Daily Defender NewsThe period was documentation-heavy, with many Exposure Management entries changing only author metadata. The substantive administrator-facing changes were post-delivery Teams QR-code protection, new Defender for Office 365 hunting tables, unified server-management guidance, a Kubernetes recommendation-scope change, and a Sentinel connector for SAP BTP vulnerability findings.
Defender XDR · GeneralMicrosoft Defender for Office 365 is extending Teams URL protection to detect malicious URLs in QR codes after delivery, warn users, and expose the activity for Advanced Hunting. Worldwide rollout is scheduled for October through November 2026, with no user action required.
Defender XDR · Hunting and detectionTwo new Advanced Hunting tables will provide Microsoft Defender for Office 365 email-submission visibility. Public Preview starts in early October 2026 and General Availability begins in late October 2026; the announcement states that no immediate action or compliance change is required.
Defender for Cloud · Cloud and workloadsUpdated Defender for Cloud release notes describe combined Defender for Endpoint and Defender for Servers data for unified inventory, cross-service investigations, Go hunt, and access through RBAC, device groups, and cloud scopes. They also document offboarding eligible servers by disabling Defender for Servers for a subscription.
Defender for Cloud · Cloud and workloadsStarting October 5, 2026, Defender for Cloud KSPM misconfiguration recommendations align with Kubernetes workload controllers rather than individual running container instances. Teams should adjust how they locate and triage these findings.
Sentinel · Cloud and workloadsThe Sentinel Data Connectors Reference adds a connector for SAP BTP application vulnerability findings. Using it requires API access and dedicated client credentials. The same update says Corelight deployments now require Reader and Microsoft Graph access in addition to Monitoring Metrics Publisher.
Review Teams URL-protection settings and investigation processes; no user action is required for the QR-code rollout. Track the SubmissionEvents and SubmissionResults preview-to-GA transition, although no immediate action or compliance change is stated. For server workflows, review RBAC, device groups, cloud scopes, and offboarding procedures. Update KSPM triage to locate findings against workload controllers. For SAP BTP, enable API access and create dedicated client credentials; Corelight deployments now also require Reader and Microsoft Graph access alongside Monitoring Metrics Publisher.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Microsoft Defender for Office 365 extends Teams URL protection to detect malicious URLs in QR codes post-delivery, warning users and enabling security teams to investigate via Advanced Hunting. Rolling out worldwide from October to November 2026, no user action is required, but admins should review related settings and processes.
The virus initiative criteria page updates its VB100 entry from Grade C or higher to Grade B or higher for a 95% detection rate. Its platform identifier was also updated.
Microsoft Defender for Office 365 is adding two new Advanced Hunting tables, SubmissionEvents and SubmissionResults, to enhance email submission visibility and detection workflows. Public Preview starts early October 2026; General Availability begins late October 2026. No immediate action or compliance concerns are required.
The Hunts overview documents an experience for viewing in-progress and completed expert-led hunts, including hunt types, statuses, outcomes, and supporting details in the Defender portal.
Microsoft Defender Vulnerability Management is privately previewing expanded vulnerability coverage for selected Node.js, Python, and Java packages on Windows devices. It integrates with existing workflows, APIs, and exports, with rollout planned from September to December 2026. Organizations should prepare for increased data volume and validate integrations before enabling.
A new Learn article documents supported local AI agents, MCP server discovery, and runtime protection scenarios, with support listed separately by operating system and configuration. It also explains that discovery depends on observed agent activity.
The article now uses broader descriptions of inspection points, streamlines explanations of agent-native and network inspection, updates discovery terminology, and removes the explicit event-point list and vendor links.
The documentation now states that Defender lists a local AI agent after observing activity on an onboarded device; installation alone does not guarantee discovery. It also clarifies that the inventory is not a complete software inventory and references the support matrix for coverage details.
The documentation states that Defender surfaces supported AI agents and MCP servers after observing activity on onboarded devices. An installed agent may not appear until it becomes active; the guidance also adds comparing query results with the discovery support matrix.
The page now describes bringing Defender for Endpoint and Defender for Servers together in the Microsoft Defender portal for Azure and on-premises servers. It covers server asset views, investigations, hunting, RBAC, and device groups.
The documentation explains that disabling Defender for Servers automatically offboards eligible servers. It also describes exclusions, processing times, verification, retry behavior, and what happens when the plan is re-enabled.
The release page now lists Android version 1.0.9330.0101, released September 30, 2026, with performance improvements and general bug fixes.
The Linux deployment article now explains how to embed the tenant-specific onboarding file in a golden image, keep `mdatp` stopped during image creation, and start Defender on clones only after their final hostname is set. It also adds onboarding and health verification steps.
The guidance replaces manual analyzer download steps with self-contained binary or Python Live Response action pairs. It adds package validation, workspace-ID handoff, explicit prerequisites, HTTPS requirements, and a local-workflow alternative for devices without Microsoft endpoint access.
The instructions now state that the Source tab displays the message body as HTML with links disabled. The separate Plain text tab description was removed, and the metadata date was updated.
Users can report scheduled or Meet now Microsoft Teams meetings, or individual meeting participants, as security concerns during or after the meeting.
The documentation now covers reporting Teams meetings and meeting participants, including related metadata, the meeting reporting policy, and updated government-cloud limitations.
The guide now covers reported Teams meetings and meeting participants, including alert generation and Defender portal review locations. It also corrects alert wording and terminology.
The article now covers malicious activity in Teams messages, calls, and meetings, and lists messages, calls, meetings, and meeting participants as reportable items. It also links to Teams user reporting settings.
The guide now directs administrators to configure the Allow users to report meetings policy in the Teams admin center. The Defender portal step to verify Monitor reported items in Microsoft Teams remains.
The documentation now states that automatic sensor activation and automatic Windows auditing require an active license that includes Microsoft Defender for Identity. The domain-controller onboarding heading no longer labels the process as preview.
The page date was updated, and the “Offboard a domain controller without Defender for Endpoint deployment” heading no longer includes “(Preview).”
The documentation adds sensor v3.x activation without Defender for Endpoint for eligible Windows Server 2019 or later domain controllers. It applies only to new sensor v3.x deployments, and automatic activation and Windows auditing require an active license that includes Microsoft Defender for Identity.
Automatic sensor activation and automatic Windows auditing now require an active license that includes Microsoft Defender for Identity.
The page now specifies that the method supports new sensor v3.x deployments on eligible domain controllers without sensor v2.x, and that the standalone package activates sensor v3.x on Windows Sense in restricted identity-only mode.
Two authoring metadata link entries were updated, but their URLs remain unchanged.
Starting October 15, 2026, the Defender for Cloud Apps integration with Identity inventory will move from opt-in to automatic enablement for eligible tenants that do not use the listed excluded configurations.
The documentation now specifies that Security Admin and Owner roles on the subscription containing the Log Analytics workspace are required to enable, disable, or change File Integrity Monitoring. Security Reader can view results.
The release notes now describe a new server asset page combining cloud and endpoint details, link to server offboarding guidance, and reference the new Defender server security experience.
The Kubernetes misconfiguration enforcement page now lists ElazarK and elkrieger instead of dlanger as its author metadata.
The document’s author and ms.author metadata changed from TimShererWithAquent and v-tishe to ElazarK and elkrieger.
The document author changed from dlanger to ElazarK, and the ms.author value changed from dlanger to elkrieger.
The page author changed from TimShererWithAquent to ElazarK, and the ms.author value changed from v-tishe to elkrieger.
The experience combines Microsoft Defender for Endpoint and Defender for Servers data, enabling unified inventory, cross-service investigations, Go hunt, and access management through RBAC, device groups, and cloud scopes. Administrators can also offboard eligible servers from Defender for Endpoint by disabling Defender for Servers for a subscription.
The FAQ metadata date changed from June 9, 2026, to September 23, 2026.
Starting October 5, 2026, KSPM misconfiguration recommendations will align with Kubernetes workload controllers instead of individual running container instances.
The documentation now states that the integration can use an existing Defender for Endpoint sensor from the same tenant, adds updated platform and Linux requirements, and lists pre-deployment checks for connectivity, proxy authentication, file-system settings, and security policies.
The documentation heading for filtering malware scans to specific items no longer includes “(Preview).”
Microsoft Defender for Storage on-demand malware scanning can now target individual blobs or files, containers or file shares, or objects matching a path prefix. REST API filters define the scope; without filters, the entire storage account is scanned.
The documentation now states that disabling Defender for Servers for Azure subscriptions in public preview automatically offboards eligible servers. Switching from Plan 2 to Plan 1 does not trigger automatic offboarding.
The reference adds a connector that ingests SAP BTP application vulnerability findings into Microsoft Sentinel. It also updates Confluence permissions and DCR support, and changes Corelight naming and access requirements.
The table now labels the Netskope Web Transactions connector as deprecated, removes several older connector entries, and adds new connectors plus Snowflake V3 tables.
The documentation now explains that the generated table sets `disabled=false` to enable custom parsers and advises forwarding `pack` only when the source-specific parser supports it.
The documentation adds AgentEvent and AssetEntity entries, updates the ProcessEvent listing, and revises parser examples to show explicit parameter-to-column mappings. Several examples also include fields such as `pack` and `disabled`.
The parser-management documentation updates custom unifying-function examples to pass `disabled=disabled` where supported, including AgentEvent and DNS parser examples, and adds or updates parser entries.
The documentation now lists the `_Im_AgentEvent_AnthropicClaudeCompliance` parser, its BlueVoyant Codeless Connector Framework source, and that it uses the pack parameter. The page date was also updated.
The page adds an Email Event mapping to `_Im_EmailEvent`, updates the Process Event mapping to include `_Im_ProcessEvent`, and refreshes ontology links and the publication date.
The schema reference now lists the Email Event schema as `EmailEvent`, version 1.0.0, with GA status.
The normalization page now links to the Email Event schema and has an updated documentation date.
The page now states that re-ingestion costs follow standard log ingestion pricing for paid tables, with final costs affected by tenant discounts or commitment tiers.
The page now documents `imProcessEvent` for querying all process event types, retains specialized parsers, revises custom parser naming guidance, and updates the filtering example.
Microsoft added reference documentation for the ASIM Email Event schema, including email routing, authentication, delivery outcomes, and threat fields. It also documents the `_Im_EmailEvent` parser, custom parser naming, and filtering parameters.
The page author changed from limwainstein to DebLanger, and the ms.author value changed from lwainstein to dlanger.
The page author changed from “dlanger” to “DebLanger.”
The page author changed from “dlanger” to “DebLanger.”
The document’s author metadata changed from “dlanger” to “DebLanger.”
The page author changed from “dlanger” to “DebLanger.”
The page author changed from “dlanger” to “DebLanger.”
The page author metadata changed from “dlanger” to “DebLanger.”
The vulnerability management integration page author changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The document author changed from “dlanger” to “DebLanger.”
The data connectors overview now lists DebLanger instead of dlanger as the author.
The page author changed from “dlanger” to “DebLanger.”
The prerequisites page author attribution changed from “dlanger” to “DebLanger.”
The page author was changed from “dlanger” to “DebLanger.”
The author metadata changed from “dlanger” to “DebLanger” on the Initiatives page.
The page author changed from dlanger to DebLanger.
The page author changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The initiatives list documentation now credits DebLanger instead of dlanger as the author.
The document’s author name changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The Exposure Management What's New page now lists the author as DebLanger instead of dlanger.
The page author changed from “dlanger” to “DebLanger.”
The page author metadata changed from limwainstein to DebLanger.
The page’s author metadata changed from limwainstein/lwainstein to DebLanger/dlanger.
The page author changed from limwainstein to DebLanger, and the Microsoft author alias changed from lwainstein to dlanger.
The document author changed from “dlanger” to “DebLanger.”
The Enterprise Exposure Graph documentation now lists DebLanger instead of dlanger as the author.
The documentation page author changed from “dlanger” to “DebLanger.”
The page author changed from dlanger to DebLanger.
The document author changed from dlanger to DebLanger.
The document author changed from dlanger to DebLanger.
The instructions now direct administrators to Agentic code scanning management, select Add another beside Source code environment, and choose Azure DevOps to open the connector flow.
The guide now instructs administrators to select GitHub under Source code environment, rather than Azure DevOps, and proceed to the GitHub connector flow.
The instructions now direct administrators to Agentic code scanning management, select Add another under Source code environment, and choose Azure DevOps. Connector naming remains optional.
The page received updated internal links, title capitalization, wording, punctuation, and terminology. A navigation section was removed, while the role-assignment instructions remain focused on the Microsoft 365 and Entra admin centers.
The page title and description were updated, wording and link formatting were refined, and the Related resources section was removed.
The guide has revised wording and capitalization, linked portal references, punctuation, and formatting for the Intune enrollment option.
The page title and headings were capitalized consistently, and periods were added to two troubleshooting list items and their linked reference.
The page updates its title, description, terminology, links, and setup instructions for using the Streaming API with Defender for Business and Microsoft 365 Business Premium.
The page author metadata changed from guywi-ms/guywild to poliveria/pauloliveria.
