The Edit description no longer mentions flexible frequency and lookback being in public preview or links to related guidance. Author and date metadata also changed.

Custom frequency from 5 minutes to 14 days is available only for rules based exclusively on Microsoft Sentinel data. Rules using Defender XDR data now use fixed lookback periods based on their run frequency, ranging from 4 hours to 30 days.

The documentation now describes independently configuring detection frequency from 5 minutes to 14 days and lookback from 5 minutes to 30 days across supported data sources. Lookback must be at least as long as the frequency to avoid coverage gaps.

The Edit option description now notes flexible frequency and lookback for all supported data sources and links to further guidance.

Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.

Microsoft Defender for Office 365 will tag promotional emails as “promotions” and can auto-move them to a Promotions folder, learning from user actions. Public preview starts mid-April 2026; general rollout completes by late 2026. Admins control settings; users can customize via message moves.

Microsoft Defender for Identity will auto-enable sensor v3.x activation and Windows event auditing for eligible tenants starting late October 2026, easing setup for security admins. A portal banner allows opt-out before rollout; manual control remains afterward. Review configurations and update guidance accordingly.

The page now documents inventory insights for new, highly privileged, risky, unused, overprivileged, externally unverified, and AI-agent-used identities. It also clarifies that Salesforce inventory includes Connected Apps and External Client Apps.

The documentation now explains that identity exclusions affect automated response actions in both Defender for Identity and Defender for Endpoint. It clarifies Unified RBAC permissions for both products’ data sources and adds guidance on role assignments and data-source scope.

Microsoft Defender XDR will allow alert tuning rules to target specific detection sources for finer control. This feature rolls out in public preview mid-October 2026 and general availability mid-November 2026. Existing rules apply to all sources unless updated. No action is needed unless customization is desired.

The Defender Endpoint What's New entry now links to the preview-specific Microsoft Store applications section.

The documentation now covers centrally scheduled Linux antivirus scans through managed JSON and Defender Portal policies, expanded detection of critical Node.js, Python, and Java libraries, a libcurl 8.20.0 security update, and Windows Antivirus August 2026-2 details and fixes.

The documented device requirement now includes Windows Server 2022 and Windows Server 2025. The local exclusion guidance also clarifies that local administrator-defined antivirus exclusions are not honored by default and can be enabled through Defender or Intune policy.

The page title, description, headings, tables, and references now use “Configuration protection” instead of “Controlled configuration.” The documented enforcement behavior and rules were correspondingly renamed.

The documented installer changes to version 2.26.921.1. The page also expands guidance for identifying Windows hosts, classic WSL devices, and WSL container devices in the Defender portal, and updates the screenshot and setup instructions.

The documentation now lists support for WSL containers (WSLc), extending Defender for Endpoint protection to WSLc workloads and providing visibility into their activity.

Cloned Linux virtual machines are now correctly identified as unique Defender for Endpoint devices. SIGILL crashes on processors without SSE4.1 support were fixed, along with general reliability improvements.

The documentation now describes Data Security AI Admins and the Data Security AI Admin role as editing Data Loss Prevention policies without the previous “related to Copilot” qualifier. Access to view AI content remains documented, while prompt and response access remains excluded.

The article now points administrators to the Teams user reported settings page and documents Exchange Online PowerShell commands for viewing and configuring Teams report destinations: Microsoft, a reporting mailbox, or both.

The article’s metadata links and update date changed. Teams-specific explanatory text and several Teams-related parameters were removed from the reported-message policy examples.

The setup instructions now direct administrators to the Teams user reported settings page and its updated URL when verifying Microsoft Teams monitoring. The document date was also updated.

Customers in Worldwide environments with Defender for Office 365 Plan 1 or 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page from email settings.

The page date changed to September 28, 2026, and the reporting guidance now links directly to the Teams user reporting settings section.

The documentation now states that Unicode is unsupported and Punycode is allowed only in hostname labels before a normal ASCII TLD.

Eligible new Defender for Endpoint customers may receive automatic Defender for Identity sensor v3.x activation and Windows auditing. Existing Defender for Identity customers will see a portal notice before these settings are enabled; eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers are now covered. A sensor update with security improvements is also listed.

The troubleshooting documentation now states that migrating from sensor v2.x to v3.x is unsupported when the Defender for Identity workspace and Defender for Endpoint onboarding for the same server belong to different Microsoft tenants. The server may appear ready, but v3.x activation fails.

The guidance now says sensor v2.x deployments should configure a Directory Service Account for full security coverage. A DSA is required to access the DeletedObjects container and for certain cross-domain and non-domain-controller scenarios.

Automatic activation applies to eligible Defender for Endpoint-onboarded domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. It activates the existing capability, does not install a separate package, and excludes servers that already have a Defender for Identity sensor.

The documentation now explains that enabling both automatic sensor v3.x activation and automatic Windows auditing configures eligible onboarded servers automatically.

The documentation now specifies that a directory service account (DSA) is required for the listed features and functionality when using sensor v2.x.

Manual activation preview is limited to eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers without an existing sensor. A July 2026 or later Windows Server cumulative update is required before installing or upgrading to sensor version 3.0.8 or later for automatic RPC auditing on domain controllers.

App/instance admin and User group admin role assignments can no longer be used in new configurations. Existing configurations remain supported.

The documentation now describes risk scores, last-used dates, and a Used by AI Agents (Preview) field. Salesforce inventory is also documented as including Connected Apps and External Client Apps.

Adds instructions for using Defender for Cloud Apps app governance to filter, investigate, and assess Microsoft Entra RBAC roles assigned directly to service principals, including role permissions, privilege levels, and risk signals.

The article now describes app risk scores, privilege levels, publisher information, and usage, clarifies SaaS insight definitions, and links to filtering and query guidance.

The documentation adds Risk management templates, including New high risk app and Risk score policies with customizable risk thresholds. It also updates monitoring guidance and the navigation path.

The page updates wording from app compliance to app security, renames the sharing section, and says administrators can review app details, aggregated data, and permission usage before viewing more information in Entra ID.

The app categories documentation now includes Risky apps—apps with a high risk score—and adds Risk score. Minor wording was also clarified.

The guide now describes itself as a quickstart and changes the step from assessing app compliance posture to assessing security posture, including an updated link. Author and publication metadata were also refreshed.

The regional availability documentation now lists ap-southeast-7 among the supported regions.

The page now only states that Foundational CSPM is free. It no longer includes the October 27, 2026 opt-in notice for new Azure subscriptions or the AWS and GCP scope note.

Plan 1 will no longer bill desktop, workstation, and mobile devices as servers. For Plans 1 and 2, server identification will run more frequently and count deployed machines individually, which may change billed server totals.

The documentation now states that VMs in the Starting power state are billed and links to upcoming billing updates.

The overview clarifies that a server is a device running a server operating system and links to the common questions page.

Starting October 27, 2026, new Azure subscriptions will have Foundational CSPM disabled by default. The plan remains free; existing subscriptions and AWS/GCP environments are unaffected.

Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. It remains free and can be enabled at any time; existing subscriptions and AWS or GCP environments are unaffected.

The article title, portal terminology, prose, list punctuation, emphasis, and screenshot formatting were revised.

The article was retitled and updated with a clearer introduction, revised formatting, refreshed links, and clarified descriptions and examples for CVE, image digest, OS version, severity, and fix-status exclusions.

The article reorganizes prerequisites and clarifies that enabling Defender CSPM or Defender for Storage automatically enables sensitive data discovery. It also documents sensitivity settings, the up-to-24-hour wait for initial results, and updated AWS S3 and RDS discovery steps.

The article updates its title, description, navigation steps, query instructions, and examples. It also removes the guidance about Azure Resource Graph findings and filtering by sensitivity labels and sensitive information types.

The documentation was edited for clearer wording, formatting, and navigation across Express/Classic configuration guidance, scan history, finding exclusions, Logic Apps notifications, API usage, and Resource Manager baseline examples.

The page replaces “blast radius” with “impact,” changes numbered lists to bullets, and revises wording for impacted-asset filtering, repository integration, exemptions, and Azure portal availability.

The article now expands Defender CSPM and CVE on first use, clarifies the dashboard’s purpose, standardizes severity labels and Kubernetes terminology, and improves wording and punctuation.

The article updates its title, prerequisites, navigation labels, instructions for existing Security Private Link resources, and descriptions of the containers sub-resource. Several sentences were also rewritten for clarity and consistency.

The article updates heading capitalization, link and emphasis formatting, and punctuation in the filtering option descriptions.

The page title and headings were simplified, portal navigation wording was updated, and “drop-down” was standardized to “dropdown.” Two authoring references were also added.

Updated capitalization and wording throughout the classic configuration article, including configuration checks, exemptions, Resource Manager templates, and Boolean baseline examples.

Updated the page title, wording, formatting, and the GitHub Advanced Security for Azure DevOps link. The page continues to state that MSDO CredScan secrets scanning is deprecated.

The article now uses updated Defender External Attack Surface Management naming, clearer prerequisite wording, and revised steps for opening Cloud security explorer and Attack path analysis.

The documentation now labels the procedure as updating the plan at the subscription level and directs administrators to select **Action required** instead of **Settings**.

The article’s wording, prerequisites, portal navigation, step numbering, and event-log instructions were revised. Guidance for regions, endpoints, platform types, and XPath filters was clarified, and a screenshot was removed.

The page updates terminology and UI steps, adds instructions for disabling all four Defender for Databases subplans, and clarifies autoprovisioning, Azure Policy assignments, and resource-level plan settings.

The article updates wording, formatting, and step instructions, including clearer prerequisites, assignment fields, and supported ticket types. The assignment screenshot was also repositioned.

The article now uses revised headings, wording, links, and step-by-step instructions. Prerequisites and details about supported Purview information types, labels, and sensitivity thresholds were clarified.

The enhanced agent for Defender for SQL Servers on Machines supports resource- and subscription-level enablement for SQL Server instances on Azure VMs and Azure Arc-enabled machines in Azure Government, without requiring Azure Monitor Agent deployment.

The article received wording, capitalization, punctuation, and formatting improvements. The validation steps remain the same, including sending a suspicious `User-Agent` value, and screenshots now support lightbox viewing.

The article’s title, introduction, prerequisites, navigation steps, ServiceNow selection instructions, and grace-period wording were revised for clarity and consistency.

The article now uses Microsoft Defender for Servers Plan 2 terminology and clearer wording for the 500 MB per-node daily allowance, subscription-wide calculation, and Log Analytics workspace application.

The documentation now presents the Azure, Defender CSPM, Endor Labs account, API key, and role prerequisites in clearer noun-phrase format. The portal instruction was also changed from “Navigate to” to “Go to.”

The article updates prerequisite wording, navigation text, capitalization, and makes the environment-settings screenshot expandable.

The procedure now uses revised wording for the outcome, Azure portal navigation, and Databases plan controls. It states that disabling the plan stops SQL alerts and recommendations for selected machines.

The article now applies to both Azure commercial and Azure Government clouds, replacing the separate Government-cloud article reference.

The article’s applicability changed from Azure commercial cloud only to both Azure commercial and Azure Government clouds.

The SQL machine protection documentation now links to instructions for verifying SQL machine protection in government cloud.

The Plan 1 documentation now defines a server as a device running a server operating system and links to the Defender for Servers FAQ.

Starting October 27, 2026, Foundational CSPM will no longer be enabled by default for new Azure subscriptions. The free plan will remain available at no cost and can be enabled at any time.

The article now uses clearer wording for deploying the Defender sensor and Azure Policy, verifying automatic provisioning, Azure Arc extensions, RBAC permissions, and GKE Autopilot resource limits. Step numbering and title capitalization were also updated.

The article updates its title and prerequisite section wording, and clarifies that the created access token grants Defender for Cloud read-only access.

The changelog now lists sensor versions 0.11.7, 0.10.10, 0.9.68, and 0.8.61 as GA releases from September 2026, each containing security vulnerability fixes and dependency updates.

The article now applies to both Azure commercial and Azure Government clouds instead of directing Government-cloud users to a separate article.

The documentation now lists flexible and high-frequency support for Sentinel data. It specifies lookback limits of up to 48 hours for frequencies over one hour and up to 14 days for frequencies of one hour or less; lookback remains in public preview.

The comparison table now identifies flexible rule frequency and configurable lookback for custom detection rules, with links to detailed guidance. Page metadata was also updated.

The Cisco Meraki connector now documents File Scanned detections and the `CiscoMerakiFileScannedEvents_CL` table. F5Telemetry LTM and RFI Playbook Alert Results tables are marked supported, and workspace transform DCR support is documented.

The reference now lists CiscoMerakiFileScannedEvents_CL and changes F5Telemetry_LTM_CL and RFI_PlaybookAlertResults_V2_CL from No/No to Yes/Yes in the two status columns.

The feature-availability page was refreshed, including metadata and reference links. The Codeless Connectors Platform entry remains in public preview, while its final availability field changed from No to Yes.

The documentation now describes Airlock Digital SaaS polling, self-hosted polling, and push connectors, including supported data tables, prerequisites, setup, and connection behavior.

Microsoft added a guide covering prerequisites, Partner Center publishing, and Azure Government endpoint updates for Sentinel CCF data connector solutions.

The reference adds mappings for Fortra Agari, Airlock Digital, BloodHound Enterprise, and Cisco Meraki connectors, updates ASim and Armis entries, and removes several older mappings.

The publishing guidance now links to separate instructions for making published solutions that include a CCF data connector available in Azure Government.

The guide now states that, after publishing a CCF data connector solution to Azure public cloud, publishers must enable Azure Government for the plan in Partner Center.

The AI code security overview now lists `aspm-data-externalapi-prd.security.aspm.microsoft.com`.

The page clarifies that Standard deployments use each of the three models once, refers to required model deployments for the Foundry resource, and consolidates the guidance that disconnecting Foundry disables agentic code scanning unless another connection is provided.

The documentation date was updated, “Dell Command” was changed to “Dell Command | Update,” and the listed software examples were revised to add 1Password, Beyond Compare, and Evernote while removing two entries.

The article now uses clearer wording for device replacement and retirement, inactive-device status, data retention, and exposure-score treatment. It also standardizes platform labels, portal links, and package and script instructions.

The article title, description, wording, image text, lists, and portal links were updated. Guidance on reviewing and editing policies in the Defender portal or Intune remains central.

The page updates its title and wording, simplifies the introduction and license-review step, and links directly to the Microsoft Defender portal.

The page title and wording were updated, the introductory “What to do” section was removed, and guidance for alert, vulnerability, and user-assignment rules was simplified.

The page updates portal capitalization, links the first portal reference directly to security.microsoft.com, and clarifies wording and punctuation in navigation descriptions.

The page now frames prerequisites around subscriptions, user accounts, browsers, and client operating systems, with clearer wording and links for accounts, permissions, operating systems, Microsoft Entra ID, and Conditional Access.

The page updates portal links, changes “details flyout” to “details pane,” improves punctuation and phrasing, and revises antivirus mode descriptions and terminology.

The article updates wording, links, step references, and portal terminology such as “flyout pane.” Instructions continue to cover firewall policies, custom rules, profiles, and the 150-rule limit.

The page title and description were updated, and wording throughout the article was revised for clarity, including role guidance and steps for reviewing incidents and releasing contained devices.

The article’s title capitalization, punctuation, portal references, and settings-table wording were updated. Microsoft Defender portal references are now clickable links.

The article now clarifies when to use the Defender portal or Intune admin center, adds links to both portals, and improves wording, formatting, and policy-setting descriptions.

The article received clearer wording, corrected action-list formatting, updated Action Center links, and two related-concepts links.

The article was revised with clearer descriptions of device groups, updated terminology, and refreshed create/edit policy instructions and formatting.

The article updates wording, image text, punctuation, and navigation links, including direct links to the Microsoft 365 admin center and Purchase services page. Placeholder direct URLs for the Devices page were removed.

The overview now has revised introductory and capability descriptions, clearer image text, corrected grammar, and improved table and footnote formatting.

Updated capitalization, wording, links, punctuation, footnote formatting, and troubleshooting instructions on the Defender for Business mobile threat defense page.

The page now uses formatted links and more concise, consistent wording throughout its report descriptions and instructions.

The page title, description, and several guidance phrases were revised, including wording about videos, customer portal access, and Defender for Endpoint API integrations.

The documentation now more clearly explains policy priority, how to change the order of custom policies, and that only the highest-priority applicable policy is applied.

The page now states that administrators can add a user and purchase additional licenses, with a link to related Microsoft 365 guidance. Titles, punctuation, and image description text were also updated.

The FAQ title capitalization, sentence punctuation, and wording were updated, including a change from “via” to “by.”

The page now presents Microsoft 365 Lighthouse guidance for CSPs and MSPs, links directly to the Lighthouse portal, updates the screenshot text, and removes the separate “Learn more” section and links.

The page title was capitalized consistently, “Microsoft Defender portal” was shortened to “Defender portal,” and “flyout” was clarified as “flyout pane.”

The page received wording, formatting, capitalization, and punctuation updates, plus linked references to the Defender, Intune, and Azure portals. The introduction now notes that several device onboarding options are available.

The page title and heading now capitalize “Attack Surface Reduction.” The text also uses “cyberattack” and revises punctuation around configuration method examples.