedures for checking coverage across an Azure subscription or for an individual SQL server VM. It explicitly names the protection-status recommendation and troubleshooting guide, and reiterates that recommendation status refreshes every 12 hours.

Updated the article date and metadata, refreshed Azure portal links, and clarified the Azure Monitor log alert and Custom log search instructions.

The article now more clearly explains how Defender for Cloud uses agentless scanning to assess Defender for Endpoint EDR settings, identify misconfigurations, and provide actionable recommendations. Prerequisite and remediation links were also refreshed, along with metadata and the publication date.

The page adds a prerequisite step and clarifies that the command lists Defender for Cloud pricing configurations, including each plan’s free trial status.

The overview now documents threat protection and sensitive data discovery for supported open-source databases in Azure and AWS, CSPM configuration assessments for Azure PostgreSQL flexible server, and Aurora PostgreSQL and Aurora MySQL RDS instances.

The overview now states that Defender for Servers no longer uses the Log Analytics agent or Azure Monitor Agent for most plan features, with agentless scanning and Defender for Endpoint integration replacing them. It also links to the AWS and GCP support matrix.

The article now explains that GCP Logs Explorer can identify when VPC Service Controls block Defender for Cloud API calls. It also clarifies that the ingress and egress policy configuration is validated by the next scheduled agentless disk scan, which may take up to 24 hours.

The article now explicitly directs readers to use Azure Resource Graph queries in Power BI, improves the introductory and sample-query wording, and updates metadata.

The guide now recommends limiting Azure portal views to 10,000 resources or fewer. For larger AWS environments, it advises distributing AWS connectors across multiple Azure subscriptions and using the Azure portal global filter.

The documentation now recommends limiting each Azure portal view to 10,000 resources or fewer. For larger GCP environments, it suggests distributing GCP connectors across multiple Azure subscriptions and using the portal’s global filter.

The page now explicitly names the Defender for Cloud and Defender for Endpoint integration, adds a stable anchor, changes “Next step” to “Next steps,” and updates metadata.

The guide now explicitly directs administrators to review prerequisites, clarifies the connected GCP project requirement, and specifies permission to modify organization-level GCP policies.

The page date and authoring metadata were updated. The unexpected-activity guidance now links to “Mitigate the alert,” and the “Next step” section was renamed “Next steps” with an anchor added.

The page now explicitly refers to Azure Policy `DeployIfNotExist` policies for continuous export, updates the next-steps heading and anchor, and refreshes its metadata date.

The page updates its metadata, changes wording from mitigating a specific issue to mitigating similar threats, and adds an introduction to steps for accessing a threat intelligence report.

The article’s date and authoring metadata were updated, failure wording was clarified, and a named anchor plus revised “Next steps” heading were added.

The article now includes steps for creating a custom data collection rule in the Azure portal and revises guidance for using Azure Policy to create and assign DCRs across subscriptions. Metadata and a next-step link were also updated or removed.

The page date was updated to July 3, 2026, authoring metadata was added, and the “Next step” heading was changed to “Next steps” with a named anchor.

Updated the page date and authoring metadata, and added a named anchor while changing “Next step” to “Next steps.”

The article now uses the full plan name and links directly to the Azure portal in the resource-level disablement steps. The publication date and authoring metadata were also updated.

The Defender for Containers introduction now links to a support matrix comparing AWS and GCP coverage by plan. Page metadata was also updated.

The Defender for Cloud introduction page now links to a support matrix for comparing workload protection coverage across Azure, AWS, and GCP. The page metadata was also updated.

The page’s publication date and custom authoring metadata were updated, and the “Next step” section was renamed “Next steps” with an explicit anchor.

The page date was updated to 07/03/2026, an authoring tag was added, and wording was revised to clarify that a single host cannot easily identify distributed attacks across multiple hosts.

The page metadata was updated, the pricing and cost-calculator paragraph was removed, and references were clarified to identify Defender for Cloud workbooks and the Defender for Cloud coverage workbook.

The page date changed to July 3, 2026, a custom authoring tag was added, and the heading changed from “Next step” to “Next steps” with an explicit anchor.

The article’s date and authoring metadata were updated, and the continuous export setup instructions were reworded with a direct Azure portal link.

The episode’s 05:52 entry now reflects the current release status of Amazon Relational Database Service (RDS) protection. The page date and authoring metadata were also updated.

The page metadata was refreshed, and the prerequisite now says “create an Azure account for free” with the existing link.

The exemption article’s metadata was refreshed, and its guidance on creating exemptions through the Defender for Cloud portal versus the Azure Policy API was updated.

The archive now uses updated anchors for CMK-encrypted VM agentless scanning, automated remediation scripts, and AWS agentless scanning. A link to “Disable specific findings” was removed.

The page date and custom metadata were updated, and the introductory link text was revised while keeping the same overview destination.

The documentation now states that deleting a suppression rule does not change alerts it previously dismissed and identifies DELETE as the method for removing the rule.

The documentation now links to the DeviceCustomFileEvents and DeviceCustomRegistryEvents Azure Monitor table references and includes updated authoring metadata.

The documentation now specifies that Defender collectors for Arc-enabled clusters and Helm deployments run as a Kubernetes DaemonSet, with a pod scheduled on each node.

The agentless data collection documentation now links AWS permission instructions to the AWS setup section and GCP permission instructions to the GCP setup section.

The documentation now lists Malware detection and states that it detects malware running in the container.

The page date changed from April 28, 2026 to August 4, 2026, and a custom authoring metadata tag was added.

The documentation now refers to identifying threats to generative AI applications and no longer mentions agents in that description.

The Attack paths article now links to the Azure section of the agentless scanning instructions using the updated page anchor.

The Defender for Storage overview now specifies that on-demand malware scanning can target individual blobs, files, containers, or file shares.

The episode twenty-three documentation now links to `/defender-xdr/defender-threat-intelligence` for information about Defender TI instead of the previous path.

The guide now names the `mdc-mock-0001:mdc-ghas-integration` image, identifies the container registry authentication details to retrieve from the Azure portal, clarifies validation-query and risk-factor instructions, and adds related content.

The article now provides clearer setup prerequisites, sandbox testing guidance, environment validation steps, troubleshooting links, and explanations of runtime-risk recommendations and matched GitHub alerts.

The page now explicitly states that Microsoft.Security must be registered at management group scope before onboarding so Defender for Cloud policies can be assigned and evaluated. It also updates headings, anchors, metadata, and the next-step link text.

The article updates its date and authoring metadata, clarifies the Cloud overview and Vulnerabilities > Cloud navigation, improves software inventory and AWS/GCP onboarding links, and labels the BYOL scanning workflow more specifically.

The article now provides clearer onboarding direction for Azure, AWS, and GCP, including its coverage of running containers, registry vulnerabilities, and Kubernetes configuration analysis. It also clarifies AKS trusted access terminology.

The article now directs administrators to review prerequisites, including enabling Microsoft Defender for Azure SQL, and clarifies that express-configuration vulnerability assessment scans do not require a storage account.

The documentation now describes 500 MB of free daily ingestion per node for eligible security data and says Defender for Servers Plan 2 must be enabled on the reporting Log Analytics workspace. Data must use a supported collection method, such as Azure Monitor Agent.

The article now explicitly describes deployment through Helm charts or an Azure Arc-enabled Kubernetes extension and names the Helm on Amazon EKS, Helm on Google Kubernetes Engine, and Azure Arc-enabled Kubernetes tabs. The publication date and documentation metadata were also updated.

The article now includes prerequisites, numbered AKS deployment steps, and explicit Defender sensor and Azure Policy extension instructions for Arc-connected EKS, GKE, and Kubernetes clusters. It also clarifies TCP 443 firewall access for private clusters and adds deployment verification links.

The article now explains one-year Defender Cloud Units, automatic application to eligible usage during the purchase term, and how to choose and purchase commit units. Links, section headings, and Azure portal navigation were also updated.

The guide now more clearly describes its CSPM and CWPP coverage, recommends following the planning guides in order, renames the “Problem space” section, and updates navigation to the business-needs guide.

The article now explicitly identifies the Azure subscription, AWS account, or GCP project used to enable Defender for Azure SQL Databases. It also updates metadata and adds a stable anchor to the “Next steps” heading.

Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. Its free capabilities will remain available and can be enabled at any time.

The documentation now links to prerequisites and clarifies that the Docker Hub access token and username are used when configuring the Defender for Cloud Docker Hub connector.

The page now states that disabling the API posture extension offboards all APIs from the Defender CSPM plan and disables API security posture management. It also updates related link text and the Azure free account wording.

The page title and description now identify the Azure Resource Graph API. The example explains filtering attack path resources by subscription and display name, and the next-steps section received a navigation anchor.

The gated deployment documentation now provides steps for configuring the managed identity and clarifies that setting the MSI objectId in the identities parameter enables runtime use by the gated deployment agent.

The page date and authoring metadata were updated, the Azure subscription signup text now says “free Azure account,” and the “Next step” heading was changed to “Next steps” with an anchor added.

The page title and heading now explicitly reference Microsoft Defender for Cloud. The publication date and custom authoring metadata were also updated.

The changelog now documents seven sensor releases with security and dependency updates. Several also improve Kubernetes pod inventory reliability when processing pod deletion events.

The page title now identifies Microsoft Defender for Cloud, and the CloudTrail warning clarifies that disabling ingestion removes data from the one-time historical collection while re-enabling it starts a new collection. The next-step heading and anchor were also updated.

The page now links to prerequisites and explicitly directs administrators to verify that Helm and curl are installed before deploying Defender for Containers.

The guide updates its title and wording, clarifies the remediation-task process and script link, and adds troubleshooting guidance for extension-related policy and DCRA misconfigurations.

The article now clarifies its scope for Defender for SQL on Machines in commercial clouds, adds prerequisite guidance, and improves links and wording for enabling protection and resolving instance-level misconfigurations.

The article adds navigation anchors, renames section headings, clarifies dashboard section and graph descriptions, and adds links to related cloud security resources and Azure portal guidance.

The article now uses clearer Azure and AWS headings, anchors, and tab identifiers; clarifies approved access requests and expiration behavior; and adds decision-flow diagram references and a next-steps link.

The article description, prerequisites wording, attack-path guidance link text, metadata, and publication date were updated. It now describes deploying a mock vulnerable container image to explore container risks with Cloud Security Explorer.

The page clarifies distribution-file selection, CMake and IAR build instructions, configuration-setting descriptions, network activity collection, Log Analytics guidance, and related-content links. The security alerts and API links are now marked as preview.

The article now consistently uses the iotSecuritySolutions resource name, updates metadata and wording, and streamlines the Azure portal, Log Analytics, verification, and cleanup instructions.

The page adds guidance for calculating detected devices for standalone licensing and warns that disabling Enterprise IoT security stops all purpose-built alerts, vulnerabilities, and recommendations. It also clarifies cancellation steps for legacy plan customers.

The article now provides an overview of roles and permissions, clarifies Microsoft Entra global roles versus Defender unified RBAC, adds prerequisite guidance, and improves links to feature-specific permission mappings and site security monitoring.

The page now uses clearer terminology for the legacy and replacement micro agents, presents tutorial links as a list, and renames the final section to “Related content.” Support and retirement wording remains included.

The migration guidance now explicitly instructs administrators to select Microsoft 365 as the price plan, save the change, and then update site details to match the license. Wording, metadata, and related-content labeling were also updated.

The recommendations page was revised with updated wording, filtering and navigation instructions, terminology, metadata, and section headings.

The page metadata, wording, heading, anchor, and OT Security prerequisite guidance were updated. The review section is now titled “Review OT and Enterprise IoT security initiatives in the Defender portal.”

The article now covers finding OT devices, filtering inventory data, investigating device details, managing site associations, and accessing vulnerability-prioritization guidance. Metadata was also updated.

The article now refers to Microsoft 365 E5 or E5 Security plans, clarifies that disabling enterprise IoT security removes access to alerts, vulnerabilities, and recommendations, and updates the standalone-license link text.

The page title now identifies Microsoft Defender for IoT in the Defender portal, and the guidance says to select a device count in the site list to view accessible device data.

The article’s metadata, vulnerability-discovery link text, and filtering instructions were revised for clarity.

The guide updates metadata, wording, capitalization, and references to examples. It also renames “Next steps” to “Related content” and adjusts the Micro agent event collection link presentation.

The article now has clearer installation wording, reordered repository setup commands, and updated guidance that the baseline validation failure recommendation may take up to one hour to appear in IoT Hub.

The article now presents its user-management procedures more clearly, including prerequisites as notes, revised wording and links, and updated metadata.

The article now provides clearer descriptions of SMBIOS requirements, renamed configuration sections, stable anchors, corrected module twin JSON formatting, and reorganized related links.

The article was refreshed with clearer wording, updated terminology and capitalization, improved formatting of UI labels, and revised instructions for filtering, exporting, and identifying devices that have not recently communicated.

The article adds clearer navigation for viewing alerts, a considerations section, refreshed grouping-option formatting, and minor wording, punctuation, metadata, and title updates.

The article now explains Automatic and Manual update modes, provides a direct onboarding link, clarifies portal navigation and package status details, and links the Sites and sensors page.

The article now includes an overview of viewing, investigating, and managing alerts across supported locations, with clearer terminology, navigation links, synchronization wording, and remediation references.

The article now uses clearer terminology and navigation for the OT sensor deployment path, subnet configuration, ICS subnet definition, port and VLAN naming, DNS lookup, and DHCP procedures. Metadata and section formatting were also updated.

The article now specifies that the module twin and device module should use the same X.509 or CA certificate used for DPS enrollment. It also updates headings, links, metadata, and navigation structure.

The page received refreshed metadata, formatting, wording, section headings, an updated alerts reference link, and a renamed “Related content” section.

The page metadata was refreshed, wording was updated to refer to potential attack paths, and the “Next steps” section was renamed “Related content” while retaining the same links.

The guidance now warns that deleting a sensor removes its registration, disconnects it from the Azure portal, cannot be undone, and requires re-onboarding with new settings.

The page title capitalization was updated, workbook topics were changed to headings, and the “Next steps” section was renamed “Related content” with updated resource references.

The page now clarifies the role-requirements link, renames “Next steps” to “Related content,” and revises wording for cloud-connected sensor reports. The same related report links remain available, with metadata also updated.

The article now describes sizing, purchasing, and updating licenses, including moving from a trial to a permanent license. Section headings, links, metadata, and the fallback from Purchase services to Marketplace were clarified.

The article now separates prerequisites and states that users must be default privileged admins or have the Admin role on the sensor. Setup wording for Azure portal and OT network sensors was also streamlined.

Updated the article title, date, metadata, formatting, and terminology for configuration status and failure reporting.

The guide updates capitalization, phrasing, drop-down terminology, the Save button label, and changes the “Next steps” heading to “Related content.”

The article title now specifies OT sensors, and the instructions clarify how to create and update custom data mining reports. Metadata and the final section heading were also updated.

The article now links to prerequisites and recommends having the IP or MAC address of at least one OT device discovered by Microsoft Defender for Endpoint before associating devices with a site. Minor wording and metadata were also updated.

The page refreshes metadata and clarifies how to investigate Defender for IoT incidents, use the DeviceInfo Site property in advanced hunting, and interpret the San Francisco site query.

The page title, heading, role-and-permissions link text, metadata, and formatting were updated.

The article title, metadata, and introductory wording were updated. The site assignment instructions now clarify that a manual site assignment remains until the device is reset, while automatic reassignment is prevented.

The article updates its metadata and rewords the prerequisite requiring the sensor’s management-port IP address to reach the OT network before active monitoring is configured.