Updated reference links and removed “(Preview)” from the headings for creating or editing custom roles, deleting roles, and importing roles.

The documentation now describes malicious content propagation, secret exfiltration, evasion techniques, and unsafe email domains, including how blocking affects user requests, model responses, tool requests, and tool responses.

The page adds two reference links, refreshes the Microsoft Sentinel table entry, and adds a sample two-column table.

The page updates its DevRel reference links and removes the “Important” callout stating that the feature is currently in preview.

Microsoft Defender for Office 365 will localize the default "Mark and notify" email template based on users' Outlook language settings, improving clarity in user-reported message notifications. Rollout starts June 2026 globally, with no changes to message classification or custom templates. No action is required.

The What's new entries for the preview AgentsInfo and AIAgentsInfo advanced hunting tables now show table names as inline code instead of linked text.

The documentation adds steps for disabling a built-in alert tuning rule and states that each alert tuning rule supports up to 200 conditions.

The documentation now states that the built-in rule took effect in early October 2026. DLP signals are treated as behaviors, so they do not generate alerts or appear in the incident queue, but remain available in advanced hunting.

The page now states that detection rules involved in creating a source incident are added to the target incident. It also explains that correlation settings control alerts from analytics rules or custom detections.

The schema page no longer labels AgentsInfo as Preview and no longer lists AIAgentsInfo.

The documentation now describes the transition from `AIAgentsInfo` to the unified `AgentsInfo` table, which expands beyond Copilot Studio-specific columns.

The page no longer includes the notice that some information concerns prereleased products subject to substantial change before commercial release.

The AIAgentsInfo advanced hunting table is transitioning to AgentsInfo. AIAgentsInfo remains accessible until July 1, 2026, and its reference documentation was removed.

The documentation now covers including or excluding custom detections from Microsoft Defender XDR correlation on a per-rule basis. Custom detections are included by default; exclusions create predictable single-alert incidents when no matching grouping rule applies.

The documentation now states that custom detections are included in correlation by default and have a per-rule option to include or exclude them.

The documentation adds Platform 4.18.26090.9, Engine 1.1.26090.9, and security intelligence 1.461.1.0 release details, including automatic protection-engine refresh, improved update reliability, ASR path handling, and policy-exclusion retention.

The October 2026 entry replaces the previous Preview listing for vulnerability assessment of applications installed via the Microsoft Store, including Microsoft Teams.

The page updates headings, links, portal navigation wording, and instructions for connecting Defender for Endpoint to Intune and creating Android app protection policies.

The article title, metadata links, and wording were updated. Examples of fileless-malware techniques were rephrased, and the PowerShell guidance paragraph was removed.

The page received wording, formatting, and accessibility edits. It clarifies when automated investigation and remediation can start, links to its overview, refines alert-severity descriptions, and updates the screenshot text.

The page title and description were refined, screenshot captions now describe each image, and wording and punctuation were clarified throughout the report guidance.

The Client Analyzer feedback page now uses direct links to the Microsoft Defender portal and centralized feedback platform, with minor title and wording updates.

The page updates capitalization, expands MSSP to “Managed Security Service Provider,” refines wording, and adds metadata links. The tenant-specific portal URL and access instructions remain documented.

The page title was capitalized consistently, explanatory text was split for readability, and the two inspection approaches—Agent-native event inspection and Network inspection—are now named explicitly.

The article refreshes terminology, links, permission formatting, navigation instructions, and screenshots for submitting files and file hashes through the Defender portal.

The page was updated with revised metadata, clearer On/Off selection steps, an endpoint screenshot, and added guidance explaining that scoped device group correlation can produce separate incidents for Global SOC users.

The article received clearer wording, standardized terminology and formatting, revised examples, and updated link text.

The page updates heading capitalization, formats navigation paths and code blocks, and restructures the supported operating systems section for clearer presentation.

The page title and description were refined, and explanations of real-time protection, hybrid detection, cloud protection, and detection engines were reworded for clarity. The description now highlights client and cloud engines, machine learning, and behavior monitoring.

The page title capitalization changed, its description now covers viewing, organizing, and managing alerts and investigating threats involving devices, files, and users, and its metadata links were updated.

The documentation now lists onboarding, security reporting, and iOS TVM as Mobile TVM service uses. It also warns that restrictive Conditional Access policies can disrupt these flows and recommends excluding the service from those policies.

The article now lists firewall and proxy URLs needed to onboard and maintain Microsoft Defender for Endpoint devices on Android and iOS, covering commercial and US Government cloud environments.

The documentation now clarifies that the DeviceTagging registry key supports only one tag in the Group value. Tags assigned through other methods aren't written there, so the registry value may not show all tags on a device.

The documentation now says the features, including SOC experiences, should be available in all organizations by the end of October instead of mid-September.

The page now explains that `X-MS-Exchange-Organization-BulkStamping` is used only during message transport and removed before delivery to the mailbox, so recipients cannot see it in message headers.

The EmailPostDeliveryEvents table documentation now includes the ApproverUpn field, which identifies the approving user or administrator.

The Safe Links documentation date was updated, and its explanation of URL scanning before delivery, at click time, and through the client-side API was revised.

The FAQ now explains that security tools can generate click telemetry during content inspection, recommends built-in simulation reports, and notes that Safe Links and UrlClickEvents may not capture all simulation activity.

The documentation now explains how to select a built-in rule on the Alert tuning page and disable it from the rule details pane, with a screenshot.

The documentation now refers to automated inspection of the simulation payload in the Clicked Message Link entry, replacing wording about non-Microsoft filtering services.

As of July 2026, messages identified as bulk receive the Promotions tag and, when Bulk moves enabled is turned on, are moved from the Inbox to the Promotions folder only when they are promotional in nature, regardless of BCL value.

The article now explains how to select a built-in rule on the Alert tuning page and choose Disable, with a supporting screenshot.

The page now documents assessments for excessive local-group privileges granted by GPOs and reversible passwords stored in Group Policy Preferences, including risks, user impact, and remediation steps.

The prerequisite changed from the July 2026 to the September 2026 or later Windows Server cumulative update. Post-migration guidance now covers manually removing workspace DSA or gMSA configuration and retiring unused gMSA accounts after verifying they have no other users.

The FAQ now states that offboarding a server from Defender for Endpoint stops Defender for Identity v3.x sensor reporting, including sensors migrated from v2.x, and does not automatically enable identity-only mode.

The alert catalog now includes updated descriptions and fields, plus entries for several OAuth, Okta, Kerberos, AD CS, and DPAPI-related alerts. The malicious MFA device registration severity is shown as High.

The October announcement adds 19 alerts covering Entra ID, Active Directory, and other identity providers, including Okta, with links to detailed alert information.

The health alerts page revises the entry describing a missing or incorrectly applied Unified Sensor RPC Audit configuration tag and its resolution steps.

The documented prerequisite changed from the July 2026 or later cumulative update to the September 2026 or later cumulative update.

The archive entry for “Suspicious network connection over Encrypting File System Remote Protocol” now links to the “Suspected PetitPotam coercion attack” section.

The Defender for Identity remediation-actions table now lists Security Operator among the roles for the Revoke session action.

The prerequisite changed from the July 2026 to the September 2026 Windows Server cumulative update for sensor version 3.0.10 or later. The guidance also clarifies v2 migration account settings and that migration does not automatically remove workspace DSA or gMSA configuration.

The documented prerequisite for Windows Server 2019 or later changed from the July 2026 cumulative update to the September 2026 cumulative update.

The article now states that, as of October 15, 2026, two EWS-based detections are marked Retired and no longer generate alerts.

The guide now lists auto-labeling migration for SharePoint and OneDrive, plus DLP file-policy migration for Google Workspace, Box, Dropbox, and Salesforce. Previously, it listed only SharePoint and OneDrive DLP migration as supported.

The documentation now explains that protection applies across tenants within the same Microsoft Edge work-profile session. Separate Edge work profiles provide separate session enforcement between tenants.

The documented KQL now queries SQL Vulnerability Assessment records, filters resources by Log Analytics workspace IDs, and returns workspace ID, machine name, and machine UUID. The prior subassessment, OnPremiseSql, and 30-day scan-time filters were removed.

The documentation now states that deletion authorization failures involving 250 or more Defender-tagged snapshots suspend new scans for the affected AWS scope. Snapshots continue accruing storage charges until deleted.

When 250 or more Defender-tagged snapshots accumulate because deletion authorization fails, new scans are suspended for the affected AWS scanning scope to limit additional storage charges.

The FAQ now recommends having more than one subscription owner and removing disabled or guest accounts with owner, write, or read permissions on Azure resources.

The documentation now explains that some identity and access recommendations can appear without the Azure CSPM standard assigned, but those recommendations don't support exemptions unless the standard is assigned. It also links to assignment instructions.

The article now covers EKS provisioning failures caused by recreated IAM roles, endpoint allowlist reconciliation, and stale Azure Arc registrations. It adds diagnostic commands and resolution steps.

The documentation now lists required CrowdStrike REST API scopes, links to upgrade notes, adds Pathlock deployment guidance, removes the Red Canary connector section, and adds SilentPush Feeds details.

The table adds entries for SilentPush Feeds, Theom, and Theom via the Codeless Connector Framework, and removes the Red Canary Threat Detection entry.

The connector reference now uses a relative setup-guide link, an anonymized server URL example, and reformatted CrowdStrike region mapping table.

The instructions now use Create > Logic App playbook and distinguish Consumption triggers—including alert, case, and legacy options—from Standard playbooks, which start with Blank playbook. The page also explains case-versus-incident terminology and adds supporting links.

The comparison table now describes excluding a rule from the correlation engine and marks it supported for analytics rules and custom detections, with configuration guidance linked.

The page no longer labels Microsoft Store applications as Preview or lists individual supported apps. It now states that vulnerability assessment is available for a limited set of commonly used Microsoft Store applications.

The page title capitalization was standardized, the “Weaknesses” description was simplified, and the Vulnerability Management link was reformatted.

The article’s title, wording, formatting, and links were revised. Guidance on next-generation protection, firewall policies, controlled folder access, and attack surface reduction was reorganized and simplified.

The guide was revised for capitalization, grammar, image description, list and link formatting, and clearer references to Microsoft Intune.

The page title and description were updated, the description now covers product updates and feature-availability changes, and several release-note entries and links were reworded.

The article’s title, descriptions, navigation steps, severity explanations, and attack-disruption text were revised. The incident screenshot can now be opened in a lightbox.

The article title and headings were updated, browser enforcement wording was clarified, setup examples and policy instructions were streamlined, and two ontology links were added.

The page received capitalization and wording edits, revised onboarding guidance for local scripts and Intune, an updated Intune enrollment link, and clearer Microsoft 365 Lighthouse wording.