Daily Defender NewsMicrosoft Defender for Office 365 will enhance the Teams message entity flyout by late September 2026. The updated workflow will let security administrators submit messages to Microsoft and block senders or domains from the same investigation flow.
Defender XDR · Email and collaborationBy late September 2026, the flyout will support submitting Teams messages to Microsoft and blocking senders or domains in one workflow.
Plan 1 and Plan 2 customers can use the streamlined Teams message investigation workflow without making configuration changes.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Microsoft Defender for Office 365 will enable Teams user reporting by default starting late October 2026 for licensed organizations. Users can report suspicious Teams content to improve threat detection. Admins can review or opt out via a dedicated Defender portal page before October 25, 2026.
Microsoft Defender introduces native Case Management to unify threat investigations, assign analysts, track SLAs, and capture notes in one workspace. Launching in public preview September 2026, it integrates with existing workflows and permissions, enhancing security team coordination and response efficiency without requiring manual migration.
Exchange Web Services (EWS) in Exchange Online will be retired starting October 1, 2026, with related Microsoft Defender for Cloud Apps app governance detections ending October 15, 2026. Organizations not using EWS need no action; those continuing EWS use will lose related alerts and should migrate away from EWS.
Support for Microsoft Defender for Endpoint on Amazon Linux 2 (ARM64) will retire on October 31, 2026. After this date, no updates or support will be provided. Organizations must identify affected devices, prevent upgrades beyond version 101.25122.0004, and migrate to a supported Linux distribution before the deadline.
Microsoft Defender for Endpoint on Linux now requires allowlisting new service URLs specific to tenant types for delivering internal configuration updates, feature rollouts, and critical issue mitigations. This update is available worldwide, with no change to user experience, and ensures devices receive the latest features and optimizations.
Microsoft Defender for Office 365 will enhance the Teams message entity flyout by late September 2026, enabling security admins to submit messages to Microsoft and block senders or domains in one workflow. This streamlines Teams message investigations for Plan 1 and Plan 2 customers without requiring configuration changes.
Microsoft Defender for Office 365 added an ApproverUpn column to the EmailPostDeliveryEvents table in Advanced Hunting, showing who approved remediation actions. This enables faster investigations without using Action Center. The feature is available worldwide, enabled by default, and requires no action from administrators.
