Latest Microsoft Security news
Every new post from the Microsoft Security Blog, Microsoft Threat Intelligence, the product team blogs on Tech Community and security-related Azure Updates, de-duplicated and tagged by product and release status.
News
All news
Every post from Microsoft's security blogs, Tech Community and Azure Updates, newest first.
- 2026
Trained to betray: How post-training supply chain attacks hijack coding agents
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities.
Links Security for Microsoft CopilotNew Protect AI agents in real time using Microsoft Defender When prompts become shells: RCE vulnerabilities in AI agent …
- 2026
Catch Microsoft Defender and Sentinel at Ignite 2026
Join us at Microsoft Ignite 2026, November 17 to 20, in San Francisco and online. Find the Defender and Sentinel sessions that fit your role, and what you will take away from each. Times are Pacific (PT). 1. Start here If you…
Links Session details and RSVP
- 2026
The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity.
Links Security for Microsoft CopilotNew documented 59 Linux kernel bug reports Prompting in Microsoft Security Copilot
- 2026Azure security Preview
Public Preview: Rate limit grouping for Azure Front Door Premium WAF
Announcing the public preview of rate limit grouping for Azure Web Application Firewall (WAF) on Azure Front Door Premium. By default, a rate limit rule counts requests separately for each client IP address. Distributed attacks get around this by spreadin
- 2026
Lessons from 59 Linux Kernel Bug Reports
Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. The research includes eight demonstrated local root privilege-escalation exploits and examines the challenges of turning AI-generated findings…
Links 33 assigned CVEs rhashtable_walk_stop() 2018 commit (5d240a8936f6)
- 2026
Detecting sleeper agents hiding in AI model neurons
Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat is detectable by…
Links Enable security for AI agents using Microsoft DefenderNew Microsoft Defender for Storage On-upload Malware Scanning Conditional Access for Agents in Microsoft Entra
- 2026
FORGE Lab uses agentic tools to identify memory safety issues in Rust
Microsoft FORGE Lab researchers found memory-safety bugs in Rust's core and std libraries, including cases where safe Rust code can trigger undefined behavior. Using Hyenas, FORGE's frontier research version of codename MDASH, the team investigated three patterns of misplaced trust in unsafe…
Links 3 lessons from frontier AI vulnerability researchNew panic safety issue Buffer::clone
- 2026
ARTEX abuse expands as cybercriminals target financial sector
In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.
- 2026
What’s new in Microsoft Entra: November 2026
Don't miss our Microsoft Ignite announcements. Tune in or join us in person for AI is changing access: See how Microsoft Entra helps you stay ahead on November 18, 2026, at 10:15 AM Pacific for secure access news and demos from our…
Links View reports & logs in entitlement managementNew Configure cloud firewall for Global Secure Access clients …New Configure home network support for Microsoft Entra Private …New
- 2026
Enhancements to the Protection and Posture Insights report
Earlier this year, we introduced the Protection & Posture Insights report: an on-demand, tenant-specific view of the email & collaboration threats targeting your organization, how well Microsoft Defender is stopping them, and where your configuration can be strengthened. Today, we're announcing the…
Links From Impersonation Calls to Transparent Reporting: Defending … Reports page within the Microsoft Defender portal View Defender for Office 365 reports
Also: Tc defender xdr, Tc defender xdr - 2026
Threat actors use agentic AI tooling to find and abuse exposed secrets
Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions in the application’s tenant. Agents…
- 2026
Generally Available: Azure Front Door TLS key exchange policy with post-quantum support
Azure Front Door now supports configurable TLS key exchange policies, including hybrid post-quantum key exchange, to help you prepare for evolving cryptographic threats while meeting your security and client compatibility requirements. Choose a predefined
- 2026
Generally Available: WAF Insights for Azure Application Gateway
WAF Insights for Azure Application Gateway Web Application Firewall (WAF) is now generally available. WAF Insights is a built-in experience in the WAF policy that brings WAF logs and metrics together in interactive dashboards, so you can investigate block
- 2026
New investments to reduce on-premises security risk
We’re announcing a new on-premises security initiative, bringing together guidance, migration, and product investments.
Links Data Migration - FastTrack – Microsoft 365 Search Product and Services Lifecycle Information Secure your on-prem estate (BRK215)
Also: Tc security community - 2026
What’s new in Microsoft Security: November 2026
Microsoft Security’s November 2026 updates strengthen AI agent security, least privilege, threat protection, and exposure management.
Links Agents are your newest insiders. Security must move at their …New What's New in Defender for Cloud FeaturesNew Manage system settings with Endpoint Privilege Management
- 2026
Email threat landscape: Q3 2026 trends and insights
Microsoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined, CAPTCHA-gated phishing recovered, and malicious messages spoofing familiar business-service sender domains exposed risks associated with security…
Links Email threat landscape: Q2 2026 trends and insights Device Code Flow: The Gift That Keeps on Giving — To … Inside Tycoon2FA: How a leading AiTM phishing kit operated …
- 2026
Catch Microsoft Entra at Ignite 2026
Join us at Microsoft Ignite 2026, November 17–20, 2026, at Moscone Center in San Francisco and online. Explore Microsoft Entra and learn how to secure access for users and AI agents. From stopping identity attacks to simplifying access policies and securing agents…
Links Microsoft Ignite 2026, Session details & RSVP
- 2026Azure security Preview
Public Preview: Azure Firewall IPv6 now supports application rules
Azure Firewall now supports application rules in IPv6 Public Preview, enabling layer 7 filtering for IPv6 HTTP and HTTPS traffic. The enhancement extends application-level controls to IPv6 and dual-stack deployments, helping customers maintain consistent
- 2026
Scale access controls with Microsoft Entra Conditional Access policy plans
Today we’re announcing the public preview of Microsoft Entra Conditional Access policy plans —a new framework for enterprise-scale access control. Instead of managing dozens of individual policies, policy plans let you define your access intent once and enforce it consistently across every…
Links Migrate Conditional Access policies to a policy plan …New What are Microsoft Entra Conditional Access policy plans? …New Microsoft Learn: Migrate Microsoft Entra Conditional Access …
- 2026
Microsoft Entra deep dives: Join our December 15–17 webinar series
At Microsoft Ignite, November 17–20, the Microsoft Entra team will explore innovative ways to secure access for people and AI agents. But Microsoft Ignite is just the beginning. Post Ignite from December 15–17, keep the momentum going with three days dedicated to…
Links Scale secure, adaptive access without policy sprawl Strengthen governance, privileged access, and resilience … Secure identity and access for every agent, local or cloud
- 2026
Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations
Written in collaboration with yuvalpery and Gunjan Jain Introduction Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP. We strongly recommend that customers upgrade to a patched version of PHP as soon as possible. Upgrading is the only way…
Links Azure WAF custom rules for PHP2Shell mitigation Rewrite HTTP headers and URL with Azure Application Gateway WAF Request Size Limits in Azure Application Gateway
- 2026
The CISO Cheat Sheet to Microsoft Digital Defense Report 2026
I know we’re all busy, so I’ve pulled the most important data from this year’s Microsoft Digital Defense Report into one short read. The full report is well worth exploring, but this article focuses on the numbers and trends most relevant to…
Links Storm-3168: Agentic-driven cloud attacks using compromised …New Malicious AI Assistant Extensions Harvest LLM Chat Histories Microsoft Digital Defense Report 2026
- 2026
What stops a service-side auto-labeling rollout from being approved — and how to unblock it
The four questions every approver asks Access Proof Reversibility Scale “Will labeling change who can open our files?” “Can we prove what gets labeled — and why?” “Can we undo it if something goes wrong?” “Will it finish at our size?” Scenarios…
Links Review simulation results for auto-labeling policies in …New Automatically apply a sensitivity label to Microsoft 365 …New Microsoft Purview DLP for Microsoft 365 Copilot and CoworkNew
- 2026
Windows news you can use: October 2026
October brought plenty to keep on your radar, from new Windows 11 features and accessibility improvements to security changes that might require some planning. We've pulled together the highlights, hardening changes, resources, and upcoming lifecycle milestones to help you stay ready for…
Links Windows settings backup and restore OverviewNew Cloud rebuildNew Windows Recovery Environment (Windows RE)New
- 2026Azure security Preview
Public Preview: JWT validation for Application Gateway for Containers
Application Gateway for Containers now supports centralized JSON Web Token validation through the AuthPolicy custom resource. Teams can validate a token signature, issuer, lifetime, and configured audience by using signing keys retrieved from a trusted HT
- 2026Azure security Preview
Public Preview: MCP gateway for Application Gateway for Containers
Application Gateway for Containers now supports Model Context Protocol routing through the new MCPRoute custom resource. Platform teams can publish MCP servers behind a stable hostname and path while centralizing TLS, JWT validation, Web Application Firew
- 2026Azure security Preview
Public Preview: Private ingress for Application Gateway for Containers
Application Gateway for Containers now supports private frontends that are reachable only through approved Azure Private Link private endpoints. This enables organizations to keep internal applications, shared services, and cross-cluster traffic on privat
- 2026
Fake-download campaign uses trojanized installers to deliver monetization payloads
Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.
Links Software inventoryNew Microsoft Security Copilot and Chat in Microsoft Defender Configure Microsoft Defender Antivirus always-on protection
- 2026
Microsoft named a Leader in the 2026 Gartner® Magic QuadrantTM for AI Agent Management Platforms
Read why Gartner named Microsoft a Leader in the inaugural 2026 Magic Quadrant for AI Agent Management Platforms.
Links Agents are your newest insiders. Security must move at their …New Connected platforms in Microsoft Agent 365New Microsoft Agent 365
- 2026
Global Secure Access: Private Access and Internet Access in one offering
Employees, and now AI agents, need secure access to resources wherever they live: the internet, Microsoft 365 and SaaS, cloud and datacenter workloads, on-premises apps, and AI services. Zero Trust means evaluating every one of those connections against full context, including identity…
Links Configure cloud firewall for Global Secure Access clients …New Web filtering in Global Secure Access (V2) - Global Secure …New Configure home network support for Microsoft Entra Private …New
- 2026
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Real-world exploitation concentrates in a small, high-impact subset of CVEs. Learn how defenders can prioritize vulnerabilities based on exploitation likelihood, exposure, and potential blast radius.
Links Security for Microsoft CopilotNew Work with attack paths in Microsoft Security Exposure … Defender EASM Overview
- 2026Defender for IoT Retirement
Retirement: OT security in Microsoft Defender for IoT
This is the formal notice that Microsoft plans to deprecate the operational technology (OT) security component of Microsoft Defender for IoT. The service will be fully deprecated in October 2029, following a three-year transition period.This change applie
- 2026
Protect against Brotli CVE-2026-111497 with Azure Web Application Firewall (WAF)
Google Brotli versions 1.0.3 through 1.2.0 contain a buffer overflow vulnerability in the Brotli decoder, according to the recently published CVE-2026-111497 . A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt decoder memory, expose sensitive memory contents, cause a…
Links WAF Custom Rule for Azure Front Door Brotli releases Upgrade CRS or DRS Ruleset Version
- 2026
Scaling classification and labeling: an interactive reference architecture update
In April, I published a set of referential architecture diagrams for Microsoft Purview — Microsoft Purview Referential Architecture Diagrams . They have been useful in workshops and training sessions for a simple reason: one picture is worth a thousand words - attempting…
- 2026
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.
Links Security for Microsoft CopilotNew Microsoft Security Copilot and Chat in Microsoft Defender Activity Profile: Malicious Claude Code branded extension …
- 2026
AI agents are coming—are your identity controls prepared?
AI is reshaping identity risk. Attackers now use AI to automate phishing, social engineering, and privilege escalation, making credential theft faster and more convincing than ever. SMS codes and push approvals can be intercepted, while standing privileges give attackers reach far beyond…
Links Secure identity to get ready for AI with Microsoft EntraNew Plan a phishing-resistant passwordless authentication … Continuous access evaluation in Microsoft Entra
- 2026
What’s new in Microsoft Sentinel: October 2026
Welcome back to What's new in Microsoft Sentinel. In October, cross-tenant delegated access reaches general availability so you can run security operations across tenants with least privilege, the Advanced Security Information Model (ASIM) EmailEvent schema gives you one consistent structure for email…
Links Microsoft Sentinel Solution for SAP BTP - security content …New Deploy Microsoft Sentinel solution for SAP BTPNew Expanded cross-tenant delegated access in Microsoft Defender …
- 2026
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.
Links Microsoft Defender for Office 365 support for Microsoft …New Security for Microsoft CopilotNew Application Control for Windows
- 2026
Interim guidance for Cuba DST 2026
On October 27, 2026, the Republic of Cuba made an official announcement about a Daylight-Saving Time (DST) time zone change. Cuba has canceled 2026 year’s...
- 2026
New policy implementation and web enrollment for Android personally owned work profile is now GA
We’re happy to announce two improvements for the management of Android personally owned work profile devices with Microsoft Intune, which is now generally...
- 2026
Your guide to Intune at Microsoft Ignite 2026
If you manage and secure endpoints, you are already on the front line of your organization’s AI transformation. Trusted, cloud native endpoint management and protection across Windows, macOS, and mobile devices are essential to preparing for AI, securing data and AI, and…
Links aka.ms/IntuneAtIgnite AI ready endpoints: secure, manage and scale Build a trusted device and app foundation for AI at scale
- 2026
What’s new in Microsoft Intune – October
Most changes to a device happen without the admin watching. A user turns off BitLocker to troubleshoot something. Patch Tuesday arrives. An agent starts working on a Cloud PC from an admin-configured pool. October’s new capabilities give admins more say over who…
Links Windows quality updates and .NET Framework updatesNew Quick machine recovery updates in Windows AutopatchNew Create a policy using settings catalog in Microsoft IntuneNew
- 2026
Generally Available: HTTP DDoS ruleset for Azure Front Door Premium WAF
Announcing the general availability of the HTTP DDoS ruleset for Azure Web Application Firewall (WAF) on Azure Front Door Premium. HTTP-layer DDoS attacks remain a leading cause of application downtime, and static controls such as IP filters and fixed rat
- 2026
Defending Linux in the age of AI-operated attacks
Linux supports cloud services, containers, developer environments, business-critical applications, and a growing share of AI infrastructure. That makes Linux both essential to modern enterprises and increasingly attractive to attackers. AI is compressing the time required to research targets, vary payloads, and adapt…
Links When AI infrastructure becomes the target: Securing gateways … Project Perception
Also: Tc defender endpoint - 2026
IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
IDC has named Microsoft a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises.
- 2026
Tracking AI adoption in North Korean threat actor tradecraft
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption. This blog breaks down how North…
Links AI as tradecraft: How threat actors operationalize AI Jasper Sleet: North Korean remote IT workers’ evolving … Diamond Sleet supply chain compromise distributes a modified …
- 2026Defender XDR GA
Now generally available: Discover local AI agents with Microsoft Defender
As local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough. Unlike static software, local agents such as coding assistants, command-line agents, desktop applications, and agentic development environments can operate on endpoints with access to a…
Links Microsoft Defender for Endpoint AI agent support matrixNew Discover local AI agents with Microsoft Defender for …New Set up AI agent runtime protection with Microsoft Defender …New
Also: Tc defender xdr - 2026
Establish a macOS security baseline with mSCP and Microsoft Intune custom compliance
By: Iris Yuning Ye, Product Manager | Microsoft Intune Organizations that manage Mac devices need a reliable way to evaluate their security posture against a recognized baseline. Microsoft Intune custom compliance provides the device compliance evaluation policy, and the National Institute of…
Links Use custom compliance settings in Microsoft Intune JSON conversion script frameworks supported by mSCP
- 2026
The CISO’s evolving role: Protecting and defending in the agentic era
As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threats. Aarti Borkar shares how security leaders can approach both.
- 2026
Growing our connector ecosystem with 500+ Microsoft Sentinel connectors
Connecting the modern security environment Having spent years working across Microsoft's cloud, AI, and customer-facing organizations. I have seen that technology delivers the greatest value when it works with the environments customers already operate. That's especially true in cybersecurity. Most organizations rely…
Links Reimagining the SOC for the agentic era in Microsoft …New Microsoft Security Store Building Microsoft Sentinel Connectors in Minutes with the …
- 2026
Windows 11, version 26H2 security baseline
Update : The Windows 11, version 26H2 security baseline has been updated to reflect the general availability of Administrator protection. An updated v2 package is now available, and organizations should review and test the existing Administrator protection configuration as appropriate for their…
Links Administrator protectionNew Microsoft Security Compliance Toolkit Windows 11, version 25H2 security baseline
- 2026GA
Large OS Disk Encryption is now generally available for Azure Confidential VM migrations
Today, we are excited to announce the General Availability of Large OS Disk Encryption (LOSDE) for Azure Confidential VM migration scenarios. This capability removes a key adoption barrier for customers migrating sensitive workloads to Azure Confidential Virtual Machines by enabling encryption for…
Links Migrate to Trusted Launch or Confidential virtual machines … About Azure confidential VMs
Also: Azure updates - 2026
Generally Available: Azure Front Door profile and route level WAF policies
Announcing the general availability of profile and route level policies for Azure Web Application Firewall (WAF) on Azure Front Door Premium. WAF policies are no longer limited to individual domains: you can now apply broad baseline protection across an e
- 2026
Part 4: See, investigate, and measure email and collaboration attacks with Defender reporting
Attacks rarely stay in one channel. A flood of spam email, a Teams chat from an unfamiliar organization, and a call from "the helpdesk" can all be part of the same attempt. Security teams need a unified way to see where attacks…
Links Part 3: Build custom email security reports with Power BI … Impersonating IT support: how threat actors turn a remote … Explore the Teams hunting queries
- 2026
Why identity needs network insight to make Zero Trust work
Your users sign in successfully—and then what? The session can be hijacked, device posture can degrade, and traffic to non-federated SaaS and AI apps can slip past the identity controls you trust to protect them. That’s the gap admins see every day…
Links Continuous access evaluation in Microsoft Entra Microsoft Entra Conditional Access: Zero Trust Policy Engine Global Secure Access documentation - Global Secure Access
- 2026
Azure WAF custom rules for PHP2Shell mitigation
Written in collaboration with Gunjan Jain and yuvalpery As described in our earlier blog, Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations , we strongly recommend upgrading to a patched version of PHP as soon as possible. Upgrading PHP…
Links Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: … WAF Custom Rule for Azure Front Door Azure Web Application Firewall (WAF) v2 Custom Rules on …
- 2026
Proofpoint’s Core Email Protection API solution joins the Microsoft Defender ICES vendor ecosystem
Email remains the most exploited gateway for cyberattacks, as the threat landscape continues to get more sophisticated with attackers using AI to scale phishing, malware, and business email compromise. Microsoft Defender is a leading email security solution , helping organizations stay ahead…
Links Defender for Office 365 ICES Vendor Ecosystem Integration … Microsoft named a leader in the 2025 Gartner® Magic … Introducing the Microsoft Defender for Office 365 ICES …
- 2026
Security Review for Microsoft Edge version 156
We have reviewed the new settings in Microsoft Edge version 156 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 151 security baseline remains our recommended configuration and can be downloaded from the Microsoft Security…
Links Microsoft Edge channel overview Microsoft Security Compliance Toolkit Security Baselines Discussion site
- 2026
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.
- 2026
Advancing Windows driver security: Removing trust for the cross-signed driver program
Microsoft announces the removal of trust for all kernel drivers signed by the deprecated cross-signed root program, enhancing Windows security by enforcing...
- 2026
How hotpatch updates help keep Windows secure by design
Explore the secure-by-default approach to keeping Windows 11 protected and productive.
- 2026
Hardening administrative actions: What IT pros need to know
Hardening administrative actions boosts Windows security, but might require updates to imaging, cloning, and auth workflows. Learn more.
- 2026
Advancing Windows security: Disabling NTLM by default
Learn how Windows is moving toward an NTLM-independent future with enhanced auditing, Kerberos enhancements, and a phased roadmap.
- 2026
Building a modern, secure, and seamless print experience for Windows
Windows is rethinking printing with a universal, secure platform designed to work seamlessly across devices and chips.
- 2026
Securing devices faster with hotpatch updates on by default
Get Windows devices secure faster with hotpatch updates enabled by default in Microsoft Intune.
- 2026
Unlocking Secure Agentic Productivity with Windows 365 for Agents
Run AI agents securely at scale in legacy and UI-based apps with Windows 365 for Agents and enterprise-grade governance
- 2026
Protect your estate: Reassess your Windows update policies
Explore a new Windows Autopatch report that shows you risk exposure based on configured policies and reflects new recommendations regarding patch compliance.
- 2026Preview
Windows 365 for Agents now in public preview: Run AI agents securely, at scale
Run AI agents securely on managed Cloud PCs with Windows 365 for Agents—now in public preview.
- 2026
Turn threat intelligence into informed action with Microsoft Defender
Every new threat raises a familiar set of questions. Is it targeting our industry? Are we exposed? What should we investigate first? Answering those questions takes more than another feed or a longer list of indicators. It takes intelligence that brings the…
Links Use Intel explorer in Microsoft Defender Transition to the new Threat intelligence experience in … MDTI convergence in Microsoft Sentinel and Defender XDR is …
Also: Tc defender xdr - 2026
Designing smarter access policies for hybrid enterprises
Every hybrid enterprise eventually reaches the same point: the security model that worked when everyone was inside the corporate network no longer holds up when people, apps, and data are distributed across clouds, data centers, and unmanaged devices. Add AI agents acting…
Links End VPN gaps with identity-first access How to enforce Zero Trust across every resource Run Global Secure Access with confidence: Introducing the …
- 2026
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.
- 2026
Announcing: Choose Your Own Telephony (CYOT) for Microsoft Entra
What and whyStarting October 30, 2026, Microsoft Entra ID will make the Choose Your Own Telephony Provider experience available. This feature enables organizations to use a supported third-party telecommunications provider for SMS and voice authentication
- 2026
Your Windows release information toolbox
Learn how to find the right information at the right time, whether you're checking what's new, investigating an issue, or planning an update.
- 2026Sentinel Preview
Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview)
As security teams bring in more data from more sources and use it across SIEM and XDR workflows, decisions about connector health, ingestion volume, and cost optimization get harder. Today, we’re announcing the public preview of Unified Data Management for Microsoft Sentinel…
Links Logs Ingestion API in Azure Monitor Unified Connectors Platform for Microsoft Sentinel Microsoft Sentinel data connectors
- 2026
Cloud Security Billing, Simplified: Introducing the Defender Workload Unit
That's the thinking behind an upcoming improvement to Microsoft Defender for Cloud: the Defender Workload Unit , or DWU. It's a new billing model and product experience that translates workload-specific usage into a common billing unit, with one unit price and one…
Links A 30-day platform trial Cloud Security Cost Estimator start onboarding
- 2026
Windows news you can use: June 2026
Get the latest Windows updates for IT admins: Windows 11 26H2, Secure Boot guidance, Intune app management, Windows 365, Windows Server, AI agents, and...
- 2026
Windows 365 for Agents: A secured execution environment for AI agents
See how Windows 365 for Agents secures agentic workloads with layered protection built into the platform.
- 2026
Collecting Delivery Optimization logs the easy way
Need to send logs to Microsoft support or want to dig in yourself? Explore the troubleshooter that makes it easy.
- 2026
Strengthening Key Management Service - (KMS) with Hardware-Based Trust
Learn how KMS with TPM attestation strengthens activation security and prepares enterprises for future compliance.
- 2026Sentinel GA
Expanded cross-tenant delegated access in Microsoft Defender is generally available
Security operations rarely stop at a single tenant boundary. Managed security service providers (MSSPs) protect many customer environments, and central security teams often operate across a tenant estate spanning business units, regions, or subsidiaries. In both cases, teams need to delegate security…
Links Configure delegated access with governance relationships for … Manage unified role-based access control in multitenant … Create custom roles with Microsoft Defender unified …
- 2026
Generally Available: Service tag match condition for Azure Front Door Premium WAF
Announcing the general availability of the service tag match condition for Azure Web Application Firewall (WAF) custom rules on Azure Front Door Premium. Service tags represent groups of IP address prefixes used by Azure services, and Microsoft updates th
- 2026
Generally Available: Keyless TLS on Application Gateway with Azure Key Vault Managed HSM
Azure Application Gateway now supports keyless TLS termination using certificates whose private keys stay in Azure Key Vault Managed HSM. Each TLS handshake signature is performed inside the HSM, and the private key is never exported to the gateway. This
- 2026
Configuring firewall and proxies for smooth Windows updates
Trouble connecting to Windows Update? Configure proxies and firewalls to respect DNS subdomains.
- 2026
Easily identify Windows protected print mode compatible devices
A new icon highlights printers that support Windows Protected Print Mode (WPP) for secure, modern IPP printing.
- 2026
Updated Secure Boot status report in Windows Autopatch
Get clear visibility into Secure Boot readiness with the Secure Boot status report.
- 2026
Reducing NTLM Dependency: IAKerb and LocalKDC in Windows Insider Preview
Windows expands Kerberos authentication to more scenarios with IAKerb and LocalKDC
- 2026
Windows device recovery in 2026: a guide for IT pros
From automated fixes to full rebuilds, explore the newest recovery tools that keep IT in control while helping address a broad range of scenarios:
- 2026Retirement Action may be required
Retiring NTLM: Frequently asked questions
NTLM has been a loyal companion to Windows since 1993. It helped us log in and share files, but it also quietly fueled a generation of red-team demos and incident reports. We're grateful for the service. We're also, respectfully, showing it the…
Links Windows message centerNew Advancing Windows security: Disabling NTLM by default Reducing NTLM Dependency: IAKerb and LocalKDC in Windows …
- 2026
Require Google Workspace authentication on Android Enterprise devices with Microsoft Intune
By: Samuel Vara, Software Engineer & Mayur Jadhav, Product Manager | Microsoft Intune We’re excited to announce that organizations using Android Enterprise can now require users on managed devices to authenticate with a managed Google Account. This capability is generally available in…
Links Create a policy using settings catalog in Microsoft IntuneNew New onboarding flow to managing Android Enterprise devices …
- 2026
Troubleshooting playbook for Auto labelling in SharePoint and OneDrive
Auto-labeling policies are how most organizations label the backlog of files at rest, and with the tenant ceiling now up to 500,000 files a day, more teams run them at scale. When a policy doesn't label what you expect, the cause is…
Links Automatically apply a sensitivity label to Microsoft 365 …New Resolve auto-labeling failures in SharePoint and OneDrive …New Review simulation results for auto-labeling policies in …New
- 2026Action may be required
Agents are your newest insiders. Security must move at their speed.
New capabilities in Microsoft 365 E7 and Project Perception help organizations contain agent risk and adapt protection continuously.
- 2026
Master Microsoft Entra with live webinars, AMAs, and on-demand videos
The identity security landscape never stands still, and neither should your knowledge. With evolving scenarios such as Zero Trust adoption, AI-driven automation, and hybrid security strategies, staying informed is essential. That’s exactly what we want to do together with you – stay…
Links Watch recording Secure AI at scale: Join the Microsoft Entra + Purview … Microsoft Entra News and Insights | Microsoft Security Blog
- 2026
ProcExp, ZoomIt, BgInfo, ListDLLs, ProcDump, ProcMon, PsKill, Sigcheck, ZoomIt for macOS, RDCMan
Process Explorer v17.2 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds process efficiency mode support,...
- 2026
Generally Available: External key management for Azure Key Vault Managed HSM
External key management for Azure Key Vault Managed HSM is now generally available in all Azure public regions. For organizations with regulatory or sovereignty requirements to retain physical control of key-encryption keys, it lets Azure services that su
- 2026
What’s new in Microsoft Entra: October 2026
Over the last few months, I've spent a lot of time with customers and our teams on one of the biggest security shifts ahead of us: securing an enterprise where people and AI agents are both acting on behalf of the business…
Links Learn about Universal Continuous Evaluation - Global Secure …New Token Protection Deployment Guide - WindowsNew Migrate to Microsoft Entra Cloud Sync with the Migration …New
- 2026
Managing open-weight model risk in enterprise deployments
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls.
- 2026Intune Retirement
Preparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment
Today, some organizations use an EnterpriseEnrollment DNS CNAME record to automatically direct devices to the Microsoft enrollment service during Windows MDM-only enrollment. Starting January 15, 2027, as part of our ongoing efforts to simplify and modernize enrollment experiences, Microsoft Intune will end…
- 2026Intune GA
Advanced Microsoft Intune capabilities are now available for GCC High
Advanced Intune capabilities are coming to GCC High G3 and G5. See what is included and how to put them to work now.
- 2026GA
Remote PC connections in Windows App on Windows generally available
Remote PC connections in Windows App on Windows generally available
- 2026GA
Generally Available: Standard service endpoint
Standard service endpoint, a new capability in the Azure Private Link family, provides a scalable and secure approach for connecting Azure IaaS workloads to Azure PaaS services. Standard service endpoint addresses the manageability, and the scale limitati
- 2026GA
Generally Available: Azure Cloud HSM hardware audit logging
Hardware Audit Logging for Azure Cloud HSM provides hardware-generated audit records for supported HSM management operations, helping organizations strengthen security monitoring, compliance reporting, governance, and forensic investigations. Customers ca
- 2026
Secure Linux desktops with Microsoft Defender
As more developers begin to use Linux desktops, they become more attractive to attackers: high-privilege, high-value, and easy for admins to overlook. A developer using Linux for day-to-day development may interact with source code repositories, continuous integration and continuous delivery (CI/CD) pipelines…
Links New features in Microsoft Defender for EndpointNew Prerequisites for Microsoft Defender for Endpoint on LinuxNew Security blog
Also: Tc defender xdr, Microsoft Learn - 2026
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies and other partners…
Links Complete Safe Links overview for Microsoft Defender for …New Enable and support passkeys in Authenticator for Microsoft …New Microsoft Security Copilot and Chat in Microsoft Defender
- 2026
Strengthening Semiconductor Supply Chain Trust with Microsoft’s Artifact Signing and Transparency
As enterprises expand their use of Confidential Computing in the cloud and in AI infrastructure, the security of the underlying hardware is more critical than ever. Organizations and their customers need confidence not only in the software they deploy, but also in…
Links About Microsoft's Signing Transparency Ledger What is Artifact Signing?
- 2026
Retirement: Azure Key Vault Secrets Provider Extension for Azure Arc enabled Kubernetes clusters
The Azure Key Vault Secrets Provider Extension for Azure Arc-enabled Kubernetes will be retired on October 9, 2027.Customers currently using the extension should plan to migrate to the Azure Key Vault Secret Store Extension before the retirement date. The
- 2026
Post-quantum authentication: Why organizations should start testing certificate ecosystems now
Prepare for post-quantum authentication by testing certificate ecosystems now. Learn how Microsoft’s PQC TLS Pilot Program helps advance future readiness.
- 2026
Protecting Organizations from External Email Risks in Microsoft 365 Copilot
Introduction As organizations embrace Microsoft 365 Copilot (Copilot), a new category of risk emerges: what happens when Copilot grounds its responses in untrusted external emails? Messages from external or unverified senders can carry content Copilot shouldn’t rely on. A new policy in…
Links Microsoft Purview DLP for Microsoft 365 Copilot and CoworkNew
- 2026
Why DLP for External Web Search in Microsoft 365 Copilot Matters?
Introduction Microsoft 365 Copilot (Copilot) grounds its responses in your organizational data—emails, files, chats—and, optionally, the public web. With web search enabled, Copilot fetches real-time information from the Bing search service to deliver richer, more current answers. But what happens when a…
Links Microsoft Purview DLP for Microsoft 365 Copilot and CoworkNew Data, privacy, and security for web search in Microsoft …New
- 2026
Generally Available: Exceptions in WAF for Azure Application Gateway and Azure Front Door
Announcing the general availability of exceptions for Web Application Firewall on Azure Application Gateway and Azure Front Door.Azure Web Application Firewall (WAF) helps protect your web applications from common threats and attacks. In some cases, WAF m
- 2026
Prepare for Windows Update certificate rotation in 2027
Review unsupported or outdated devices before May and June 2027.
Also: Tc windows itpro - 2026
Introducing the Microsoft Sentinel ASIM EmailEvent schema
Email remains one of the most common entry points for security threats. Yet email products often describe the same activity with different table names, fields, and values. This makes it harder to build detections and investigations that work consistently across data sources…
Links Microsoft Sentinel ASIM Email Event normalization schema … Learn about normalization and ASIM Explore the EmailEvent implementation in Azure-Sentinel
- 2026
The Microsoft AI and Agent Platform — Securing and Governing Intelligent Agents
In Part 1 , we explored the intelligence side of the Microsoft AI and Agent Platform: how agents understand work, reason over trusted context, use models and tools, and operate across experiences such as Microsoft 365 Copilot, Copilot Studio, Microsoft Foundry, Dynamics…
Links The Microsoft AI and Agent Platform — The Platform Behind …
- 2026
3 lessons from frontier AI vulnerability research
Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel.
- 2026
Microsoft Intune Settings Catalog updated to support Windows 11, version 26H2
10.06.26 Update: The Windows security baseline for Windows 11, version 26H2 is now available for all customers in Microsoft Intune. This baseline reflects current Microsoft security recommendations and is the latest available Windows security baseline in Intune. Windows 11, version 26H2 is…
Links Create a policy using settings catalog in Microsoft IntuneNew Windows 11 - release informationNew Learn about Intune security baselines for Windows devicesNew
Also: Microsoft Learn - 2026Retirement
Retirement: Always Encrypted with Intel SGX Enclaves
Always Encrypted with Intel SGX enclaves in Azure SQL Database will retire on October 31, 2027 as support for SGX-enabled DC-series hardware is phased out. Customers should transition to Virtualization-Based Security (VBS) enclaves, a hardware-independent
- 2026
CISO perspectives on managing vulnerability risks in the age of AI
Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management.
- 2026Azure security Preview
Public Preview: IPv6 Support for Application Gateway WAF
Announcing the Public Preview of IPv6 support for Application Gateway WAF.Application Gateway Web Application Firewall (WAF) now supports inspection and enforcement for IPv6 traffic in Public Preview, marking a major step forward in modernizing the platfo
- 2026Purview Preview
Meet the New Microsoft Purview Classifiers Experience: Your Admin Playbook for Public Preview
Microsoft Purview Unified Classification Management Experience Feature overview and administrator playbook Overview The new Classifiers experience brings supported Microsoft Purview classification types into one place where administrators can discover, create, inspect, and manage classifiers. It adds practical…
Links Public documentation
- 2026
Preparing governments for an era of interconnected cyber risk
According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025.
- 2026
Insights from the 2026 Microsoft Digital Defense Report
Read highlights from the 2026 Microsoft Digital Defense Report, which reflects a security environment that continues to grow more interconnected.
- 2026
Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026
This year at Microsoft Ignite, we spotlight our AI-first, end-to-end security platform designed to protect identities, devices, data, applications, clouds, infrastructure, and the AI agents now working alongside your teams.
- 2026
What’s new in Microsoft Sentinel: September 2026
Welcome back to What's new in Microsoft Sentinel. In September, Case Management brings investigation and collaboration together in Microsoft Defender, with a shared workspace to track work through resolution. Defender unified RBAC custom roles for granular delegated admin privileges (GDAP) give you…
Links Integrated Security Operations Center (ISOC) in Microsoft …New Integrated Security Operations Center in Microsoft Defender our Case Management blog
- 2026
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Microsoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance.
Links Security for Microsoft CopilotNew Microsoft Threat Intelligence Blog Protect AI assets from emerging threats and vulnerabilities …
- 2026
Microsoft Purview Referential Architecture Diagrams
The Microsoft Purview architecture diagrams provide a referential view of how data classification, sensitivity labeling, Data Loss Prevention (DLP) and Insider Risk operate across Microsoft 365 workloads. These diagrams are intended to help organisations understand where policy evaluation occurs, how signals flow…
Links Scaling classification and labeling: an interactive … Purview Deployment blueprints here
- 2026
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity
- 2026GA
Generally Available: Azure Arc-enabled SQL Server in Germany West Central
Azure Arc-enabled SQL Server is now available in Germany West Central, enabling you to connect SQL Server instances to Azure Arc and take advantage of Azure-based inventory, governance, security, assessment, and license management capabilities. Learn more
- 2026
What’s new in Microsoft Intune – September
Planning before the first devices receive updates is an important part of managing a rollout. IT admins must regularly decide which devices go first, how quickly a rollout expands, and where to pause when the signals change. The same need for control…
Links Microsoft Intune Enterprise Application ManagementNew Manage eSIM plans in Microsoft IntuneNew Configure the Microsoft Managed Home Screen AppNew
- 2026
Generally Available: Azure Database for PostgreSQL Flexible Server supports cross-tenant customer-managed keys (CMK)
Azure Database for PostgreSQL Flexible Server now supports cross-tenant customer-managed keys (CMK). You can encrypt your data using keys stored in an Azure Key Vault or Azure Managed HSM that resides in a different Microsoft Entra tenant than your Postgr
- 2026GA
Generally Available: SQL Server support on Azure Local connected mode
With SQL Server on Azure Local, you can run SQL Server workloads on Azure Local infrastructure while leveraging Azure services for centralized management, governance, monitoring, security, and licensing experiences. By connecting to Azure through Azure Ar
- 2026Retirement
Retirement: Azure IoT Central will be retired on September 20, 2029
Azure IoT Central will be retired on September 20, 2029. You can continue using Azure IoT Central until the retirement date, but we recommend starting your transition planning early.Why is this happening?As Azure IoT evolves, Microsoft is focusing future
- 2026Entra Preview
Public Preview : Microsoft entra kerberos authentication for Azure NetApp Files
Azure NetApp Files now supports Microsoft Entra Kerberos authentication for SMB volumes. The capability enables users with hybrid or cloud-only identities to authenticate through Microsoft Entra ID using cloud-issued Kerberos tickets. This capability remo
- 2026
Beyond source code: A path to the keys to the kingdom
Explore how Storm-3068 turned a compromised identity into broader cloud access and the steps organizations can take to defend their identities, pipelines, and cloud infrastructure.
- 2026
Sign in to Microsoft apps with passkeys from external identity providers
Organizations that use an external identity provider to authenticate Microsoft 365 users can now extend browser-based passkeys, security keys, and eligible single sign-on sessions to supported Microsoft app sign-ins—including Outlook, Teams, OneDrive, Word, Excel, PowerPoint, and Microsoft To Do—on Android, iOS, and…
Links Browser authentication for external identity providers in … feature documentation internalDomainFederation resource type
- 2026
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”.
- 2026
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.
- 2026
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders.
- 2026
Microsoft Intune and Apple OS 27: New settings, support, and platform changes
With Apple's release of OS 27, we’ve been working hard to ensure that Microsoft Intune provides support for Apple’s latest operating systems (OS) so that existing features work as expected, and adding support for new features that were introduced at WWDC. We’ll…
Links Create a policy using settings catalog in Microsoft IntuneNew Set up automated device enrollment (ADE) for iOS/iPadOSNew Device Action: Enhanced Log Collection - Microsoft Intune
- 2026
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment.
- 2026
What’s new in Microsoft Security: September 2026
This month's updates help you discover and control local AI agents, extend Zero Trust to agent traffic, and strengthen SOC foundations.
- 2026
Reimagining the SOC for the agentic era in Microsoft Defender
We are announcing ISOC in Microsoft Defender: a foundation built for agentic security that brings leading solutions for SIEM and threat protection together.
- 2026
Integrated Security Operations Center in Microsoft Defender
AI is transforming the attacker’s operating model, accelerating threats to unprecedented speed and scale. Yet many security operations centers still depend on fragmented data, tools, intelligence, and workflows. Analysts spend valuable time rebuilding context and coordinating action across systems, while the economics…
Links Read blog to learn more Microsoft Sentinel https://aka.ms/ISOCDefender
Also: Tc defender xdr, Microsoft Learn - 2026
Reimagining Case Management in Microsoft Defender
Security work extends beyond the signal Identifying a threat, exposure, or data risk is only the start. Security teams still need to assign ownership, bring together the right context, coordinate investigation and response, document decisions, track actions, and maintain accountability through resolution…
Links https://aka.ms/casedemovideo Microsoft Learn Read the Integrated Security Operations Center (ISOC) …
Also: Tc defender xdr - 2026
Unmasking EvilTokens: Getting to the root of device code phishing
EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.
- 2026
Prepare your tenant estate for AI: Join our upcoming webinars
Securing multiple tenants has never been more critical. From mergers and acquisitions to shadow IT and test environments, multi-tenant complexity can introduce gaps in security, compliance, and governance. Now that Microsoft Entra Tenant Governance is generally available, you can gain visibility across…
Links Licensing for Microsoft Entra Tenant GovernanceNew https://aka.ms/EntraTG-AMA https://aka.ms/EntraTG-webinar
- 2026
Bringing Defender Experts protection and proactive hunting into focus
As threats move faster and security environments grow more complex, security teams need to quickly understand what matters, where potential risks may exist,...
- 2026Entra Preview
Public preview of self-service onboarding for new Microsoft Entra App Gallery applications
Previously, publishing a new application to Microsoft Entra App Gallery could require multiple review cycles. Publishers submitted an integration, received feedback, made corrections, and resubmitted it, which delayed when customers could discover and deploy the application. Today, we're announcing the public preview…
Links Prerequisites to validate and publish your app Publish your app to Microsoft Entra App Gallery Update or remove your app from the Microsoft Entra App …
- 2026Preview
Public Preview: Azure Payments HSM v2
Azure Payments HSM v2 is a highly available, single-tenant Payment HSM service for payment processing, credential issuance, PIN processing, key management, and authentication data protection. Customers retain exclusive administrative control of an isolate
- 2026
From guidance to action: Security fundamentals that materially reduce risk
AI has made fundamental changes to the operating environment for cybersecurity. Explore exposure management guidance on recommended controls and take action and stay ahead of cyberthreats.
- 2026
Improving email security outcomes with real-world Microsoft Defender insights
The latest email security benchmarking reports show strong Microsoft Defender performance across pre-delivery and post-delivery scenarios and reveal where threats and defenses continue to evolve.
- 2026
Moving from Windows Autopilot to Windows Autopilot device preparation
By: Maggie Dakeva, Senior Product Manager - Microsoft Intune Organizations have spent years refining Windows Autopilot deployments. Profiles, Enrollment Status Page settings, group tags, dynamic groups, application assignments, and support processes all work together to deliver a familiar provisioning experience.…
Links Windows Autopilot for Pre-provisioned DeploymentNew Windows Autopilot Self-deploying ModeNew Enrollment for Microsoft Entra hybrid joined devicesNew
- 2026
Replace VPN access with identity-driven security
Traditional VPNs no longer fit the security or agility needs of modern enterprises. Static tunnels, device trust assumptions, and network-level access introduce risk in a Zero Trust world. Microsoft Entra Private Access offers a different path. As a component of Global Secure…
Links Plan and operate your Global Secure Access deployment Identity Under Attack: How AI Learns to Defend Introduction to Microsoft Global Secure Access Deployment …
- 2026
From DLP Alert Volume to Measurable Detection Assurance
Introducing Data Security Workbench Built on the newly released Microsoft Purview DLP API, Data Security Workbench is an open-source starting point for any customer who wants to turn DLP alert volume into explainable detection assurance and controlled response. Figure 1: The workbench…
Links Explore the project →
- 2026
Unpacking Endpoint Management - Podcast series - Intune Tech Community
Find out what works, what doesn't, and what organizations like yours have learned along the way.
- 2026
Simplify Employee Identity Lifecycle with HiBob and Microsoft Entra
Every workforce transition creates an identity moment that your IT team must get right. That’s why we’re excited to announce the general availability of HiBob’s native integration with Microsoft Entra. It helps you turn trusted workforce changes in HiBob into governed identity…
Links What is entitlement management? Transfer user SOA to Microsoft Entra ID Configure HiBob to Active Directory hybrid user provisioning
- 2026Sentinel Preview
Public Preview: Multi-account support for Microsoft Sentinel codeless connectors
Security teams rarely have just one of anything. Most SOCs run separate production, staging, and development accounts. Large enterprises segment by region, business unit, or brand. And managed security service providers (MSSPs) watch over many customers at once. Traditionally, ISVs have used…
Links Create a pull codeless connector for Microsoft Sentinel Support Multiple Connections in a Codeless Connector Semperis Lightning
- 2026
Protecting organizations from AI-assisted executive impersonation and invoice fraud
Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.
- 2026GA
Generally Available: TLS/SSL certificate and end-to-end TLS encryption support for Azure Functions Flex Consumption
Azure Functions Flex Consumption support for TLS/SSL certificates is now generally available through a new site-scoped certificate model. Each function app can hold up to 3 private (.pfx) and 3 public (.cer) certificates uploaded directly, imported from A
- 2026
Detect and disrupt AI-themed attacks with Microsoft Defender
See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain.
- 2026GA
Generally Available: User-bound user delegation SAS for Azure Storage
Announcing the addition of enhanced secure authentication in Azure Storage that combines the flexibility of user-delegation shared access signature (SAS) with the user-bound access of Entra ID. User-bound user delegation SAS is now generally available for
- 2026
Threat matrix: Mapping threats across cloud web applications
Microsoft introduces the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework that helps defenders understand, prioritize, and mitigate threats to cloud-hosted web apps and serverless platforms.
- 2026
Passkey-themed social engineering leads to identity and cloud compromise
Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance.
- 2026GA
Generally Available: Azure Developer CLI (azd) Extension Framework
The Azure Developer CLI (azd) Extension Framework is now generally available. The framework enables developers, teams, and partners to extend Azure Developer CLI with custom capabilities that support their preferred application development workflows.With
- 2026
How to secure edge AI in customer-owned environments
As AI moves into customer-owned environments, organizations need new ways to verify the systems, software, and AI assets they trust before releasing sensitive data, credentials, and models.
- 2026
Help Shape the Microsoft Security Practitioner Community
We want to hear from the people who configure, operate, and defend with Microsoft Security every day. Share your priorities, challenges, and where you go to learn and connect. Your feedback will help shape future technical content, hands-on experiences, events, and community…
- 2026
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them.
- 2026
Device Code Flow: The Gift That Keeps on Giving — To Attackers
Tags: Microsoft Entra ID, Conditional Access, Device Code Flow, OAuth, Azure Arc, Azure Migrate, Identity Security, Zero Trust Introduction Device Code Flow...
- 2026
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and…
- 2026
Instant revocation of service principal bearer tokens with CAE
Introduction Workload identities such as service principals are an important part of the attack surface in Entra: they are often used by critical automated processes, and they can carry privileged and sensitive permissions. The authentication flow used by these principals is the…
Links Securing workload identities with Microsoft Entra ID … Continuous access evaluation for workload identities in … Access token claims reference
- 2026Azure security Preview
Public Preview: Azure Front Door profile and route level WAF policies
Azure Front Door’s Web Application Firewall (WAF) now supports profile and route level WAF policy associations in public preview. This gives you more flexibility to apply broad baseline protection across an Azure Front Door profile while using targeted po
- 2026
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations…
- 2026
Generally Available: Microsoft Defender for Cloud support for Azure Container Apps (Serverless Containers Posture)
Customers can now bring Azure Container Apps environments into Microsoft Defender for Cloud’s Serverless Containers Posture experience, helping security teams extend posture management across more of their container estate from a single workflow. This mak
- 2026GA
Generally Available: Confidential VMs for Azure Linux
Confidential Virtual Machines (CVM) offer strong security and confidentiality for tenants. CVM for Azure Linux in AKS is now generally available and enables node pools with CVM to target the migration of highly sensitive container workloads to AKS without
- 2026
Cybersecurity IR Workshop: The workshop you shouldn’t miss
Cyber resilience starts before a crisis. Gain practical insights from DART to strengthen readiness and response.
- 2026
Generally Available: Azure Firewall auto-learn SNAT routes
Azure Firewall’s auto-learn SNAT routes is now generally available, automatically learning registered and private destination prefixes periodically and applying them as No-SNAT ranges to preserve original source IPs and simplify SNAT management.Learn more
- 2026
Stop identity attacks before they start with Microsoft ISPM recommendations
Many major breaches involve compromised identities, excessive privileges, or misconfigured access. Long before ransomware detonates or data leaves the building, adversaries are quietly abusing valid accounts, excessive privileges or other misconfigurations to move deeper into the environment. Identity has become…
Links https://security.microsoft.com/exposure-secure-scores Microsoft Defender for Identity Security Posture Assessments
Also: Tc defender xdr - 2026
Expanding memory integrity protection across Windows devices
Security works best when protection is built in, not bolted on. Beginning in October 2026, Microsoft will expand memory integrity protection across eligible devices, helping you and your organization benefit from stronger kernel-level protection from sophisticated attacks by default with little or…
Links Enable memory integrity Windows 11 security book Memory integrity enablement
- 2026Entra Action may be required
What’s new in Microsoft Entra: September 2026
Welcome to the September edition of “What’s New in Microsoft Entra.” This month, we’re highlighting new generally available and public preview capabilities that strengthen tenant governance, simplify identity lifecycle management, and help organizations secure access in the age of AI. We’re also…
Links Transition to Password-less Teams Shared Device Resource …New Microsoft Graph permissions referenceNew Tutorial: Govern access to an on-premises app (Preview)
- 2026
Security Review for Microsoft Edge version 152
We have reviewed the new settings in Microsoft Edge version 152 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 151 security baseline continues to be our recommended configuration which can be downloaded from the…
Links Microsoft Edge release scheduleNew Microsoft Edge channel overview Microsoft Security Compliance Toolkit
- 2026
Close the gaps: layered data protection with Microsoft Purview across endpoint, browser, and network
Three layers that work like a good team and slides to show it Data Loss Prevention (DLP) is not new, many use it daily without ever even knowing it, but with AI bringing faster results for productivity so does the risk of…
Links Learn about Endpoint data loss prevention Learn about Data Loss Prevention for Cloud Apps in Edge for … Learn about Microsoft Purview Network Data Security
- 2026
Introducing Multi-Account Support for Connectors in Microsoft Sentinel
We're excited to announce that Microsoft Sentinel's data connectors for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud now support multi-account ingestion — enabling you to connect and monitor multiple accounts or tenants from a single, unified connector configuration. The Challenge with Multi-Account…
Links Find your Microsoft Sentinel data connector
- 2026
From GPO to Microsoft Intune: A practical guide to cloud-first policy management
By: Per Larsen - Senior Product Manager | Microsoft Intune For many organizations, Group Policy Objects (GPOs) remain an important part of Windows configuration. As device strategies expand to include cloud-native management, Microsoft Intune provides the policy platform for devices that are…
Links Group Policy Management Console in Windows Use Microsoft Intune to import and analyze group policies settings catalog
- 2026
What’s new in Microsoft Sentinel: August 2026
Welcome back to What's new in Microsoft Sentinel. This August, Sentinel innovation kicks off with the AI-powered playbook generator, generally available to all Sentinel customers in the Microsoft Defender portal. Meanwhile, User and Entity Behavior Analytics (UEBA) anomalies enter public preview on…
Links AI-powered playbook generator, now available to more … Smarter signals, broader coverage: UEBA anomalies on top of … Public Preview: Nested API Support Comes to Microsoft …
- 2026
One SOC, Many Tenants: Centralizing Microsoft Sentinel with Azure Lighthouse
Most large organizations don’t live in a single Microsoft Entra ID tenant. Acquisitions, regulatory separation, sovereignty mandates, and mission boundaries all multiply tenants over time. For a security operations team, that sprawl creates one hard question: how do you run a single…
Links Manage Microsoft Sentinel workspaces at scale Manage multiple tenants in Microsoft Sentinel as a Managed … Extend Microsoft Sentinel across workspaces and tenants
- 2026
Security baseline for Microsoft Edge version 151
We are pleased to announce the enterprise-ready release of the security baseline for Microsoft Edge version 151! We have reviewed the settings in Microsoft Edge version 151 and updated our guidance with six new recommendations. We have also identified one additional setting…
Links Microsoft Edge Browser Policy Documentation … Security Compliance Toolkit Security Baseline Community
- 2026
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.
- 2026
What’s new in Microsoft Intune – August
At scale, endpoint management becomes a different job. A two-minute task on one device can become months of work across thousands of devices. Organizations can’t add headcount every time the device estate grows. They need repeatable processes that give IT admins’ time…
Links Overview of Windows Autopilot device association read the customer success blog on Autopilot device … Defender for Endpoint
- 2026
What’s new in Microsoft Security: August 2026
This month’s updates provide new capabilities to help organizations gain insights into agent activity, expand security coverage across supported environments, and enhance security management across their environments.
- 2026
Introducing device association for Windows Autopilot device preparation
By: Maggie Dakeva, Senior Product Manager - Microsoft Intune We’ve heard organizations want Windows deployment to be simple for employees and predictable for IT admins. But before a device enrolls, how does the organization know that the device is really one of…
Links Windows Autopilot device preparation user-driven Microsoft … Overview of Windows Autopilot device association Requirements for Windows Autopilot device association
- 2026
Generally Available: Azure Bastion shareable link expiration
Azure Bastion shareable link expiration is now generally available. When creating a shareable link, administrators can specify the date and time when the link should expire. After the configured expiration time, the link can no longer be used to connect t
- 2026Azure security Preview
Public Preview: IPv6 dual-stack support for Azure Bastion
Azure Bastion support for IPv4 and IPv6 dual-stack configurations is now available in public preview. Customers can configure a newly created Bastion deployment with both IPv4 and IPv6 public IP addresses. IPv6 is supported for connections between the use
- 2026
Generally Available: Connect to AKS clusters using Azure Bastion
Azure Bastion integration with Azure Kubernetes Service is now generally available. Customers can establish a secure tunnel from their local machine through Azure Bastion to an AKS cluster API server. The integration enables customers to use standard Kube
- 2026GA
Generally Available: Azure SRE Agent VNet Integration
Azure SRE Agent VNet Integration is now generally available. VNet integration enables Azure SRE Agent to operate within your existing network controls, including Network Security Groups (NSGs), private DNS, and firewall policies, etc. With VNet support, t
- 2026
When AI infrastructure becomes the target: Securing gateways and control points
Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity.
- 2026
Remote Help on Windows: Unattended Support with Remote Sign-In Is Here
By: Rodolfo Bermudez | Sr. Product Manager & Kara Wang | Product Manager 2 - Microsoft Intune Helpdesk teams have long asked for a way to remotely troubleshoot Windows devices without needing the user to be present. Whether it’s after-hours maintenance on…
Links Deploy Remote Help with Microsoft Intune Azure Virtual Desktop Agent Azure Virtual Desktop Agent Bootloader
Also: Roadmap - 2026
The patch window is collapsing: Why security needs a new control plane
Organizations need protection that operates in the gap between discovery and remediation.
- 2026
Generally Available: Custom block response code and body for Application Gateway WAF
Announcing the General Availability of custom block response code and body for WAF integrated with Application Gateway Azure WAF integrated with Application Gateway now supports customizable response status codes and bodies for blocked requests, enabling
- 2026
Support tip: Restore the Managed Home Screen Exit PIN
We identified and resolved a recent issue (IT1450132) that could cause the configured Managed Home Screen exit PIN to be removed from some existing Android Enterprise when updating older device configuration policies. While a fix has been deployed to address this, if…
Links Device restriction settings for Android in Microsoft IntuneNew Device Action: Suspend Managed Home Screen @IntuneSuppTeam
- 2026
Microsoft Entra ID enhances security of branded sign-ins
Microsoft Entra ID blocks custom CSS positioning properties to help deliver more secure and trusted branded sign-ins. [Action may be required]
- 2026
Microsoft named a Leader in the Frost RadarTM: Cloud Workload Protection Platforms, 2026
Microsoft is named a visionary leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, recognized for unified runtime security with Microsoft Defender for Cloud.
- 2026
Configure Delivery Optimization for Windows to save bandwidth and speed up deployments
By: Carlos Diaz - Sr. Product Manager and Jason Sandys - Principal Product Manager | Microsoft Intune Delivery Optimization is built into Windows and can help reduce bandwidth usage during app and update deployments. Instead of downloading content from the internet every…
Links Delivery Optimization referenceNew What is Delivery Optimization? Configure Delivery Optimization (DO) for Windows
- 2026
Smarter signals, broader coverage: UEBA anomalies on top of Behaviors layer and new data sources
Co-authors: Ron Shlomo and Ryan Smith Security teams don't struggle with a lack of security signals. The real challenge is understanding which activity matters, why it stands out, and where to focus first. Microsoft Sentinel's Behaviors layer already helps analysts transform raw…
Links Microsoft Sentinel’s AI-driven UEBA ushers in the next era … Turn Complexity into Clarity: Introducing the New UEBA … Translate raw security logs to behavioral insights using …
- 2026Azure security Preview
Public Preview: Ipv6 support in Azure Firewall
Azure Firewall now supports IPv6 in public preview, enabling customers to configure Azure Firewall and Firewall Policy in dual-stack mode for both IPv4 and IPv6 traffic. This preview allows native IPv6 network-rule filtering and DNS Proxy support, helping
- 2026
Hunting MacSync Stealer infrastructure through behavioral pivots
MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft uncovered 30+ related domains using durable hunting pivots.
- 2026
Why Active Directory alone is no longer enough
Most organizations have moved their applications, devices, and business processes to the cloud, but identity often remains dependent on Active Directory. That gap can increase operational complexity, limit modern security controls, and slow the adoption of new cloud and AI capabilities. For…
Links Road to the cloud - Implement a cloud-first approach when … Road to the cloud - Introduction to moving identity and … Road to the cloud - Determine cloud transformation posture …
- 2026
Security Review for Microsoft Edge version 150
We have reviewed the new settings in Microsoft Edge version 150 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 139 security baseline continues to be our recommended configuration which can be downloaded from the…
Links Microsoft Security Compliance Toolkit Security Baselines Discussion site
- 2026
Support tip: Known issues in reporting and viewing compliance policies
The Intune team is aware of compliance reporting behavior in the Microsoft Endpoint Manager admin center that causes confusion among some of our customers.
- 2026Sentinel Retirement
Retirement: Containerized data connector agent for the Microsoft Sentinel solution for SAP applications
On September 14, 2026 we will retire the containerized data connector agent for the Microsoft Sentinel solution for SAP applications. After this date the agent will be permanently disabled and will stop sending SAP logs to Microsoft Sentinel.The SAP agent
- 2026Azure security Preview
Public Preview: Azure Front Door mutual TLS
Mutual TLS, also known as client certificate authentication, enables Azure Front Door to authenticate clients using X.509 certificates before requests reach an application. It helps protect sensitive applications and APIs across business-to-business, Inte
- 2026
How to enforce Zero Trust across every resource
This post builds on the strategic foundations introduced in End VPN gaps with identity-first access . Read the strategic overview to understand why Zero Trust must apply to every resource before diving into implementation. TL;DR: Your quick guide Reduce deployment risk by…
Links Sign in to your account What is Global Secure Access? - Global Secure Access Risk policies
- 2026
Generally Available: 2.2X IDPS performance optimization in Azure Firewall
Azure Firewall Premium now delivers up to 22 Gbps throughput with TLS inspection and IDPS in Deny mode, a 120% increase from 10 Gbps, and up to 600 Mbps per TCP connection with IDPS enabled in either Alert or Deny mode (doubled…
- 2026
Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent
Overview We previously announced the public preview of the Microsoft Sentinel connector builder agent via VS code extension, that helps developers build Microsoft Sentinel codeless connectors faster with low-code and AI-assisted prompts. This post walks through a hands-on lab using a mock…
Links Onboard to Microsoft Sentinel How to install the Azure CLI Microsoft Sentinel connector builder agent
- 2026
MDTI is Converging into Microsoft Sentinel and Defender XDR
In today’s rapidly evolving threat landscape, organizations need threat intelligence (TI) that is woven seamlessly into every step of their security...
- 2026
What’s New at Ignite: Powerful Enhancements in Unified Threat Intelligence
At Microsoft Ignite 2025, we’re unveiling transformative upgrades in threat intelligence designed to empower security teams. With the Threat Intelligence...
- 2026
Introducing the Threat Intelligence Briefing Agent
As cyber threats rapidly evolve, security teams are overwhelmed by the sheer volume of threat intelligence, making it challenging to deliver timely, targeted...
- 2026
New at Ignite: TI Guided Experience in Security Copilot
The Security Copilot team is consistently improving the threat intelligence (TI) experience for customers. At Microsoft Ignite 2024, we're thrilled to...
- 2026
New Security Copilot Plugin Name Reflects Broader Capabilities
The Copilot for Security team is continuously enhancing threat intelligence (TI) capabilities in Copilot for Security to provide a more comprehensive and...
- 2026
Introducing the MDTI Home Page Widget and Article Digest
The MDTI team is excited to introduce the MDTI Article Digest, a new way for customers to stay up to speed with the latest analysis of threat activity...
- 2026
Introducing the MDTI Premium Data Connector for Sentinel
The MDTI and Unified Security Operations Platform teams are excited to introduce an MDTI Premium data connector available in the Unified Security Operations...
- 2026
More Threat Intelligence Content In MDTI, TA Enables Better Security Outcomes
Microsoft threat intelligence empowers our customers to keep up with the global threat landscape and understand the threats and vulnerabilities most...
- 2026
MDTI Earns Impactful Trio of ISO Certificates
We are excited to announce that Microsoft Defender Threat Intelligence (MDTI) has achieved ISO 27001, ISO 27017 and ISO 27018 certifications.
- 2026
Introducing Automatic File and URL (Detonation) Analysis
We are excited to announce the new file and URL intelligence (detonation) enhancement made in our Threat Intelligence blade within the Defender XDR user...
- 2026
Unified MDTI APIs in Microsoft Graph Now GA
We’re thrilled to share that the unified APIs that are part of the Microsoft Graph are now generally available! These APIs come with a single endpoint,...
- 2026
MDTI Adds Microsoft Threat Intelligence to Silobreaker
Microsoft Defender Threat Intelligence (MDTI) adds Microsoft Threat Intelligence reputation enrichment to Silobreaker!
- 2026
How MDTI Helps Power Copilot for Security
This blog post will delve into Copilot for Security, focusing on the strategic utilization of Microsoft Defender Threat Intelligence (MDTI), a comprehensive...
- 2026
Using MDTI with the Diamond Model for Threat Intelligence
Microsoft Defender Threat Intelligence (MDTI) provides robust tools and features that enable security analysts to quickly investigate incidents and respond...
- 2026
What's New at Microsoft Ignite 2023
The Microsoft Defender Threat Intelligence team (MDTI) continuously introduces innovations that make its strategic, tactical, and operational threat...
- 2026
Unleash the Power of Threat Intel: Introducing the MDTI GitHub
Are you looking to enhance your organization's security processes? The Microsoft Defender Threat Intelligence (MDTI) GitHub offers technical solutions for...
- 2026
What's New: MDTI Intel Reporting Dashboard and Workbook
We are excited to announce the launch of a new dashboard that we have created to enhance our threat intelligence reporting capabilities. This dashboard...
- 2026
New Threat Actor Intel Profiles Added to MDTI
The Microsoft Defender Threat Intelligence (Defender TI) team has recently launched twenty-six new threat actor Intel Profiles, and more than 50 additional...
- 2026
What’s New: MDTI Interoperability with Microsoft 365 Defender
Microsoft Defender Threat Intelligence (MDTI) helps streamline security analyst triage, incident response, threat hunting, and vulnerability management...
- 2026
What's New: APIs in Microsoft Graph
Unified APIs part of the Microsoft Graph with a single endpoint, permissions, auth model, and access token are now available. We’re happy to share that...
- 2026
What's New: MDTI Microsoft Sentinel Playbooks
During Microsoft Secure, we announced new capabilities that help enterprise users power up automation with Defender Threat intelligence, including an...
- 2026
What's New: Intel Profiles Deliver Crucial Information, Context About Threats
Microsoft is thrilled to introduce Intel Profiles within Microsoft Defender Threat Intelligence. This feature offers a single, reliable source of...
- 2026
What's New at Microsoft Secure
Today, we are excited to announce several new features and capabilities that put more threat actor insights at our customers' fingertips and enhance SIEM...
- 2026
Performing a Successful MDTI Proof of Concept (PoC)
To effectively determine the benefits of adopting Defender Threat Intelligence, you should perform a Proof of Concept (PoC). Before enabling Defender Threat...
- 2026
Microsoft Defender for Cloud and Defender for Threat Intelligence are Better Together
When used together, Microsoft Defender for Cloud (MDC) and Microsoft Defender Threat Intelligence (MDTI) enable analysts to quickly understand exposures and...
- 2026
Infrastructure Chaining with Microsoft Defender Threat Intelligence
Infrastructure Chaining is used to investigate the relationships between connected datasets which allows an analyst to develop an investigation into events...
- 2026
Become a Microsoft Defender Threat Intelligence Ninja: The complete level 400 training
Learn how to become a Microsoft Defender Threat Intelligence (MDTI) Ninja! This blog will walk you through the resources you'll need to master and make best...
- 2026
What's in an MDTI Web Crawl?
Want to learn how data found from the DOM of web pages is so powerful when it comes to investigating threats? Check out this blog to learn more about...
- 2026
Introducing Microsoft Defender Threat Intelligence Community
Come learn about the differences between Microsoft Defender Threat Intelligence's Community vs. Premium level of access.
- 2026
Understanding and Using Finished Threat Intelligence
Raw versus finished cyber threat intelligence? What's the difference and why should I care about both? Check out this blog to learn why!
- 2026
Getting the Most Out of Projects in Defender TI
Want to learn about an easier way to collaborate with peers during investigations? Look no further! Microsoft Defender Threat Intelligence's Projects feature...
- 2026
Using Reputation and Analyst Insights Features For Quick Indicator Assessments
Understanding if a host, domain, or IP address is good, bad, or otherwise, can be difficult during your security incident triage process. Microsoft Defender...
- 2026
Getting Started with Microsoft Defender Threat Intelligence
So you're interested in Microsoft Defender Threat Intelligence, but don't know where to start? Learn how to start a Premium trial or sign-up for Community...
- 2026
Get to Know the Datasets and How to Use Them During Investigations
The internet can be confusing sometimes. Understanding its datasets doesn't have to be. Come learn how Microsoft Defender Threat Intelligence's datasets can...
- 2026
Defender TI Detections in Microsoft Sentinel
Did you know that you can benefit from Microsoft Defender Threat Intelligence if you're a Microsoft Sentinel customer? Come and learn how Microsoft Defender...
- 2026
Exploring Target User Functions and Use Cases
Microsoft Defender Threat Intelligence seems like an awesome product, but what are its use cases and who should use it? Check out this blog to learn more.
- 2026
How Microsoft Defender Threat Intelligence Enables Threat Hunting Success
Microsoft Defender Threat Intelligence (MDTI) is powerful in the hands of a threat hunter. In this blog, we’ll show you why.
- 2026
How Internet Telemetry Data Becomes Threat Intelligence
So how does Microsoft Defender Threat Intelligence collect, analyze, and index its raw public internet telemetry data? Check out this blog to learn more.
- 2026
Welcome to the Microsoft Defender Threat Intelligence Tech Community
The Microsoft Defender Threat Intelligence (DTI) Tech Community will offer the latest content on how you and your team can get the most out of DTI's...
- 2026
We Are Pleased To Introduce the Microsoft Defender Threat Intelligence Ninja Training Series!
Microsoft has introduced Microsoft Defender Threat Intelligence (MDTI) Level 400 Ninja Training.
- 2026
New at Ignite: Unified Threat Intelligence Experience in Security Copilot
The Security Copilot team is continuously enhancing threat intelligence (TI) capabilities in Copilot. At Microsoft Ignite 2024, we’re excited to announce...
- 2026
MDTI for Government Now Available
We are thrilled to introduce Microsoft Defender Threat Intelligence (MDTI) with FedRAMP High (DOD IL2) attestation are now available for government sectors....
- 2026
MDTI Achieves PCI DSS Certification: Elevating Security Standards
We are excited to announce that MDTI has successfully obtained the Payment Card Industry Data Security Standard (PCI DSS) certification, representing a...
- 2026Defender XDR Retirement
MDTI Standalone Portal Retirement and Transition to Defender XDR
On June 30th, 2024, the Microsoft Defender Threat Intelligence (MDTI) standalone portal will reach end-of-life and the Microsoft Defender XDR portal will...
- 2026
Managing “Defender Threat Intelligence” MDTI Premium licenses in Microsoft Entra Admin Center
Learn how to manage MDTI Premium seat assignments in your Microsoft Entra Admin Center.
- 2026
Introducing MDTI Free Experience for Microsoft Defender XDR
Now available in all Microsoft Defender XDR tenants. With the new Microsoft Defender Threat Intelligence (MDTI) free experience, security professionals of...
- 2026
What's New: Hash and URL Search Intelligence
Microsoft Defender Threat Intelligence (Defender TI) now includes File Hash and URL Search capabilities, enabling researchers, analysts, hunters, and...
- 2026
MDTI empowers defenders to get more done with less
A recent peer-reviewed commentary published by the Sans Institute explores the critical role of cyber threat intelligence in attack surface management....
- 2026
Microsoft Defender Threat Intelligence Overview, Concepts, and Vocabulary
Never heard of Microsoft Defender Threat Intelligence? No matter! This blog walks you through an overview of our product.
- 2026Entra GA
Microsoft Entra Tenant Governance is now generally available
Today, we’re excited to announce the general availability of Microsoft Entra Tenant Governance, a built-in capability that helps organizations centrally govern and secure multi-tenant environments at scale. Why centralized tenant governance matters Tenants represent your organization, housing its identities,…
Links Licensing for Microsoft Entra Tenant GovernanceNew Microsoft Agent 365 - Service DescriptionsNew Manage agents across multiple tenants in the Microsoft 365 …
- 2026
What's New in Microsoft Entra: August 2026
Hello everyone, I'm Yina Arenas. I'm honored to have joined Microsoft Security as the CVP and Chief Product Officer of Identity and Network Access and to introduce myself to the legendary Microsoft Entra community. Having spent much of my career focused on…
Links Add OIDC for customer sign-inNew Configure device sync with Microsoft Entra Cloud SyncNew Admin Control for SSO prompts
- 2026
MCP safety & evaluation with the Agent 365 CLI & Agent Governance Toolkit
Co Author: JiteshThakur AI agents are useful because they can act. They call tools, query databases, send messages, and hand work to other agents. That same freedom creates a problem: access control can tell you which service an agent may reach, but…
Links Overview of the Tools page in Microsoft 365 admin centerNew Install and Use the Agent 365 CLINew Securing AI Agents at Runtime: Real-Time Protection and …
- 2026
Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
Microsoft is named a Leader in the 2026 IDC MarketScape for MDR services. Discover how Microsoft Defender Experts MDR combines AI, threat intelligence, and human expertise.
- 2026
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims.
- 2026Sentinel GA
AI-powered playbook generator, now available to more customers
We’re excited to announce we’re making it easier than ever to go from intent to action with the AI-powered playbook generator now available to more customers. What’s new All Microsoft Sentinel customers in Defender portal can now create AI-generated playbooks directly in…
- 2026Sentinel Preview
Public Preview: Nested API Support Comes to Microsoft Sentinel CCF
Microsoft Sentinel continues to evolve its capabilities to support an expanding ecosystem of partners and data integrations. Recent innovations include the Codeless Connector Framework (CCF) Push feature , the new Sentinel connector builder agent , and the CCF expansion to pull data…
Links Push feature Accelerate connectors development using AI agent in … Azure Storage Blob
- 2026
Monthly News-August 2026
Microsoft Defender Monthly news - August 2026 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the…
Links AI agent posture risk in Microsoft DefenderNew Migrate from sensor v2.x to sensor v3.xNew Deploy the Microsoft Defender for Identity sensor v3.xNew
Also: Tc defender xdr - 2026
Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP)
Learn why KuppingerCole named Microsoft a Leader in its Leadership Compass: Cloud Native Application Protection Platforms report.
- 2026
Building a CCF Nested API Pull Connector: A Technical Lab Walkthrough
This post walks through building a Microsoft Sentinel Codeless Connector Framework (CCF) RestApiPoller connector that uses the nested API polling pattern. The nested pattern exists for a specific reason: many enterprise APIs do not return enriched records from a single call. Instead…
Links Onboard to Microsoft Sentinel How to install the Azure CLI CCF Pull Connector - Nested API Accelerator
- 2026
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. The change makes malicious infrastructure harder to detect while giving defenders new hunting opportunities.
- 2026
Containment Strategies for AI now available in Secure Now
Recent public disclosures have reinforced why building foundational security matters. Security researchers and leading AI labs have highlighted scenarios where autonomous AI systems were able to exploit common security weaknesses, move across trust boundaries, and perform actions at a speed and scale…
Links aka.ms/Securenow
- 2026
End VPN gaps with identity-first access
Traditional VPNs extend network access—but they were not built continuously evaluate identity, device posture, location, user risk, or session context. That gap can leave AI apps, SaaS, on-premises applications, unmanaged services, and internet traffic unevenly protected. Zero Trust closes this gap by…
Links Zero Trust Implementation Guide Microsoft Entra Conditional Access documentation Operations Guide for Secure Access
- 2026
Generally Available: Explicit proxy in Azure Firewall
Azure Firewall explicit proxy is now generally available. Explicit proxy enables customers to configure applications and browsers to send HTTP and HTTPS traffic directly to Azure Firewall using proxy settings, providing an alternative to route-based traffic steering and enabling more granular control…
Links Azure Firewall explicit proxy
- 2026
Become a Microsoft Defender for Endpoint Ninja
Do you want to become a ninja for Microsoft Defender for Endpoint? We can help you get there!
- 2026
- 2026
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. This analysis details the attack chain, affected environments, and practical guidance for detection, hunting, and remediation.
- 2026
Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps
Microsoft expands its Zero Trust for AI strategy to enhance security for AI and DevSecOps environments with new tools and guidance.
- 2026
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET
Microsoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread.
- 2026
Microsoft Entra ID security updates: What organizations need to do now
Prepare now for three Microsoft Entra ID changes affecting Custom controls, credential registration, and SSPR enforcement.
- 2026
Microsoft Defender for Cloud Customer Newsletter
*This will be the last monthly MDC newsletter. To keep up with the latest, please visit: What's new in MDC What's new in Defender for Cloud? Multiple container security features are now Generally Available: Container-level misconfiguration recommendations for Kubernetes, Upgrade AKS version…
Links What's new in MDC documentation Built to Protect: The Architecture Behind Codename MDASH
- 2026GA
Secure by default: Trusted Launch as Default is now Generally Available
We are excited to announce that Trusted Launch as Default (TLaD) is now Generally Available for new Azure Generation 2 (Gen2) virtual machines (VMs) and virtual machine scale sets. With this milestone, new Gen2 deployments come up with Secure Boot and a…
Links Trusted Launch for Azure VMsNew Enable Trusted launch on existing Gen2 VMs Set up preview features in Azure subscription
- 2026
Why AI Agents May Require a New Security Operations Model
Organizations are rapidly adopting AI agents to retrieve data, invoke tools, automate workflows, interact with applications, and increasingly make decisions on behalf of users. As these agents become part of the enterprise workforce, they introduce an entirely new security surface. A compromised…
- 2026
From AI Experiments to Digital Workforce: Do Enterprises Need a Chief Agent Officer?
As organizations move from deploying a handful of AI copilots to managing fleets of task-specific agents, a new challenge is emerging - Ownership. Today's AI agents can do far more than answer questions. They can access enterprise data, invoke tools, interact with…
- 2026GA
Writeback for Cloud-Managed Remote Mailboxes: Now Generally Available
Writeback for cloud-managed remote mailboxes is now Generally Available!
- 2026
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch.
- 2026
Detecting CVE-2026-54121 (Certighost) with Microsoft Defender
What is CVE-2026-54121? CVE-2026-54121 is an authentication-bypass vulnerability in Active Directory Certificate Services that allows an attacker to obtain certificates for arbitrary domain computer accounts, including Domain Controllers. A valid Domain Controller certificate enables escalation to full domain…
Links Configure Windows event auditingNew What's newNew More details about VCE-2026-54121 can be found here
Also: Tc defender xdr - 2026
What’s new in Microsoft Sentinel: July 2026
Welcome back to What's new in Microsoft Sentinel. In July, Sentinel adds custom detections support in Sentinel repositories, so you can manage detections as code alongside your analytics rules, playbooks, parsers, and workbooks, authoring in GitHub and deploying through the CI/CD pipelines…
Links Manage custom content with repository connections Read the blog Understand your Sentinel tables at a glance: Monitor with …
- 2026
Accelerate Your Security Copilot and Agentic Security Readiness with Virtual Technical Workshops
These virtual technical workshops for practitioners looking to build AI-for-Security expertise across Microsoft Entra, Intune, Purview, and Threat...
- 2026Azure security Preview
Public Preview: Symmetric keys on Azure Key Vault Premium
We’re announcing post-quantum resilient symmetric keys on Azure Key Vault Premium are now available in public preview. This preview enables customers and partners to evaluate symmetric encryption capabilities using the oct-HSM key type and the Advanced Encryption Standard (AES) algorithm directly within…
- 2026
Built to Protect: The Architecture Behind Codename MDASH
Information Table Defender Foundations Regional Operation AI & Data Containment Responsible Governance Built as a production Microsoft Security service, not an isolated research system. Operates alongside Microsoft Defender in the clouds and regions customers already use. Designed to keep source, findings, and…
- 2026
What’s new in Microsoft Security: July 2026
This month’s updates help security and IT teams secure their AI environments, use AI to defend, and strengthen the foundations that AI-powered operations depend on.
- 2026
The Microsoft AI and Agent Platform — The Platform Behind Intelligent Agents
Why the platform around the model is the real enterprise differentiator Enterprise AI has reached a turning point. Beyond answering questions, it can now reason over business context, retrieve knowledge, use tools, coordinate workflows, and act across enterprise systems. This shift raises…
- 2026
MDTI convergence in Microsoft Sentinel and Defender XDR is complete
Beginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal, giving customers real-time Microsoft threat intelligence across detection, investigation, response, hunting, and automation at no additional cost. Announced last year,…
Links Threat intelligence in Microsoft Defender MDTI is Converging into Microsoft Sentinel and Defender XDR View threat intelligence in entity pages in Microsoft …
Also: Tc defender xdr - 2026
Better security starts with better questions
Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems.
- 2026
What’s new in Microsoft Intune – July
Ask an IT admin what a good day looks like, and it usually comes down to one word: control. Control means you push a change and know it landed. It means you have a clear view into your device fleet, from compliance…
Links Overview of Windows AutopilotNew Overview of Windows Autopilot Device PreparationNew Use custom compliance settings in Microsoft Intune
- 2026
Registry Inventory in Microsoft Intune: Verifying What’s on Your Devices
By: Madison Cooks, Product Manager | Microsoft Intune IT admins need a reliable way to confirm how Windows devices are configured, especially when troubleshooting, validating compliance, or investigating security posture. Policy assignment alone doesn’t always show what’s present on the device and…
Links @IntuneSuppTeam
- 2026
Securing AI Agents at Runtime: Real-Time Protection and Threat Detection for Microsoft Agent 365
Organizations are rapidly adopting AI agents to automate workflows, access enterprise data, invoke tools, and take actions on behalf of users. This autonomy creates a fundamentally new security challenge. Unlike traditional AI applications, agents operate across dynamic execution flows, interacting with external…
Links Add and manage toolsNew Enable security for AI agents using Microsoft DefenderNew Protect AI agents in real time using Microsoft Defender
- 2026
Generally Available: HTTP header insertion in Azure Firewall
Azure Firewall now supports HTTP header insertion, enabling organizations to add or overwrite HTTP/HTTPS request headers directly from Azure Firewall application rules. This capability helps customers enforce security controls, support tenant restriction scenarios, integrate with backend services, and simplify…
Links Azure Firewall HTTP Header Insertion Configuration
- 2026
Level Up Your Security Skills This August with the Microsoft Defender Challenge and Learn Live
Security teams face an increasingly complex landscape. Threats span identities, endpoints, email, cloud workloads, and emerging AI environments. The best defenders aren't just reacting to threats—they're continuously building the skills needed to stay ahead. That's why we're inviting security practitioners to build…
Links Microsoft Certified: Security Operations Analyst Associate - … Microsoft Certified: Cloud and AI Security Engineer … Security hub - Security
- 2026
Rethinking security for the age of AI
The physics of cybersecurity are changing. Introducing security's new cyber stack: Project Perception.
- 2026
Enhancing AI security through global AI red teaming
Microsoft's External Red Team Alliance (EXTRA) is a global AI security initiative designed to advance AI safety research and red teaming. By partnering with universities, researchers, and regional experts, EXTRA helps identify emerging AI risks, improve security testing, and strengthen…
- 2026Exposure Management Preview
Prioritize exposure resolution with a new dashboard experience (public preview)
Cut Through the Noise and Focus on What Matters Most Security teams face a constant challenge: too many findings, too many dashboards, and not enough clarity on where to act first. Organizations today are managing vulnerabilities, internet-facing assets, misconfigurations, code weaknesses, exposed…
Links Learn more about using the new dashboard here
- 2026
How Nationwide stays ahead of attackers with Project Perception
Nationwide, the world’s largest building society, is among the first organizations to put Microsoft’s new agentic security system to work. Facing adversaries who now regularly weaponize AI, the society is using Project Perception’s coordinated multi-agent defense — red, blue, and green agents…
- 2026
From the frontlines: Frontline worker management with Microsoft Intune
So, here we are. You’ve been asked to start managing frontline devices for your organization with Intune. You may be a pro with Intune management - with...
- 2026
From hours to minutes: Rethinking Microsoft Intune compliance reporting with the Export API
By: Daniel Gerrity – Principal Product Manager | Microsoft Intune If you manage a large device fleet with Microsoft Intune, you’ve almost certainly needed to get reporting data out of the service at scale — compliance state, device inventory, app status, endpoint…
Links Intune Graph API - Reports and Properties @IntuneSuppTeam
- 2026
Modernize SAP Identity Management with Microsoft Entra
Many organizations are rethinking how they manage identity across their SAP landscape as they move away from on-premises identity management systems and adopt a more unified cloud strategy. That shift often starts with a practical question: how do you connect SAP identity…
Links Migrate identity management scenarios from SAP IDM to … past two years Read the SAP IDM to Microsoft Entra migration guidance
- 2026
What's New in Microsoft Entra: July 2026
Welcome to the July edition of our monthly newsletter, summarizing the latest news and developments in the exciting, ever-evolving world of Microsoft Entra. What went into General Availability (GA) since June 2026? Microsoft Entra Backup and Recovery - A capability that helps…
Links Configure Microsoft Entra Kerberos trustNew Add a SAML/WS-Fed identity providerNew Microsoft Entra AD object enforcementNew
- 2026
Designing Intune enrollment for frontline workers: Choosing the right path for real-world devices
By: Shawn Catlin – Senior Product Manager | Microsoft Intune and Sucheta Gawade, Microsoft MVP (Azure & Security / Intune) Practitioner perspective from Sucheta Gawade, Microsoft MVP (Azure & Security / Intune), with deep experience in secure frontline mobility, including regulated healthcare…
Links Migrating Frontline Mobile Devices: Understanding the … Migrating frontline mobile devices: Identity considerations … Get started with Android frontline worker devices
- 2026Azure security Preview
Public Preview: Azure DDoS Protection custom policy
Azure DDoS Protection custom policy is now in public preview. This capability provides per-resource control over DDoS mitigation thresholds for protected Standard Load Balancer frontend IP configurations. Customers can configure fixed inbound detection thresholds for TCP, UDP, and TCP SYN traffic. Thresholds…
Links What is Azure DDoS Protection custom policy? (preview)New Create a DDoS Protection custom policy in the Azure portal …New Create an Azure DDoS Protection custom policy using Azure …New
- 2026
Email threat landscape: Q2 2026 trends and insights
In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage…
- 2026
Defending the Inbox Against Prompt Injection Attacks
AI assistants are quickly becoming part of everyday work—summarizing emails, drafting responses, triaging requests, and even potentially acting across connected business systems. As email becomes an automated input to AI systems, it can also become a new attack surface. Attackers no longer…
Links Prompt injection protection in Microsoft Defender for Office …
Also: Tc defender xdr, Tc defender xdr - 2026
Real world incident response: Microsoft and AXA XL strengthen cyber resilience
Our collaboration with AXA XL brings Microsoft Incident Response services directly to cyber insurance policyholders, helping organizations coordinate technical, business, and insurance decisions.
- 2026
Secure AI, web, and private apps with Zero Trust
Explore the latest Microsoft Entra capabilities to secure AI traffic, protect sensitive data, and extend identity-first Zero Trust controls across web and...
- 2026
Plan your Azure AD B2C migration with the Migration Policy Analyzer
Migration planning starts with visibility One of the first challenges organizations face when planning a migration from Azure AD B2C to Microsoft Entra...
- 2026
Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks
Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and our reception.
- 2026
ACR Stealer: Two observed intrusion chains amid increased threat activity
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.
- 2026
Least privilege for AI agents: Identity, access, and tool binding
As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure.
- 2026
Run agentless SAP connector cost-efficiently
The SAP agentless connector uses SAP Integration Suite (Cloud Integration/CPI) to fetch SAP audit log data and forward it to Microsoft Sentinel. Because SAP...
- 2026
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended defenses.
- 2026
AI agents are everywhere. Are your access controls ready?
AI agents are multiplying fast. See what 150 identity pros said about sprawl, shadow AI, and governance at Identiverse 2026.
- 2026
Turning threat intelligence into decisive action with Defender Experts
Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities, cloud workloads, and a sprawling mix of third-party tools.
- 2026
New Privileged Token Context Telemetry Boosts Advanced Hunting in Microsoft Defender
In brief: Defenders can now easily identify logons involving high-privilege identities or special logon flags to better hunt threats and fine-tune detections. When a user logs on, Windows’ Local Security Authority (LSA) constructs an access token that represents the user’s security context…
Links [MS-DTYP]: Well-Known SID Structures
Also: Tc defender endpoint - 2026
Announcing the ASIM Parser Creation Agentic Experience
Creating high-quality ASIM parsers has always required deep knowledge about source data and ASIM schemas, careful KQL design, and repeated validation cycles. That process is meaningful to understand the whole Sentinel ecosystem, but it can be slow when you are starting from…
Links Azure-Sentinel Create ASIM parsers using AI agent skills in Microsoft …
- 2026
Introducing scheduled antivirus scans on Microsoft Defender Linux
Security teams rely on scheduled scans to ensure consistent coverage across devices, detect dormant or missed threats, and meet compliance requirements. However, managing scans on Linux has traditionally required custom scripts and cron-based setups, which can be hard to scale and maintain…
Links Schedule Microsoft Defender for Endpoint antivirus scans on … Security blog
- 2026
New Windows Features to Secure Today’s Data in a Post-Quantum World
***July 14 Update: TLS Hybrid Key Exchange using ML-KEM groups is now available on Windows 11 starting with update KB5089573 for 24H2 and 25H2...
- 2026
Microsoft Defender now integrates with Dragos, Forescout, & Armis for OT Security
Co-author(s): Amit Cohen and Hadar Shindler Operational technology (OT) environments are unlike anything else in cybersecurity. The systems that run our factories, power grids, water treatment plants, pipelines, and transportation networks weren’t built with modern threats in mind — and they can’t…
Links OT data connectors in Microsoft Security Exposure Management Integrate the Armis OT data connector in Microsoft Security …
Also: Tc defender xdr - 2026
Defending SaaS-based applications against ShinyHunters OAuth abuse
Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply-chain compromise, and misconfigured guest access targeting SaaS-based applications.
- 2026
Building toward an Agentic SOC: A Portable, Autonomous Malware Investigation Agent
Modern Security Operations Centers are not short on tools. They are short on continuity. Analysts jump from alert consoles to data exploration, from enrichment to investigation, and from evidence gathering to response—often across multiple interfaces and disconnected workflows. A single malware incident…
Links SOC Malware Investigator (Portable)SOC Malware Investigator … What is Microsoft Sentinel’s support for MCP? Microsoft Sentinel data lake overview
- 2026
Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID
Microsoft Entra ID makes passkeys the default sign-in experience and introduces a new model for SMS and voice authentication. Read about how to prepare.
- 2026
Secure Native Access to Azure Kubernetes Service (AKS) Private Clusters with Azure Bastion
Written in Collaboration with AvirupChat ShabazShaik Mohit_Kumar YuriDiogenes Introduction: As organizations move toward containerized workloads such as Azure Kubernetes Service (AKS), secure access to cluster resources becomes critical. Making the Kubernetes API server private, therefore, significantly reduces the…
Links Concepts - Access and Identity in Azure Kubernetes Service … Connect to AKS Private Cluster Using Azure Bastion AKS GitHub repository
- 2026Intune Action may be required
Build a patch strategy for today’s threat pace with Microsoft
AI-accelerated vulnerability discovery and remediation are changing how organizations manage risk. As discussed in Pavan Davuluri’s recent blog , Microsoft is investing across the vulnerability lifecycle to help organizations identify, validate, and respond faster. For IT and security teams, one challenge lies…
Links Autopatch group policiesNew Microsoft Intune Enterprise Application ManagementNew Manage Apple Volume-Purchased AppsNew
- 2026
Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative
Microsoft’s latest Secure Future Initiative report outlines progress on secure foundations, AI-powered defense, and future-ready cybersecurity.
- 2026
Azure DDoS Protection & Azure WAF: A Layered Defense for Modern DDoS Attacks
Introduction: The Need for Layered DDoS Defense Organizations today operate in an environment where Distributed Denial of Service (DDoS) attacks continue to evolve across both network and application layers. To help organizations build resilient, internet-facing applications and services, Microsoft Azure provides a…
- 2026
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
GigaWiper, also tracked as BLUERABBIT, is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. This blog analyzes how the malware incorporates code from several previously separate malware families and provides guidance to help defenders detect…
- 2026
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
At Microsoft we encompass these security requirements, along with threat knowledge, and operational frameworks in our Secure Future Initiative (SFI), to guide what a well-defended cloud service looks like. But defining the requirements is only the start. Meeting the requirements means continuously…
- 2026
Govern AI agent identities and access the same way you govern your employees
Use Microsoft Entra Agent ID to assign accountable identities, control agent access, and automate sponsor lifecycle management at scale.
- 2026Azure security Preview
Public Preview: Exceptions in WAF for Azure Application Gateway and Azure Front Door
Azure Web Application Firewall (WAF) helps protect your web applications from common threats and attacks. In some cases, WAF may block requests that are safe and expected for your application. Existing exclusions help reduce false positives by omitting specific request attributes, such…
Links Azure Front Door WAF Exceptions List (Preview)New Azure Application Gateway WAF Exceptions List (Preview)
- 2026
What’s new in Microsoft Intune – June
Editor's note (July 2026): This post has been updated since its original publication. Content related to Intune Endpoint Privilege Management capabilities for system-level network configuration has been removed. AI agents are beginning to act on behalf of users, interact with company data…
Links Microsoft Intune Enterprise Application ManagementNew Learn about using Endpoint Privilege Management with … Vulnerability Remediation Agent Overview and Set Up
- 2026
5 insights from Frost & Sullivan’s 2025 Frost RadarTM for Cloud Security Posture Management
Read five key learnings from the Frost & Sullivan 2025 Frost RadarTM for CSPM to learn how CSPM is evolving from point-in-time compliance to continuous risk management.
- 2026
Microsoft Defender for Cloud Customer Newsletter
What's new in Defender for Cloud? Microsoft Defender for Open-Source Relational Databases is now generally available for Amazon Web Services Relational Database Service (AWS RDS) instances. Receive database threat protection and sensitive data discovery insights for supported open-source relational databases,…
Links documentation Check out other updates from last month here! Check out monthly news for the rest of the MTP suite here!
- 2026
Improving security posture across the Microsoft partner ecosystem
Read how Microsoft strengthens partner ecosystem security with CSP vetting, least privilege access, monitoring, and risk management best practices.
- 2026
Migrating frontline mobile devices: Identity considerations for assigned and shared devices
By: Carol Burns - Principal Product Manager | Microsoft Intune and Sucheta Gawade, Microsoft MVP (Azure & Security / Intune) Practitioner perspective from Sucheta Gawade, Microsoft MVP (Azure & Security / Intune), with deep experience in secure frontline mobility, including regulated healthcare…
Links Microsoft Entra authentication overview Migrating Frontline Mobile Devices: Understanding the … Migrating frontline mobile devices: Aligning stakeholders …
- 2026
Behind the Build with Gigamon: Enriching Microsoft Sentinel with Network-Derived Telemetry
Behind the Build is an ongoing series spotlighting standout Microsoft partner collaborations. Each edition dives into the technical and strategic decisions that shape real-world integrations—highlighting engineering excellence, innovation, and the shared customer value created through partnership. Security teams…
Links Security Posture Insight Agent Extending App Assure’s Sentinel Promise through the Sentinel … Submit a request to App Assure
- 2026
Now generally available: Serverless posture coverage in Microsoft Defender CSPM
Serverless workloads are a foundation of modern application development, powering everything from low-code and no-code solutions to AI applications and agentic workflows. Development teams use functions, app services, containers, APIs, and event-driven infrastructure to move quickly, scale on demand, and reduce…
Links What's New in Defender for Cloud FeaturesNew What is Serverless protection? Discovery and posture for serverless container workloads
- 2026
Microsoft named a leader in the Frost Radar for cloud and application runtime security
Frost & Sullivan names Microsoft a leader as cloud and application security converge into unified, runtime risk reduction.
- 2026
Extend data security to the network with Microsoft Purview and Microsoft Entra
Protection that keep s up with how data moves in the AI era Enterprise data used to be easier to contain. It lived in files, in apps you managed, within boundaries you controlled. Security teams could focus on endpoints and known systems…
Links That’s why Microsoft Purview and Microsoft Entra now …
- 2026Intune GA
Advanced Microsoft Intune capabilities now available in Microsoft 365 E3 and E5
Across industries, customers are already using advanced Microsoft Intune Suite capabilities to solve real endpoint challenges, such as reducing standing privilege, improving IT response times, modernizing certificate management, and preparing for AI-assisted operations. Now, more Microsoft 365 customers can put…
Links Microsoft a Leader in The Forrester WaveTM for Endpoint … Learn about using Endpoint Privilege Management with … Microsoft Cloud PKI for Microsoft Intune
Also: Microsoft Learn - 2026
Monthly news - July 2026
Microsoft Defender Monthly news - July 2026 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the…
Links View your identity coverage and maturityNew What's newNew AgentsInfo table in the advanced hunting schema
Also: Tc defender xdr - 2026
Bring business logic into PIM role activation workflows
Use PIM custom extensions to validate tickets, enforce HR policies, and automate approval decisions during role activation.
- 2026
Introducing a unified alert experience for Microsoft Purview Insider Risk Management
Modern insider risk investigations succeed or fail based on how quickly analysts can move from signal to decision with more context. Too often, investigations within Microsoft Purview require high switching costs while analysts struggle with disconnected alert views and scattered case notes…
Links New IRM Alert Experience
- 2026
Accelerating the quantum-safe timeline
We’re accelerating quantum-safe readiness—and sharing what organizations can do now to transition earlier and with confidence.
- 2026Entra GA
Microsoft Entra Backup and Recovery is now generally available
Move from point-in-time restore to a full tenant recoverability strategy with Microsoft Entra Backup and Recovery, included in Entra P1 and P2.
Also: Roadmap, Microsoft Learn, Microsoft Learn - 2026
Microsoft Defender for Cloud expands multicloud coverage across AWS and Google Cloud
Organizations are building and running applications across multiple cloud platforms and hybrid environments to move faster, improve resilience, and choose the services that best fit each workload. But that flexibility also changes how teams need to manage exposure. A risk may start…
Links What's New in Defender for Cloud FeaturesNew Integrate AWS CloudTrail Logs New and upcoming changes in recommendations, alerts, and …
- 2026
What’s new in Microsoft Sentinel: June 2026
Welcome back to What's new in Microsoft Sentinel. In June, Sentinel SIEM’s Advanced Security Information Model (ASIM) broadens its normalization, so one analytic rule can reach more sources with less per-source work and, additionally, two new ASIM schemas can now bring asset…
Links Microsoft Sentinel ASIM Agent Event normalization schema …New The Advanced Security Information Model (ASIM) Asset Entity … ASIM parsers on GitHub
- 2026
What’s new in Microsoft Security: June 2026
This month’s updates help security and IT teams strengthen identity and multicloud foundations, protect data wherever it lives, and secure the developer workflows powering AI innovation.
- 2026
The AI-first SOC: Copilot, UEBA, threat intelligence, and SOC optimization
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl The portal change was the easy part. The real upside is the operating model it unlocks—generative AI in every workflow, behavioral analytics across hybrid and multi-cloud, native threat intelligence, and SOC…
Links Microsoft Sentinel in the Microsoft Defender portal Transition Your Microsoft Sentinel Environment to the … Threat intelligence in Microsoft Defender
- 2026
Securing AI agents: When AI tools move from reading to acting
MCP tool poisoning turns trusted AI agents into a control plane for data loss. Learn how threat actors manipulate tool descriptions to trigger unauthorized actions, and how to detect, contain, and prevent it.
- 2026
The state of MCP security in 2026
MCP is now the default way agents reach tools and data, and that reach is the attack surface. Here's where the risk actually sits in 2026, what has changed...
- 2026
The next frontier in endpoint security: Securing local AI agents with Microsoft Defender
AI agents are now doing real work on the endpoint — reading files, running commands, browsing the web, and acting on behalf of the users they run under. That same power is also what makes them dangerous: agents act on whatever content…
Links Discover local AI agents with Microsoft Defender Block malicious AI agent behavior with runtime protection Manage and secure your agents with Microsoft Agent 365
- 2026
Protect sensitive data in motion across SaaS and AI apps with Microsoft Purview and Microsoft Entra
Stop sensitive data from leaving your organization. Extend data detection and identity-aware enforcement to the network—now in preview.
- 2026
Streamlining macOS security: Automatically enable AutoFill after Platform SSO registration
By: Chris Kunze - Principal Product Manager | Microsoft Intune Platform single sign-on (SSO) improves how macOS devices establish identity with Microsoft Entra ID, enabling a more secure and streamlined authentication experience. However, completing Platform SSO registration isn’t enough to deliver a…
Links New Platform SSO with registration during Automated Device … Add Platform SSO policy to ADE Profile on macOS devices Overview of Apple Automated Device Enrollment for macOS in …
- 2026
Chromium extension uses AI‐related branding to redirect browser search
A malicious Chromium-based extension that spoofs the AI-powered answer engine Perplexity AI redirects browser search traffic using MV3 APIs and intermediary infrastructure.
- 2026Sentinel Action may be required
Your readiness playbook: adoption helper, costs, APIs, and the checklist
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl The transition is not a project—it is a sequence of small, ordered decisions. Here is the readiness tool that scores your environment in minutes, the cost story you can take to…
Links Use the Microsoft Graph security API Sentinel-Defender-helper-script Microsoft Sentinel pricing
- 2026
Understand your Sentinel tables at a glance: Monitor with table insights
What it is Table insights is a new panel on the Sentinel Tables page that gives you 30-day ingestion volume per tier, day-over-week fluctuations, the top 5...
- 2026
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The campaign uses photo-themed ZIP archives and fake image shortcut files to deliver a persistent Node.js implant and evade detection.
- 2026
Secure AI at scale: Join the Microsoft Entra + Purview webinar series
Learn how to protect data, govern access, and reduce risk across AI apps, agents, browsers, and networks with Microsoft Entra and Microsoft Purview.
- 2026
The governance shift: RBAC, URBAC, data lake, and MSSP
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Governance is the silent dependency every transition trips on. Read about how roles,...
- 2026
Microsoft Intune and Apple platform updates: What to expect after WWDC 2026
By Benjamin Flamm | Product Manager, Iris Yuning Ye | Product Manager - Microsoft Intune Apple’s Worldwide Developers Conference (WWDC) is the annual starting point for the next wave of Apple platform changes. For Microsoft Intune customers, WWDC is also the moment…
Links View Software Update Reports for Apple Devices Support tip: Move to declarative device management for Apple … @IntuneSuppTeam
- 2026
Microsoft a Leader in The Forrester WaveTM for Endpoint Management Platforms
Microsoft named a Leader in the Forrester WaveTM: Endpoint Management Platforms, Q2 2026, with the highest scores in the current offering and strategy categories.
- 2026
How Karambit.AI and Microsoft Bring Software Authenticity to 14 Billion Files Per Month
The Problem: Static Analysis Without Context Traditional static analysis treats every file as an island. Scan a binary, match against known signatures, flag...
- 2026
Security Community Spotlight: Sathish Veerapandian
Meet Sathish Veerapandian: security architect, community collaborator, published author, and cycling enthusiast with a knack for turning real-world customer...
- 2026
How to Configure macOS Privacy Preferences Policy Control (PPPC) Using the Intune Settings Catalog
By: Chris Kunze - Principal Product Manager | Microsoft Intune Privacy Preferences Policy Control (PPPC) settings on macOS are used to pre-approve privacy permissions for apps so users aren't repeatedly prompted by macOS for access requests. Common examples include Full Disk Access…
Links Create a policy using settings catalog in Microsoft IntuneNew Intune admin center Privacy Preferences Policy Control
- 2026
A guide to innovating threat hunting with Microsoft Sentinel custom graph
Microsoft Sentinel platform offers a growing list of tools and features, with graph being a cornerstone capability. Sentinel graph is a relationship-first...
- 2026
CNAPP evolution: How Microsoft aligns with leading cloud risk management platforms
Learn how CNAPP platforms are helping organizations prioritize exploitable risks, reduce exposure, and operationalize security across the application lifecycle.
- 2026
StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them
On June 24, 2026, Microsoft’s Digital Crimes Unit (DCU) facilitated the takedown, suspension, and blocking of domains that formed the backbone of the StealC and Amadey infrastructure. This blog is a technical breakdown of StealC and Amadey.
- 2026
Guarding AI memory
What happens when threat actors target what AI remembers? Microsoft breaks down the risks and the defenses.
- 2026
Microsoft Leads a New Era of Software Supply Chain Transparency
Today, Microsoft announces the general availability of Microsoft’s Signing Transparency (MST) – a first-of-its-kind capability that brings unprecedented...
- 2026
Exporting all Microsoft Intune Enterprise App Management catalog apps to CSV using Microsoft Graph
By: Joe Lurie, Sr. Product Manager | Microsoft Intune Managing applications at scale is one of the biggest time-consuming tasks for IT admins. Between packaging installers, writing detection rules, and keeping everything up to date - it adds up fast. That's exactly…
Links Microsoft Intune Enterprise Application ManagementNew Add an Enterprise App Catalog App to Microsoft Intune Microsoft Intune advanced capabilities
- 2026
New Platform SSO with registration during Automated Device Enrollment on macOS
By Iris Yuning Ye, Product Manager – Microsoft Intune & Justin Ploegert, Principal Product Manager – Microsoft Entra A new setting ‘Enable Registration...
Also: Microsoft Learn - 2026
One intrusion, two cyberattackers: Uncovering parallel threat activity
Ransomware case reveals two parallel threat actors, blending tactics and evasion—showing why isolated signals can often miss modern, overlapping cyberattacks.
- 2026
MDOP is out of support: What to do next with Microsoft Intune
By: Joe Lurie – Sr. Product Manager | Microsoft Intune On April 14, 2026, the Microsoft Desktop Optimization Pack (MDOP) reached the end of extended support....
- 2026Intune Preview
Triage vulnerabilities with the Vulnerability Remediation Agent, now in public preview
As automation and AI accelerate the pace of vulnerability discovery, the window between disclosure and exploitation continues to shrink. For IT and security...
- 2026
Deploying Platform SSO for pre macOS 26 with Microsoft Intune: Lessons Learned
By: Naveen Akkugari, Sr. Service Engineer and Michael Griswold, Principal Service Engineering Manager | Microsoft Intune Who we are Our internal Intune...
- 2026
How Enterprise App Management secures your App Catalog from ingestion to device
By: Joe Lurie, Sr. Product Manager | Microsoft Intune One of the most common questions I get from customers when I talk about Enterprise App Management is...
- 2026
AutoJack: How a single page can RCE the host running your AI agent
AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger…
- 2026
Microsoft 365 adds advanced Microsoft Intune solutions at scale
Microsoft 365 extends advanced security and AI-powered endpoint management to more customers
- 2026
New Forrester Total Economic ImpactTM study projects a 124% ROI from unifying with Microsoft Security
New Forrester Total Economic ImpactTM study shows Microsoft Security consolidation delivers ROI, lowers risk, and prepares organizations to secure AI.
- 2026
Detection and automation, reimagined
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl How analytics rules, playbooks, workbooks, and hunting evolve in Defender—and why the...
- 2026
Microsoft Defender for Office 365 Plan 1 is now rolling out to Microsoft 365 E3 and Office 365 E3
Starting today, Microsoft Defender for Office 365 Plan 1 is rolling out to customers with Microsoft 365 E3/G3 and Office 365 E3/G3 licenses, with rollout expected to complete by Fall 2026. For security teams, this means added protection against phishing, malware, and…
Links Enhanced filtering for connectors in Exchange OnlineNew Built-in security features for all cloud mailboxes Preset security policies
- 2026
IT experts weigh in: Advanced Intune capabilities coming to Microsoft 365 E3 and E5
Back on December 4th, we shared that advanced capabilities from the Microsoft Intune Suite were coming to Microsoft 365 E3 and Microsoft 365 E5 . These packaging changes become effective on July 1st, with existing eligible customers expected to receive the capabilities…
Links Learn about using Endpoint Privilege Management with … Microsoft 365 adds advanced Microsoft Intune solutions at … Advanced Analytics Overview
- 2026
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet
A poisoned npm package infected 140+ projects with a hidden payload. This report highlights how to detect, hunt, and defend against supply chain attacks using Microsoft Defender and actionable threat intelligence.
- 2026
How to enable HTTPS support for Microsoft Connected Cache for Enterprise and Education
By: Aditya Middha | Product Manager 2 - Microsoft Connected Cache Starting on June 16th, 2026, or soon after, Intune will enforce HTTPS content delivery...
- 2026
Crypto Clipper uses Tor and worm-like propagation for persistence and control
Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, Tor-based communications, and worm-like propagation. Beyond stealing cryptocurrency transactions, the malware establishes persistent access and enables follow-on activity through a lightweight…
- 2026
Beyond the benchmark: Advancing security at AI speed
Read how Microsoft Security has advanced its agentic vulnerability detection system, codename MDASH, integrating into real-world workflows across Windows, Azure, and identity systems.
- 2026
Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms WaveTM report
Microsoft has been named a Leader in The Forrester WaveTM: Extended Detection and Response Platforms, Q2 2026.
- 2026
AI is accelerating cyberattacks—here’s how to stay ahead
See how Microsoft unifies identity and security signals to help teams prevent, detect, and respond to AI-accelerated attacks faster.
- 2026
Securing the invisible workforce
Non-human identities are now the majority of the identity estate in most enterprises. Service principals access organizational resources across SharePoint, Azure, and Microsoft 365, Service accounts run critical business processes on-premises, OAuth apps move data across SaaS boundaries, and AI agents increasingly…
Links Non-human identities in Microsoft DefenderNew Midnight Blizzard: Guidance for responders on nation-state …
Also: Tc defender xdr - 2026
Designing Cloud Landing Zones by Traffic Flow: A Defence‐in‐Depth, DMZ‐First Architecture
As enterprises adopt Microsoft Azure for large‐scale and regulated workloads, security architecture must be driven by traffic trust boundaries and inspection intent, not connectivity alone. Regulatory frameworks consistently require a clear separation between Internet‐untrusted and private enterprise traffic,…
Links What is Azure Firewall?New Azure Virtual WAN Overview Azure DDoS Protection & Azure WAF: A Layered Defense for …
- 2026
Closing the loop on container security: From code to runtime in the AI era
Containers are the backbone of modern cloud-native apps — and increasingly, the infrastructure powering AI, from AI assistants to a new wave of intelligent agents. They also blur the line between build , deploy , and runtime : a single code change…
Links What's New in Defender for Cloud FeaturesNew GitHub Advanced Security Integration with Microsoft Defender … Defender for Cloud CLI Overview
- 2026
Introducing New Additions to Microsoft Sentinel Normalization and ASIM
TL;DR: New ASIM parsers for Azure Firewall, Key Vault, AWS CloudTrail (EC2, S3, IAM), and 10+ third-party products. Two new schemas — Asset Entities and AI...
- 2026
Anatomy of the change
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Incidents, alerts, correlation, and data—what actually changes with the new platform,...
- 2026Sentinel Preview
Announcing Public Preview: Agent Identities Asset Connector for Microsoft Sentinel
As organizations accelerate adoption of AI agents across Microsoft 365 and enterprise environments, security teams face a fundamental shift: Agents are...
- 2026
Transform your security operation with a unified experience in Defender
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Security operations teams today are being asked to do more than ever: respond faster,...
- 2026
Known issue: Upgrading Microsoft Tunnel version 20260129.1
We identified an upgrade issue with the early March release of Microsoft Tunnel version 20260129.1 that caused servers to become stuck and unable to complete...
- 2026
Microsoft Defender email security benchmarking: Key insights from one year of data
See how Microsoft Defender performed in one year of real-world email security benchmarking against SEG and ICES vendors.
- 2026Entra GA
Tools for Azure AD B2C migration now available
See the latest migration paths, tooling, and partner support to help you move from Azure AD B2C to Microsoft Entra External ID with confidence.
- 2026
A deep dive into Azure Bastion session recording
If you’ve worked with Azure Bastion’s Premium SKU, you’ve likely encountered one of its most powerful security features: graphical session recording. Capturing RDP and SSH sessions end to end strengthens compliance, supports forensic investigations, and improves operational accountability. How you configure session…
Links Public Preview: Managed Identity support for graphical … Configure storage account container Azure Bastion: Enterprise-grade secure access made simple
- 2026
Level up your Azure Network Security Skills with our Upcoming Webinar Series
As network and application-layer threats continue to evolve, security and infrastructure teams need more than product knowledge. They need practical,...
- 2026
Reduce unnecessary internet exposure with Microsoft Defender
In today’s threat landscape, internet exposure , i.e. devices that allow inbound connectivity from the public internet, continues to be a major vector for initial access and compromise. Devices that are exposed to the public internet can significantly increase an organization’s attack…
Links Discovering Internet-facing Devices Investigate devices in Microsoft Defender for Endpoint Microsoft Secure Score for Devices
- 2026
Turn specs into evals for any agent with ASSERT
Adaptive Spec-driven Scoring for Evaluation and Regression Testing (ASSERT) is an open-source framework for converting natural language behavior requirements into executable evaluations of AI models and agents.
- 2026
New Exchange Online Mailbox Auditing Signal: Visibility into IPM to Non-IPM Copy Activity
Background: IPM vs. Non-IPM Subtree Every Exchange Online mailbox is organized into two parts: IPM subtree (Interpersonal Message subtree) — the...
- 2026
Extend Microsoft Purview data protection to AWS Bedrock agents for cross-cloud AI governance
Organizations are moving fast with AI, and many of those AI workloads are not staying in one cloud. A team might use Microsoft 365 and Microsoft Purview for governance and in addition to Microsoft Foundry they may still choose to run an…
Links purview-api-samples/DLPforCustomAIApps at main · … purview-api-samples/AWSBedrock at main · … Configure Data Security Posture Management (DSPM) for AI for …
- 2026
Reconstructing AI activity in investigations
Learn how to investigate AI activity in Microsoft 365 Copilot and Azure AI services using a structured, telemetry-driven approach. This playbook helps security teams reconstruct events, assess data exposure, and detect potential threats faster.
- 2026
Microsoft Defender now monitors RPC activity
Remote procedure call (RPC) is a protocol commonly abused by attackers that allows functions implemented in a separate process, and potentially on a remote machine, to be called as if they were local. Many core Windows and Active Directory capabilities are built…
Links Remote procedure call (RPC) - Win32 apps Security blog
- 2026
Elevate your telemetry using custom data collection in Microsoft Defender
At Ignite in November, we announced that Microsoft Defender is now the only endpoint protection solution that allows data-hungry security teams to meet specific telemetry needs by optimizing their data collection right within the Defender portal, without the need to rely on…
Links Create and manage custom data collection rules in Microsoft … Security blog
- 2026Defender for Cloud Preview
Public Preview: Microsoft Foundry agent security capabilities in Microsoft Defender for Cloud are transitioning to a Microsoft Agent 365 license
Starting July 1, 2026, Microsoft Foundry agent security capabilities previously available through Microsoft Defender for Cloud will transition to a Microsoft Agent 365 license. Agent protection in Defender will be powered by Agent 365 observability logs and the Microsoft 365 agent registry…
- 2026
AI brands as bait: How threat actors are using the AI hype in social engineering
As threat actors operationalize AI to accelerate attacks, they are also leveraging the wider global interest around AI itself as a social engineering lure.
- 2026
Security Review for Microsoft Edge version 149
We have reviewed the new settings in Microsoft Edge version 149 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 139 security baseline continues to be our recommended configuration which can be downloaded from the…
Links Microsoft Security Compliance Toolkit Security Baselines Discussion site
- 2026
The Worm in the Supply Chain: How Defender for Endpoint and Sentinel for SAP BTP Caught Shai-Hulud
On 29 April 2026, malicious versions of multiple SAP ecosystem npm packages were briefly published, creating a supply-chain exposure for SAP Cloud...
- 2026Purview Action may be required
Enhancements to Device Status API & Logged-In User Email in Endpoint DLP
1. The Real‐World Problem Endpoint DLP analyst Faced (What Was Missing Earlier) Before the introduction of the Device Status API enhancements and logged‐in user visibility, Endpoint DLP teams consistently struggled in below discussed areas: Device Visibility Was Fragmented and Manual - Customers…
- 2026
Run Global Secure Access with confidence: Introducing the GSA Operations Guide
Use the new Operations Guide to adopt alert-first workflows, standardize operations, and run Global Secure Access more reliably every day.
- 2026
Securing CI/CD in an agentic world: Claude Code Github action case
Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI/CD workflows.
- 2026
Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us
A surge in real-world attacks against agentic AI systems is reshaping how we think about risk. Based on 12 months of red teaming, this update introduces seven new failure modes, from supply chain compromise to goal hijacking, and the practical mitigations teams…
- 2026
Microsoft Defender for Cloud Customer Newsletter
What's new in Defender for Cloud? Defender for Cloud is now integrated into the Defender portal to bring together cloud security posture management and threat protection in a single experience. Read more about it here . Cloud security reporting in the Defender…
Links documentation Check out other updates from last month here! Check out monthly news for the rest of the MTP suite here!
- 2026
What’s new in Microsoft Sentinel: May 2026
Welcome to the May edition of What's new in Microsoft Sentinel. This month’s updates focus on unified role-based access control (RBAC), ecosystem breadth,...
- 2026GA
General Availability: Backup your ledger files for audit with Azure confidential ledger’s new tool
Ever wondered how to allow auditing personas (i.e. security analyst in your organization or security assessment contractor) the ability to view your ledger files and establish trust in the cryptographic proofs themselves? With the new localized, web ledger explorer tool, ledger files…
- 2026
Amazon Security Lake Integration with Microsoft Sentinel: Parquet at the Gates
This blog has been jointly published by and . In this blog post, we explore how centralized AWS Security Lake data can be transformed and streamed into...
- 2026
Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals credentials from GitHub, cloud platforms, and local machines, then spreads like a worm by republishing trusted packages. Discover…
- 2026
The end of patching era for containers: Microsoft Defender for Cloud expands hardened image support
Why hardened images are becoming the new baseline for container image security Container security is evolving beyond vulnerability scanning alone. Across the ecosystem - spanning container platforms, registries, and software supply chain tooling - customers are increasingly adopting hardened container images -…
Links What's New in Defender for Cloud FeaturesNew
- 2026
Start Secure, Stay Secure: How Microsoft is Closing the Gap from Code to Runtime
Modern software applications composed of hundreds of artifacts, multiple programing languages, and cloud infrastructure provide an extensive attack surface that only continues to expand in the era of AI. According to Microsoft Threat Intelligence and industry research, threat actors are also increasingly…
Links Digital Defense Report 2025 Source: MSRC CVE disclosures, May 12, 2026 Defense at AI speed: Microsoft’s new multi-model agentic …
- 2026
Microsoft Build 2026: Securing code, agents, and models across the development lifecycle
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.
- 2026
Microsoft Purview enables developers with strong data security across AI apps and agents
Today, developers are at the center of a new wave of innovation—building AI applications and agents that are deeply connected to enterprise data. But with...
- 2026
Build AI agents for production with secure identities from day one
Learn how Microsoft Entra Agent ID and the Agent 365 SDK help developers help secure AI agents from the start.
- 2026
Securing Local Agents, Claws, Runtimes | Microsoft Security
Secure local AI agents and claws with unified visibility, control, and enforcement across endpoints to help reduce risk and protect data in real time.
- 2026
Share Your Use Case in a Lighting Talk
Microsoft Security Store Lightning Talks are high‐energy, community-led mini sessions spotlighting real users like you who are putting Microsoft...
- 2026
What's New in Microsoft Entra: June 2026
Welcome to the June edition of our monthly newsletter, summarizing the latest news and developments in the exciting, ever-evolving world of Microsoft...
- 2026
How Microsoft Defender used predictive shielding to proactively disrupt a ransomware attack
Modern ransomware attacks are increasingly designed to blend in with normal IT operations, using trusted administrative tools to quietly weaken defenses and distribute malicious payloads at scale. In a recent real‐world incident, a human‐operated ransomware actor attempted to do exactly that by…
Links Case study: How predictive shielding in Defender stopped … Security blog
- 2026
Now Generally Available: Microsoft Defender for open source relational databases on AWS RDS
Securing multicloud databases to help reduce risks Open‐source (OSS) relational databases are becoming increasingly critical and increasingly targeted in organization of all sizes. As organizations adopt multicloud architectures, these databases often run across Azure and Amazon Web Services (AWS), while security…
Links Explore Risks to Sensitive Data Microsoft Defender for Open-Source Relational Databases Now … Cloud Security Solutions | Microsoft Security
Also: Microsoft Learn - 2026
Introducing the next generation of SOC automation: Sentinel playbook generator
Security teams today operate under constant pressure. They are expected to respond faster, automate more, and do so without sacrificing precision....
- 2026
Introducing the updated exposure score in Microsoft Defender Vulnerability Management
We are introducing an updated exposure score model in Microsoft Defender Vulnerability Management, now available in public preview. Security teams use the exposure score to understand vulnerability posture, prioritize remediation, and explain progress to leadership. The updated model helps make that score…
Links Predefined classifications in Microsoft Security Exposure … Exposure score in Defender Vulnerability Management Security recommendations
Also: Microsoft Learn, Microsoft Learn - 2026
Malicious npm packages abuse dependency confusion to profile developer environments
A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and detection opportunities to help organizations identify and disrupt related activity.
- 2026
Microsoft is named a Leader in the 2026 Gartner® Magic QuadrantTM for Endpoint Protection
Microsoft is named a Leader in the 2026 Gartner® Magic QuadrantTM for Endpoint Protection.
- 2026
Typosquatted npm packages used to steal cloud and CI/CD secrets
The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environments. This report details the attack chain, detection opportunities, and mitigation guidance to help organizations identify and disrupt related activity.
- 2026Intune Action may be required
What’s new in Microsoft Intune – May
Whether it's Android app deployment, identity setup on macOS, certificate authority renewal, or faster compliance evaluations, the throughline is the same: less friction for the IT admins doing the work. More control over how admins manage and protect Android devices A device…
Links Microsoft Intune Enterprise Application ManagementNew Enable Mobile Threat Defense connector in Microsoft Intune Microsoft Defender for Endpoint
- 2026
The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
Microsoft Threat Intelligence presents a comprehensive analysis of The Gentlemen, a Go-based ransomware deployed by affiliates of Storm-2697 that combines per-file ephemeral key encryption with an aggressive self-propagation module to deploy itself across an entire network using series of simultaneous lateral movement…
- 2026
How to exclude specific CVEs with CVE exceptions in Microsoft Defender Vulnerability Management
Not every CVE should be handled the same way, and choosing the wrong exception type can remove more risk visibility than intended. A security recommendation can include many CVEs. If only one CVE is out of scope, excluding the full recommendation can…
- 2026
Become an Azure Network Security Ninja
Become an Azure Network Security Ninja! We have gathered essential materials, from foundational to advanced concepts, to help you master network...
- 2026
Microsoft Security Community Spotlight: Marcel Graewer
Globally, Marcel shares practical detection engineering insights on Microsoft Sentinel and Microsoft Defender XDR through forums and blog posts. Locally, he...
- 2026
Organize your multitenant view with Tenant Groups in Microsoft Defender
Managing security across many tenants shouldn’t mean drowning in a single, flat list. We’re excited to share a new capability, now in public preview in the Microsoft Defender multitenant (MTO) porta l : Tenant Groups —a flexible way to organize the tenants…
- 2026
From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots.
- 2026
Microsoft recognized as a Leader in The Forrester WaveTM for Workforce Identity Security Platforms
Microsoft has been recognized as a Leader in The Forrester WaveTM: Workforce Identity Security Platforms, Q2 2026, receiving the highest scores in both the current offering and strategy categories.
- 2026
From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
A multi-stage attack on Linux devices began with an exposed F5 BIG-IP edge appliance and pivoted to an internal Confluence server for credential theft and identity compromise. Learn how the threat actor attempted Kerberos relay and lateral movement, and how Microsoft Defender…
- 2026
Microsoft Security success stories: How St. Luke’s and ManpowerGroup are securing AI foundations
How Frontier firms secure AI at scale: read how Microsoft customers embed governance, identity, and cloud security to make protection an enabler of AI growth.
- 2026
Find shadow tenants and reduce risk fast with Microsoft Entra Tenant Governance
Get continuous visibility into related tenants and the signals behind them—so you can reduce blind spots before they turn into incidents.
- 2026
What’s new in Microsoft Security: May 2026
Microsoft Security’s latest updates extend visibility, control, and protection across expanding ecosystems as organizations accelerate AI adoption.
- 2026Sentinel Preview
The Microsoft Copilot Data Connector for Microsoft Sentinel is Now in Public Preview
*Please note that this connector is now in GA status as of March, 2026* We are happy to announce a new data connector that is available to the public:...
- 2026
Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft
Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments. The malware executes during npm install and targets credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password platforms.
- 2026
Securing the gaming culture of cultures
Read about the unique challenges and rewards of securing gaming platforms and how to better protect gaming communities.
- 2026
Introducing RAMPART and Clarity: Open source tools to bring safety into Agent development workflow
The AI systems shipping inside enterprises today are fundamentally different from the ones we were building even two years ago, because they have moved well past answering questions and into accessing your email, retrieving records from your CRM, writing and executing code…
- 2026Defender for Cloud Preview
Public preview: Expanded coverage and unified management for SQL VA Express Configuration
SQL Vulnerability Assessment (SQL VA) is a core capability in Defender for SQL that helps customers identify possible misconfigurations, excessive permissions, and other deviations from security best practices through continuous scanning of their databases. Traditionally, enabling SQL VA on SQL PaaS resources…
Links Enable SQL Vulnerability Assessment Express Configuration … Enable vulnerability assessments on Azure SQL databases with … Get started with the unified SQL Vulnerability Assessment …
- 2026
Securing AI Agents End‐to‐End: Connecting Purview DSPM, Agent 365, and the AI Security Dashboard
The Challenge:Organizations deploying Microsoft Copilot and custom AI agents face a critical gap: security visibility is fragmented across data protection,...
- 2026
Exposing Fox Tempest: A malware-signing service operation
Fox Tempest is a financially motivated threat actor operating a malware‐signing‐as‐a‐service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm groups, to more effectively distribute malicious code, including ransomware.
- 2026
Security Review for Microsoft Edge version 148
We have reviewed the new settings in Microsoft Edge version 148 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 139 security baseline continues to be our recommended configuration which can be downloaded from the…
Links Microsoft Security Compliance Toolkit Security Baselines Discussion site
- 2026
How Storm-2949 turned a compromised identity into a cloud-wide breach
Storm-2949 turned stolen credentials into a cloud-wide breach, moving from identity compromise to large-scale data theft without using malware. This incident shows how threat actors can exploit trusted systems to operate undetected.
- 2026
Migrate Sentinel to Defender - Why It Is a Security Architecture Decision, Not Just a Portal Change
Microsoft will retire the Sentinel experience in Azure on March 31, 2027. Most of the conversation around this transition focuses on cost optimization...
- 2026
State Explosion Security Problem in AI-Era Software Supply Chains
Introduction To see why this problem scales so quickly, start with the smallest possible change: a single line of code. In modern software, even a tiny...
- 2026
Agent 365 connector: Monitor, hunt, and investigate AI agent activity in Microsoft Sentinel
As enterprises scale the use of AI agents, SOC teams need visibility into AI agent behavior. The Agent 365 connector, now in public preview, streams rich...
- 2026
How to better protect your growing business in an AI-powered world
See how built-in security helps keep your growing business running, protect customer trust, and support growth.
- 2026
Introducing selective response actions for high-value assets in Microsoft Defender
Deploying Microsoft Defender on high-value assets (HVAs) such as domain controllers, ADFS servers, and other Tier-0 systems, requires a thoughtful approach to balance strong protection with operational stability. Given the powerful response capabilities available, organizations often seek greater control over how…
Links Selective response actions on critical assets in Microsoft … Security blog
Nothing matches these filters.