Microsoft Defender for Cloud

1. New feature

   Arc proxy support for Defender for SQL Servers on Machines

   November 4, 2026 Defender for SQL Servers on Machines now supports Azure Arc SQL Server instances with Arc proxy enabled, starting with Defender for SQL extension version 2.0.3585.403 . Organizations that don't allow direct internet access from their machines can…

   DocsEnable Microsoft Defender for SQL Servers on MachinesNew·Disable Defender for SQL Servers on MachinesNew·Update the Defender for SQL extension manuallyNew

   Enable Microsoft Defender for SQL Servers on Machines Learn how to protect your Microsoft SQL Servers on Azure VMs, on-premises, and in hybrid and multicloud environments with Microsoft Defender for Cloud.

   Listed under November 2026 on Microsoft Learn

1. GA

   Posture policies and recommendation exemptions available in Microsoft Defender

   October 28, 2026 Posture policies and recommendation exemptions are now available in public preview in the Microsoft Defender portal for Azure environments. With these new capabilities, you can: Gain visibility into your security posture through evaluations of Azure resources against…

   DocsExempt resources from recommendationsNew·Security policies in Microsoft Defender for CloudNew

   Exempt resources from recommendations Create exemption rules to remove resources or recommendations from secure score impact in Microsoft Defender for Cloud.

   Listed under October 2026 on Microsoft Learn
2. GA

   On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares (GA)

   October 5, 2026 On-demand malware scanning in Microsoft Defender for Storage now supports targeted scanning of specific items. Instead of scanning an entire storage account, you can scope scans to a single blob or file, a specific container or file…

   DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated

   Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.

   Listed under October 2026 on Microsoft Learn
3. New feature

   New Defender server security experience

   October 6, 2026 The new Defender server security experience brings together cloud and endpoint data from Microsoft Defender for Endpoint and Defender for Servers. In the Microsoft Defender portal, you can: Review the new server asset page with combined cloud…

   DocsThe new Defender server security experienceNew·Offboard devicesNew

   The new Defender server security experience Review cloud and endpoint information, investigate threats, and check access for servers in Microsoft Defender.

   Listed under October 2026 on Microsoft Learn
4. GA

   KSPM misconfiguration recommendations moving to controller-level scope (GA)

   October 5, 2026 Kubernetes security posture management (KSPM) misconfiguration recommendations are being updated to align their resource scope with Kubernetes workload controllers. Previously, recommendations appeared at the individual running container instance level. They will now appear at the container deployment…

   DocsReference table for all container security recommendations in …

   Reference table for all container security recommendations in Microsoft Defender for Cloud This article lists all Microsoft Defender for Cloud container security recommendations that help you harden and protect your resources.

   Listed under October 2026 on Microsoft Learn
5. New feature

   Expanded server onboarding experience

   October 20, 2026 The new Defender server security experience expands to include onboarding guidance for Azure and on-premises servers, building on the investigation and access management capabilities released on October 6. With this update, you can: Onboard supported Azure virtual…

   DocsUse Direct onboarding for on-premises serversNew·Offboard devicesNew·Onboard servers to Microsoft DefenderUpdated·Connect on-premises machinesUpdated

   Use Direct onboarding for on-premises servers Associate existing endpoint-protected servers with Defender for Servers and review the affected population.

   Listed under October 2026 on Microsoft Learn
6. Preview

   Cloud security plan management in the Defender portal

   October 20, 2026 Cloud security plan management is scheduled to become available in public preview in the Microsoft Defender portal for Azure commercial environments on October 20, 2026. With this experience, you can: Connect Azure subscriptions and management groups to…

   DocsOverview of Defender for Cloud in Defender PortalUpdated

   Overview of Defender for Cloud in Defender Portal Comprehensive overview of Microsoft Defender for Cloud in the Defender portal, including navigation hub, dashboard features, and unified security management capabilities.

   Listed under October 2026 on Microsoft Learn

1. Deprecation

   Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation

   September 23, 2026 As part of the transition to individual recommendations, the Machines should have a vulnerability assessment solution recommendation will be deprecated on December 14, 2026. Customers should use individual recommendations in Microsoft Defender for Cloud to review and…

   DocsTransition from grouped to individual recommendations in Defender for …Updated

   Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.

   Listed under September 2026 on Microsoft Learn
2. New feature

   Upcoming billing updates for Defender for Servers

   September 30, 2026 Effective November 1, 2026, Microsoft Defender for Servers introduces two related updates: Billing policy update: Productivity and desktop client devices, such as Windows 10 and Windows 11 PCs, are no longer billed as servers. For more information…

   Listed under September 2026 on Microsoft Learn
3. GA

   General availability of Defender for Cosmos DB in Azure Government cloud

   September 3, 2026 With this general availability announcement, the Defender for Cosmos DB plan in Azure Government cloud now aligns with the commercial cloud offering in feature coverage and runtime protection capabilities. For more information about Microsoft Defender for Cosmos…

   DocsOverview of Defender for Azure Cosmos DB·Interoperability with Azure services, Azure clouds, and client …

   Overview of Defender for Azure Cosmos DB Learn about the benefits, features, and security capabilities of Microsoft Defender for Azure Cosmos DB to help protect your databases.

   Listed under September 2026 on Microsoft Learn
4. New feature

   Enhanced agent for Defender for SQL Servers on Machines is fully available in Azure Government cloud

   September 29, 2026 In Azure Government cloud, the Defender for SQL Servers on Machines plan in Microsoft Defender for Cloud protects SQL Server instances running on Azure virtual machines and on Azure Arc-enabled machines connected to that cloud. The enhanced…

   DocsUpdate Defender for SQL Servers on Machines Configuration for …Updated·Verify Defender for SQL Servers on Machines Protection in Government …Updated·Troubleshoot Defender for SQL on Machines ConfigurationUpdated·Defender for Cloud pricing page

   Update Defender for SQL Servers on Machines Configuration for Automatic Registration Learn how to update the Defender for SQL Servers on Machines configuration to enable automatic registration for Azure VMs, on-premises, and hybrid environments.

   Listed under September 2026 on Microsoft Learn
5. New feature

   AWS GuardDuty coverage status is now shown on the S3 asset page

   September 3, 2026 Microsoft Defender for Cloud now shows Amazon GuardDuty coverage status for AWS S3 buckets, in the Cloud security details section of the S3 asset page. Two statuses are shown for each bucket, each as Enabled or Disabled…

   Listed under September 2026 on Microsoft Learn

1. New feature

   Update to CVE details data consumption in Azure Resource Graph

   August 21, 2026 Microsoft Defender for Cloud has updated how vulnerability assessment CVE details are consumed in Azure Resource Graph. CVE information remains available, but detailed CVE properties are now consumed through the microsoft.security/cvedetails resource type to improve query performance…

   DocsRemediate Machine VulnerabilitiesUpdated

   Remediate Machine Vulnerabilities Learn how machine vulnerability remediation in Microsoft Defender for Cloud helps you review scan findings, fix risks, and export results.

   Listed under August 2026 on Microsoft Learn
2. New feature

   On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares

   August 6, 2026 On-demand malware scanning in Microsoft Defender for Storage now supports targeted scanning of specific items. Instead of scanning an entire storage account, you can scope scans to a single blob or file, a specific container or file…

   DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated

   Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.

   Listed under August 2026 on Microsoft Learn
3. Retirement

   Classic Defender for SQL APIs retirement

   August 17, 2026 The classic Defender for SQL APIs for Vulnerability Assessment and Advanced Threat Protection will be retired on August 16, 2027 . If you use these APIs, migrate to the supported configuration model and update any dependent scripts…

   DocsMigrate from classic Defender for SQL APIs

   Migrate from classic Defender for SQL APIs Migrate classic Defender for SQL Vulnerability Assessment and Advanced Threat Protection configurations before the APIs retire.

   Listed under August 2026 on Microsoft Learn
4. New feature

   Breaking change: Unused actions no longer included in AWS and GCP overprovisioned identity assessments

   August 6, 2026 To improve the performance and scalability of overprovisioned identity recommendation generation, Microsoft Defender for Cloud will no longer use the unused actions when computing overprovisioned identity assessments for AWS and GCP environments. As a result of this…

   DocsEnable cloud infrastructure entitlement management (CIEM)

   Enable cloud infrastructure entitlement management (CIEM) Enable CIEM to enforce least privilege access and manage user entitlements across Azure, AWS, and GCP as part of Defender for Cloud's CNAPP solution.

   Listed under August 2026 on Microsoft Learn Action may be required

1. Deprecation

   Plan enablement API now blocks onboarding to five deprecated Defender plans

   July 5, 2026 Effective immediately, onboarding is blocked through the plan-enablement API for five deprecated Microsoft Defender for Cloud pricing plans. This update aligns with Microsoft deprecation policy and matches existing portal behavior, where these plans are already blocked in…

   Listed under July 2026 on Microsoft Learn
2. GA

   New container security capabilities are now generally available

   July 1, 2026 The following container security capabilities in Microsoft Defender for Cloud are now generally available: Container-level misconfiguration recommendations for Kubernetes : Agentless, container-level KSPM recommendations in Defender CSPM that assess individual containers rather than entire clusters. The following…

   DocsReference table for all container security recommendations in …·Review and Remediate Kubernetes Node VulnerabilitiesUpdated·View and Remediate Vulnerabilities for Running ContainersUpdated·Containers support matrix in Defender for CloudUpdated

   Reference table for all container security recommendations in Microsoft Defender for Cloud This article lists all Microsoft Defender for Cloud container security recommendations that help you harden and protect your resources.

   Listed under July 2026 on Microsoft Learn
3. GA

   Kubernetes misconfiguration enforcement in Defender for Containers is now generally available

   July 1, 2026 Kubernetes misconfiguration enforcement in Microsoft Defender for Containers is now generally available. This feature evaluates Kubernetes resource configurations at admission time and can audit or block deployments that don't meet Microsoft security best-practice rules. With this release…

   DocsKubernetes Misconfiguration EnforcementUpdated

   Kubernetes Misconfiguration Enforcement Learn about Kubernetes misconfiguration enforcement in Microsoft Defender for Containers to audit or block misconfigured workloads at deployment time.

   Listed under July 2026 on Microsoft Learn
4. GA

   Discovery and posture for serverless container workloads is now generally available

   July 1, 2026 Discovery and posture for serverless container workloads is now generally available in Microsoft Defender for Cloud. This capability provides inventory visibility, security recommendations for misconfigurations and vulnerability assessment findings, and attack path analysis for Azure Container Apps…

   DocsDiscovery and posture for serverless container workloads

   Discovery and posture for serverless container workloads Learn how Microsoft Defender for Cloud uses Defender cloud security posture management (Defender CSPM) to provide inventory, recommendations, and attack path visibility for serverless containers.

   Listed under July 2026 on Microsoft Learn
5. Deprecation

   Deprecation completed: Legacy grouped recommendations removed from Azure portal

   July 31, 2026 Retirement of legacy grouped recommendations (sub-assessments) has started. Customers can no longer access the deprecated data through the API. The Azure portal and Azure Resource Graph might take a few days to reflect the change. Individual recommendations…

   DocsTransition from grouped to individual recommendations in Defender for …Updated

   Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.

   Listed under July 2026 on Microsoft Learn
6. GA

   Database-level recommendations for SQL Vulnerability Assessment (GA)

   July 26, 2026 The SQL vulnerability assessment recommendations created as part of the transition from grouped to individual recommendations are now generally available. Each SQL vulnerability assessment rule is surfaced as its own recommendation, reported directly on the affected SQL…

   DocsTransition from grouped to individual recommendations in Defender for …Updated·SQL vulnerability assessment rules reference·Review and remediate SQL vulnerability assessment findings

   Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.

   Listed under July 2026 on Microsoft Learn

1. Preview

   Vulnerability assessment extended to runtime-discovered container images on EKS and GKE (Preview)

   June 4, 2026 Defender for Cloud now extends vulnerability assessment to runtime-discovered container images on Amazon Elastic Kubernetes Service (EKS) and Google Kubernetes Engine (GKE). Previously, vulnerability assessment covered registry-based images. With this update, images discovered at runtime that weren't…

   DocsView and Remediate Vulnerabilities for Running ContainersUpdated

   View and Remediate Vulnerabilities for Running Containers Learn how to view and remediate vulnerability findings for running containers in Microsoft Defender for Cloud.

   Listed under June 2026 on Microsoft Learn
2. New feature

   Support for additional Azure regions in the UAE geography for Defender for APIs and API security posture management with Defender CSPM

   June 30, 2026 Microsoft Defender for APIs and API security posture management with Defender CSPM has expanded to provide its capabilities in the following Azure regions: UAE North UAE Central Customers who have Azure API Management services in these regions…

   DocsOverview of the Microsoft Defender for APIs plan·API security posture overview

   Overview of the Microsoft Defender for APIs plan Learn about the benefits of the Microsoft Defender for APIs plan in Microsoft Defender for Cloud

   Listed under June 2026 on Microsoft Learn
3. GA

   Serverless protection for Azure and AWS is now generally available

   June 1, 2026 Serverless protection for Azure and Amazon Web Services (AWS) is now generally available in Defender for Cloud. This capability helps you discover serverless resources and assess them for misconfigurations, vulnerabilities, and insecure dependencies across Azure Web Apps…

   DocsWhat is Serverless protection?·Serverless protection recommendations·Interoperability with Azure services, Azure clouds, and client …

   What is Serverless protection? Learn how Serverless protection in Microsoft Defender for Cloud helps secure serverless resources across Azure and AWS.

   Listed under June 2026 on Microsoft Learn
4. GA

   SQL Vulnerability Assessment Express Configuration is now generally available for Azure SQL Managed Instance and Azure Synapse Analytics workspaces

   June 8, 2026 Defender for SQL Vulnerability Assessment (SQL VA) Express Configuration is now generally available for Azure SQL Managed Instance and Azure Synapse Analytics workspaces. Express Configuration is already generally available for Azure SQL Database, and is now available…

   DocsEnable SQL Vulnerability Assessment Express Configuration for Azure …Updated·Scan your Azure SQL databases for vulnerabilities

   Enable SQL Vulnerability Assessment Express Configuration for Azure SQL Learn how to enable the express configuration of SQL vulnerability assessment on Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics.

   Listed under June 2026 on Microsoft Learn
5. Preview

   New multicloud security recommendations now in public preview

   June 9, 2026 More than 60 multicloud security recommendations are now available in public preview. These recommendations add coverage across AWS services including AppFlow, AppStream, AppSync, Athena, Auto Scaling, CodeBuild, Cognito, Comprehend, DMS, DataSync, FSx, Kendra, Keyspaces, Kinesis, MQ, Neptune…

   DocsSecurity Recommendations

   Security Recommendations Learn about security recommendations in Microsoft Defender for Cloud to improve the security posture of your environments.

   Listed under June 2026 on Microsoft Learn
6. Preview

   New actionable recommendation to upgrade AKS for system pod vulnerabilities (Preview)

   June 01, 2026 Defender for Cloud now provides a new, actionable recommendation, Upgrade Azure Kubernetes Service Version (preview) that helps you remediate vulnerabilities in AKS-managed system pods. This replaces the previous non-actionable recommendation with a resolvable remediation path, helping teams…

   DocsReview and Remediate Kubernetes Node VulnerabilitiesUpdated·Reference table for all container security recommendations in …

   Review and Remediate Kubernetes Node Vulnerabilities Learn how to review and remediate vulnerability findings for Kubernetes nodes in Microsoft Defender for Cloud.

   Listed under June 2026 on Microsoft Learn
7. Preview

   Kubernetes node vulnerability assessment extended to EKS and GKE (Preview)

   June 2, 2026 Defender for Cloud now extends Kubernetes node (host) vulnerability assessment to Amazon Elastic Kubernetes Service (EKS) and Google Kubernetes Engine (GKE), bringing parity with the existing Azure Kubernetes Service (AKS) capability. This feature detects OS-level vulnerabilities in…

   DocsReview and Remediate Kubernetes Node VulnerabilitiesUpdated

   Review and Remediate Kubernetes Node Vulnerabilities Learn how to review and remediate vulnerability findings for Kubernetes nodes in Microsoft Defender for Cloud.

   Listed under June 2026 on Microsoft Learn
8. Preview

   Kubernetes misconfiguration enforcement in Defender for Containers (Preview)

   June 3, 2026 Kubernetes misconfiguration enforcement is now available in public preview in Microsoft Defender for Containers. This feature extends Kubernetes security from audit to audit or block mode at deployment time, preventing risky Kubernetes deployments before they reach production…

   DocsConfigure gated deployment rules for Kubernetes container imagesUpdated

   Configure gated deployment rules for Kubernetes container images Learn how to configure gated deployment rules in Microsoft Defender for Containers to audit or block Kubernetes deployments based on container image vulnerability findings.

   Listed under June 2026 on Microsoft Learn
9. GA

   General availability of Microsoft Defender for Open-Source Relational Databases on AWS RDS

   June 1, 2026 Microsoft Defender for Open-Source Relational Databases is now generally available for Amazon Web Services Relational Database Service (AWS RDS) instances. As of June 1, 2026, the plan bills for AWS RDS instances that were previously onboarded to…

   DocsOverview of Defender for Open-Source Relational Databases·Enable Defender for Open-source Relational Databases on Amazon Web …Updated

   Overview of Defender for Open-Source Relational Databases Learn about the benefits and features of Microsoft Defender for Open-Source Relational Databases such as PostgreSQL and MySQL.

   Listed under June 2026 on Microsoft Learn Related post
10. GA

    General availability of Defender for Key Vault in Azure Government cloud

    June 30, 2026 With this general availability announcement, the Defender for Key Vault plan in Azure Government cloud now aligns with the commercial cloud offering in feature coverage and runtime protection capabilities. For more information about Microsoft Defender for Key…

    DocsMicrosoft Defender for Key Vault - the benefits and features·Interoperability with Azure services, Azure clouds, and client …

    Microsoft Defender for Key Vault - the benefits and features Learn about the benefits and features of Microsoft Defender for Key Vault.

    Listed under June 2026 on Microsoft Learn
11. GA

    Expanded multicloud security coverage is now generally available

    June 30, 2026 Microsoft Defender for Cloud's expanded multicloud security coverage is now generally available. This release significantly broadens posture assessment for AWS and GCP environments, adding support for about 90 new resource types and over 200 new security recommendations…

    DocsReference table for all identity and access security recommendations …Updated·New and upcoming changes in recommendations, alerts, and incidents·Reference table for all compute security recommendations in Microsoft …·Reference table for all container security recommendations in …

    Reference table for all identity and access security recommendations in Microsoft Defender for cloud This article lists all Microsoft Defender for Cloud identity and access security recommendations that help you harden and protect your resources.

    Listed under June 2026 on Microsoft Learn
12. New feature

    Expanded container support for cloud scopes

    June 17, 2026 Microsoft Defender for Cloud has expanded the supported environment primitives for cloud scopes to include additional container-related resources. Cloud scopes now support the following new environment types: K8s namespace : Organize resources by Kubernetes namespace for granular…

    DocsManage cloud scopes and unified role-based access control in Microsoft …New

    Manage cloud scopes and unified role-based access control in Microsoft Defender for Cloud Learn how to configure cloud scopes and unified role-based access control for granular permissions management across your cloud environments.

    Listed under June 2026 on Microsoft Learn
13. Preview

    Discovery and posture for serverless container workloads (Preview)

    June 4, 2026 Microsoft Defender for Cloud now includes discovery and posture coverage for supported serverless container workloads in preview. This capability adds inventory visibility, security recommendations for misconfigurations and vulnerability assessment findings, and attack path analysis for Azure Container…

    DocsDiscovery and posture for serverless container workloads

    Discovery and posture for serverless container workloads Learn how Microsoft Defender for Cloud uses Defender cloud security posture management (Defender CSPM) to provide inventory, recommendations, and attack path visibility for serverless containers.

    Listed under June 2026 on Microsoft Learn
14. Preview

    Container-level misconfiguration recommendations for Kubernetes (Preview)

    June 1, 2026 Defender for Cloud now introduces agentless, container-level Kubernetes Security Posture Management (KSPM) misconfiguration recommendations, replacing the previous cluster-level findings with more granular, actionable insights integrated into Defender CSPM. The new recommendations assess individual containers rather than entire…

    DocsReference table for all container security recommendations in …

    Reference table for all container security recommendations in Microsoft Defender for Cloud This article lists all Microsoft Defender for Cloud container security recommendations that help you harden and protect your resources.

    Listed under June 2026 on Microsoft Learn
15. GA

    Cloud security reporting is now generally available

    June 30, 2026 Cloud security reporting in Microsoft Defender portal is now generally available. You can create, customize, and share cloud security insights across your organization using built-in and custom reports. With this release, you can also customize cards when…

    DocsCloud Security Reporting in Microsoft Defender PortalUpdated

    Cloud Security Reporting in Microsoft Defender Portal Learn how to create, customize, and export cloud security reports in Microsoft Defender portal, including built-in reports and custom report options.

    Listed under June 2026 on Microsoft Learn
16. GA

    API security posture management for Function Apps and Logic Apps is now generally available

    June 18, 2026 API discovery and security posture management in the Defender cloud security posture management (Defender CSPM) plan for APIs hosted in Azure Function Apps and Azure Logic Apps is now generally available. This capability extends API security posture…

    DocsEnable API Security Posture with Defender CSPMUpdated·API security posture overview

    Enable API Security Posture with Defender CSPM Discover and secure APIs for API Management, Function Apps, and Logic Apps with prioritized risk insights and API security recommendations.

    Listed under June 2026 on Microsoft Learn

1. New feature

   Updated Helm installation for Defender for Containers sensor

   May 6, 2026 Defender for Containers sensor installation using Helm now uses direct Helm chart deployment instead of installation scripts. The updated flow includes environment-specific Helm commands for Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes…

   DocsInstall Defender for Containers Sensor Using HelmUpdated

   Install Defender for Containers Sensor Using Helm Install the Defender for Containers sensor on AKS, EKS, and GKE clusters by using Helm, including prerequisites, deployment steps, and upgrade guidance.

   Listed under May 2026 on Microsoft Learn
2. Preview

   Scanning support for Docker Hardened container images (preview)

   May 19, 2026 Microsoft Defender for Cloud's vulnerability scanner, powered by Microsoft Defender Vulnerability Management, is extending its scanning coverage to Docker Hardened container images, and identify vulnerabilities in Docker Images to validate that they're shipping the most secure builds…

   DocsContainers support matrix in Defender for CloudUpdated

   Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

   Listed under May 2026 on Microsoft Learn
3. GA

   SQL Vulnerability Assessment Express Configuration now available for Azure SQL Managed Instance and Synapse (Preview)

   May 17, 2026 SQL Vulnerability Assessment (VA) Express Configuration is now available in preview for Azure SQL Managed Instance and Azure Synapse Analytics Workspaces. This Microsoft-managed storage tool for vulnerability baselines and scan results extends the same experience already available…

   DocsEnable SQL Vulnerability Assessment Express Configuration for Azure …Updated·Scan your Azure SQL databases for vulnerabilities

   Enable SQL Vulnerability Assessment Express Configuration for Azure SQL Learn how to enable the express configuration of SQL vulnerability assessment on Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics.

   Listed under May 2026 on Microsoft Learn
4. Preview

   Private clusters protection for gated deployment, binary drift detection, and malware detection (Preview)

   May 31, 2026 Private clusters now support the Defender sensor for gated deployment, binary drift detection, and malware detection in preview. This update extends Defender for Containers coverage to private cluster scenarios where you use the sensor-based features for container…

   DocsDeploy Defender for Containers to private clusters (Preview)·Access patterns and private cluster support for Defender for …

   Deploy Defender for Containers to private clusters (Preview) Learn how to deploy Microsoft Defender for Containers to private clusters by using preview Helm charts and the Azure Arc Preview release train.

   Listed under May 2026 on Microsoft Learn
5. GA

   Microsoft Defender for Open-Source Relational Databases on AWS RDS will become Generally Available

   May 24, 2026 Microsoft Defender for Open-Source Relational Databases will be generally available for Amazon Web Services Relational Database Service (AWS RDS) instances on June 1, 2026 . Starting June 1, 2026, the plan will begin billing for AWS RDS…

   DocsEnable Defender for Open-source Relational Databases on Amazon Web …Updated·Overview of Defender for Open-Source Relational Databases

   Enable Defender for Open-source Relational Databases on Amazon Web Services (AWS) Enable Defender for open-source relational databases on AWS RDS to detect suspicious activity and protect supported database engines.

   Listed under May 2026 on Microsoft Learn
6. New feature

   Microsoft Defender Experts for Servers as a managed XDR option

   May 18, 2026 Defender for Cloud is now partnered with Microsoft Defender Experts, as a managed extended detection and response (XDR) service for server workloads. Microsoft analysts and automation work together to detect, prioritize, and respond to threats on machines…

   DocsOverview of Defender for Servers in Defender for CloudUpdated

   Overview of Defender for Servers in Defender for Cloud Get an overview of the Defender for Servers plan in Microsoft Defender for Cloud, including its features and integration with other Defender services.

   Listed under May 2026 on Microsoft Learn
7. Preview

   Malware detection for EKS and GKE nodes (Preview)

   May 31, 2026 Malware detection is now in preview for Amazon Elastic Kubernetes Service (EKS) nodes and Google Kubernetes Engine (GKE) nodes. This update expands Kubernetes node malware coverage beyond Azure Kubernetes Service (AKS) so you can detect malware in…

   DocsReview and Remediate Malware Alerts for Kubernetes NodesUpdated·Overview of Kubernetes Nodes Protection

   Review and Remediate Malware Alerts for Kubernetes Nodes Defender for Containers uses the Microsoft Defender Antivirus anti-malware engine. Learn how to review and remediate malware alerts.

   Listed under May 2026 on Microsoft Learn
8. GA

   General availability of on-demand malware scanning of Azure Files in Microsoft Defender for Storage

   May 26, 2026 On-demand malware scanning of Azure Files in Microsoft Defender for Storage is now generally available. This feature extends on-demand malware scanning so you can scan Azure Storage accounts that contain blobs and files. You can start scans…

   DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated

   Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.

   Listed under May 2026 on Microsoft Learn
9. Deprecation

   General availability of individual recommendations for Defender for Cloud in Azure portal and deprecation of legacy grouped recommendations

   May 5, 2026 Individual recommendations for Defender for Cloud that were previously represented as grouped recommendations are now generally available (GA) in the Azure portal. Azure portal secure score behavior: The classic secure score in the Azure portal is also…

   DocsReview Security Recommendations in Microsoft Defender for CloudUpdated·Transition from grouped to individual recommendations in Defender for …Updated

   Review Security Recommendations in Microsoft Defender for Cloud Learn how to review security recommendations in Microsoft Defender for Cloud to improve the security posture of your environments.

   Listed under May 2026 on Microsoft Learn
10. GA

    General availability of Microsoft Defender for Cloud and GitHub Advanced Security integration

    May 3, 2026 The native integration between Microsoft Defender for Cloud and GitHub Advanced Security (GHAS) is now generally available. This integration connects runtime security signals from Defender for Cloud with code-level vulnerability management in GHAS, enabling developers and security…

    DocsGitHub Advanced Security Integration with Microsoft Defender for Cloud·Deploy GitHub Advanced Security Integration with Microsoft Defender …Updated

    GitHub Advanced Security Integration with Microsoft Defender for Cloud Learn how GitHub Advanced Security integrates with Microsoft Defender for Cloud to provide unified code-to-runtime security from development to production.

    Listed under May 2026 on Microsoft Learn
11. GA

    General availability of Defender for Cloud integration into the Defender portal

    May 5, 2026 Microsoft Defender for Cloud is now integrated into the Microsoft Defender portal, unifying cloud security posture management and threat protection in a single experience. This integration provides a centralized view across hybrid and multicloud environments, including Azure…

    DocsOverview of Defender for Cloud in Defender PortalUpdated

    Overview of Defender for Cloud in Defender Portal Comprehensive overview of Microsoft Defender for Cloud in the Defender portal, including navigation hub, dashboard features, and unified security management capabilities.

    Listed under May 2026 on Microsoft Learn
12. New feature

    Daily score calculation enhancement for risk-based Cloud secure score

    May 5, 2026 We've improved how daily Cloud secure score values are calculated to more accurately reflect your posture and the impact of actions taken throughout the day. Daily scores represent end-of-day snapshots instead of averaged values over the course…

    DocsCloud Secure Score in Microsoft Defender for Cloud

    Cloud Secure Score in Microsoft Defender for Cloud Learn about the Microsoft Defender for Cloud secure score, which is part of the Microsoft cloud security benchmark.

    Listed under May 2026 on Microsoft Learn
13. Preview

    Cloud security reporting in Microsoft Defender portal (Preview)

    May 20, 2026 Microsoft Defender portal now includes integrated cloud security reporting capabilities, enabling you to create, customize, and share security insights across your organization. With cloud security reporting, you can: View built-in reports such as CNAPP Executive Summary and…

    DocsCloud Security Reporting in Microsoft Defender PortalUpdated

    Cloud Security Reporting in Microsoft Defender Portal Learn how to create, customize, and export cloud security reports in Microsoft Defender portal, including built-in reports and custom report options.

    Listed under May 2026 on Microsoft Learn

1. New feature

   Update to Defender for SQL servers on machines plan for Fairfax customers

   April 1, 2026 The Defender for SQL Server on machines plan in Microsoft Defender for Cloud protects SQL Server instances hosted on Azure, AWS, GCP, and on-premises machines. To simplify onboarding and improve protection coverage, we're releasing an enhanced agent…

   DocsUpdate Defender for SQL Servers on Machines Configuration for …Updated·Verify SQL Machine ProtectionUpdated·Troubleshoot Defender for SQL on Machines ConfigurationUpdated

   Update Defender for SQL Servers on Machines Configuration for Automatic Registration Learn how to update the Defender for SQL Servers on Machines configuration to enable automatic registration for Azure VMs, on-premises, and hybrid environments.

   Listed under April 2026 on Microsoft Learn
2. GA

   General availability of container security capabilities in Azure Government cloud

   April 1, 2026 The service helps U.S. federal and government agencies, including the Department of Defense (DoD) and civilian agencies, secure Kubernetes workloads by providing cloud security posture management, vulnerability assessment, and runtime threat protection for containerized environments. The Defender…

   DocsContainers support matrix in Defender for CloudUpdated·Introduction to Microsoft Defender for Containers

   Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

   Listed under April 2026 on Microsoft Learn
3. GA

   General availability of Defender for Storage integration in Azure portal Storage Center

   April 20, 2026 This integration brings Defender for Storage insights directly into the native storage management experience. This approach makes it easier for customers to understand and improve their storage security posture at scale. Customers can now view Defender for…

   DocsAbout Blob (object) storage

   About Blob (object) storage Azure Blob storage stores massive amounts of unstructured object data, such as text or binary data. Blob storage also supports Azure Data Lake Storage for big data analytics.

   Listed under April 2026 on Microsoft Learn
4. GA

   Defender for Containers runtime protection on EKS Bottlerocket is now generally available

   April 30, 2026 Defender for Containers runtime protection now supports AWS Bottlerocket operating systems on Amazon Elastic Kubernetes Service (EKS) in general availability. Learn more about Defender for Containers runtime protection .

   DocsContainers support matrix in Defender for CloudUpdated

   Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

   Listed under April 2026 on Microsoft Learn
5. GA

   DNS Detection for Kubernetes is now generally available

   April 30, 2026 DNS Detection for Kubernetes is now generally available in Defender for Containers for Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes Engine (GKE). DNS Detection monitors DNS queries from containerized workloads to detect…

   DocsContainers support matrix in Defender for CloudUpdated

   Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

   Listed under April 2026 on Microsoft Learn
6. GA

   Anti-malware detection and blocking is now generally available

   April 30, 2026 Container runtime anti-malware detection and blocking is now generally available in Defender for Containers for Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes Engine (GKE). Anti-malware detection and blocking detects and blocks malware…

   DocsContainer runtime antimalware detection and blocking

   Container runtime antimalware detection and blocking Learn how to configure container runtime antimalware detection and blocking to block or alert on malware in Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) environments.

   Listed under April 2026 on Microsoft Learn

1. New feature

   Support for additional Azure regions for Defender for APIs and API security posture management with Defender CSPM

   March 31, 2026 Microsoft Defender for APIs and API security posture management with Defender CSPM has expanded to provide its capabilities in the following Azure regions: Sweden Central Sweden South Germany West Central Germany North Italy North France Central France…

   DocsAPI security posture overview·Overview of the Microsoft Defender for APIs plan

   API security posture overview Learn how Microsoft Defender for Cloud enhances API security posture management for your APIs across Azure API Management, Function Apps, and Logic Apps.

   Listed under March 2026 on Microsoft Learn
2. New feature

   Severity-based risk assignment for "Not evaluated" recommendations

   March 11, 2026 Recommendations that previously appeared as Not evaluated will now receive a risk level derived from the recommendation severity. As a result, these recommendations will now be prioritized in the recommendations list based on their assigned risk level…

   DocsSecurity Recommendations

   Security Recommendations Learn about security recommendations in Microsoft Defender for Cloud to improve the security posture of your environments.

   Listed under March 2026 on Microsoft Learn
3. Preview

   On-demand malware scanning of Azure Files in Microsoft Defender for Storage (Preview)

   March 10, 2026 On-demand malware scanning for Azure Files in Microsoft Defender for Storage is now in preview. This preview extends the existing on-demand malware scan feature and lets you scan entire Azure Storage accounts that contain blobs and files…

   DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated

   Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.

   Listed under March 2026 on Microsoft Learn
4. Preview

   New individual recommendations format in Azure portal (Preview)

   March 04, 2026 Microsoft Defender for Cloud is converting grouped recommendations into individual recommendations in the Azure portal. This change reflects a shift from grouping related findings under one recommendation to listing each recommendation separately. What's changing. You might see…

   DocsTransition from grouped to individual recommendations in Defender for …Updated·Review Security Recommendations in Microsoft Defender for CloudUpdated

   Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.

   Listed under March 2026 on Microsoft Learn
5. GA

   Kubernetes gated deployment support for AKS Automatic (GA)

   March 12, 2026 Kubernetes gated deployment is now generally available for AKS Automatic clusters. To use this capability, install the Defender for Containers sensor by using Helm in the kube-system namespace. If the sensor is currently installed through the AKS…

   DocsInstall Defender for Containers Sensor Using HelmUpdated

   Install Defender for Containers Sensor Using Helm Install the Defender for Containers sensor on AKS, EKS, and GKE clusters by using Helm, including prerequisites, deployment steps, and upgrade guidance.

   Listed under March 2026 on Microsoft Learn
6. New feature

   File Integrity Monitoring requires MDE agent version 10.8799+ for legacy Windows machines

   Due to a pipeline change in Microsoft Defender for Endpoint (MDE), File Integrity Monitoring now requires the Defender for Servers Windows client (Microsoft Defender for Endpoint agent) version 10.8799 or above for proper functionality on legacy Windows machines (downlevel clients)…

   DocsEnable File Integrity MonitoringNew·Overview of file integrity monitoring in Microsoft Defender for Cloud

   Enable File Integrity Monitoring Configure File Integrity Monitoring in Microsoft Defender for Cloud. Use the Defender for Endpoint scanning to collect monitoring data.

   Listed under March 2026 on Microsoft Learn
7. Preview

   Expanded multicloud coverage for AWS and GCP (Preview)

   March 29, 2026 Microsoft Defender for Cloud expands multicloud posture management with broader native coverage for AWS and GCP. This update adds discovery and posture assessment for additional resource types across compute, databases, storage, analytics, networking, identity, secrets, DevOps, and…

   DocsReview Security Recommendations in Microsoft Defender for CloudUpdated

   Review Security Recommendations in Microsoft Defender for Cloud Learn how to review security recommendations in Microsoft Defender for Cloud to improve the security posture of your environments.

   Listed under March 2026 on Microsoft Learn
8. Deprecation

   Deprecation of preview of container and container images vulnerability recommendations

   March 04, 2026 As part of the transition to individual recommendations, Microsoft Defender for Cloud is deprecating existing grouped container vulnerability recommendations. This change enables more granular visibility, prioritization, and governance of container security findings. Grouped recommendations previously aggregated multiple…

   DocsReview Security Recommendations in Microsoft Defender for CloudUpdated

   Review Security Recommendations in Microsoft Defender for Cloud Learn how to review security recommendations in Microsoft Defender for Cloud to improve the security posture of your environments.

   Listed under March 2026 on Microsoft Learn
9. Preview

   Code to runtime enrichment for recommendations (Preview)

   March 10, 2026 Microsoft Defender for Cloud now provides Code to runtime capabilities, enabling end-to-end visibility across the software development lifecycle (SDLC). This feature helps security teams trace runtime security issues back to their source code origins and understand the…

   DocsUse Code-to-runtime Visibility for Security RecommendationsUpdated·Map container images from code to runtime

   Use Code-to-runtime Visibility for Security Recommendations Learn how to use code to runtime visibility to trace security issues from runtime back to source code and fix them at the origin to prevent recurrence.

   Listed under March 2026 on Microsoft Learn
10. GA

    Automated malware remediation in Defender for Storage

    March 31, 2026 Automated malware remediation in Defender for Storage is now generally available. Defender for Cloud now lets you automatically soft-delete malicious blobs detected during on-upload or on-demand malware scanning. Soft-deleted blobs are quarantined and can be recovered for…

    DocsSet Up Automated Remediation for Malware Detection

    Set Up Automated Remediation for Malware Detection Learn how to set up automated remediation for malware detection in Microsoft Defender for Storage to protect your Azure Storage accounts from harmful files.

    Listed under March 2026 on Microsoft Learn
11. Preview

    AI model security for Azure Machine Learning (Preview)

    March 30, 2026 Microsoft Defender for Cloud now offers AI model security in preview for Azure Machine Learning registries and workspaces. AI model security helps security teams discover and scan custom AI models for risks before deployment, and review findings…

    DocsDiscover AI models (Preview)

    Discover AI models (Preview) Learn about AI model security in Microsoft Defender for Cloud.

    Listed under March 2026 on Microsoft Learn

1. GA

   Updated CIEM recommendation logic

   February 2, 2026 Cloud Infrastructure Entitlement Management (CIEM) recommendations are now available as a native capability in Microsoft Defender for Cloud across Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). This update changes how inactive identities and over-permissioned…

   DocsIntegrate AWS CloudTrail LogsUpdated·Integrate GCP cloud logging·Cloud infrastructure entitlement management (CIEM)

   Integrate AWS CloudTrail Logs AWS CloudTrail logs give Defender for Cloud visibility into permission changes and control-plane activity. Learn to enable and verify ingestion.

   Listed under February 2026 on Microsoft Learn
2. Preview

   Threat protection for AI agents (Preview)

   February 2, 2026 Microsoft Defender for Cloud now includes threat protection for AI agents built with Foundry, available in preview as part of the Defender for AI Services plan. This new capability delivers advanced security from development through runtime, addressing…

   DocsAlerts for AI services

   Alerts for AI services This article lists the security alerts for AI services visible in Microsoft Defender for Cloud.

   Listed under February 2026 on Microsoft Learn
3. GA

   Simulate alerts for SQL servers on machines

   February 9, 2026 Microsoft Defender for Cloud’s SQL simulated alerts is now generally available. Simulated alerts let security teams safely validate SQL protection, detections, and automated response workflows without introducing real risk. Simulated alerts generate realistic alerts with full SQL…

   DocsSimulate Alerts for SQL Servers on MachinesUpdated

   Simulate Alerts for SQL Servers on Machines Simulate alerts for SQL servers on machines to safely validate your Defender for Cloud detection and response workflows. Learn how to run and verify test alerts.

   Listed under February 2026 on Microsoft Learn
4. New feature

   Scanning support for Minimus and Photon OS container images

   February 10, 2026 Microsoft Defender for Cloud's vulnerability scanner, powered by Microsoft Defender Vulnerability Management, is extending its scanning coverage to Minimus and Photon OS container images to help validate that they're shipping the most secure builds possible. As additional…

   DocsContainers support matrix in Defender for CloudUpdated

   Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

   Listed under February 2026 on Microsoft Learn
5. Preview

   Database-level recommendations experience for SQL Vulnerability Assessment (Preview)

   February 10, 2026 Microsoft Defender for SQL is introducing a database-level recommendations experience for SQL Vulnerability Assessment in preview. This update applies to SQL VA across all supported database types (PaaS and IaaS), including both Express and Classic configurations, and…

   DocsReview and remediate SQL vulnerability assessment findings·SQL vulnerability assessment rules reference

   Review and remediate SQL vulnerability assessment findings Learn how to find, review, and remediate SQL vulnerability assessment findings in Microsoft Defender for Cloud for Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics.

   Listed under February 2026 on Microsoft Learn
6. Preview

   Container runtime anti-malware detection and blocking (Preview)

   February 22, 2026 Microsoft Defender for Cloud is announcing container runtime anti-malware detection and prevention in preview. This feature provides real-time detection and prevention of malware in containerized workloads across Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and…

   DocsContainer runtime antimalware detection and blocking

   Container runtime antimalware detection and blocking Learn how to configure container runtime antimalware detection and blocking to block or alert on malware in Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) environments.

   Listed under February 2026 on Microsoft Learn
7. Preview

   Binary drift now supports blocking (Preview)

   February 22, 2026 Binary drift now supports blocking in preview. With this update, you can configure binary drift policies to not only detect but also block unauthorized changes to container images at runtime. This enhancement helps prevent potential security breaches…

   DocsBinary drift detection and blocking

   Binary drift detection and blocking Learn how binary drift detecting and blocking can help you detect unauthorized external processes within containers.

   Listed under February 2026 on Microsoft Learn

1. Preview

   Microsoft Security Private Link (Preview)

   January 8, 2026 Microsoft Defender for Cloud is announcing Microsoft Security Private Link in Preview. Microsoft Security Private Link enables private connectivity between Defender for Cloud and your workloads. The connection is established by creating private endpoints in your virtual…

   DocsMicrosoft Security Private Link for Microsoft Defender for CloudUpdated

   Microsoft Security Private Link for Microsoft Defender for Cloud Learn how Microsoft Security Private Link provides secure, private connectivity between your virtual network and Microsoft Defender for Cloud.

   Listed under January 2026 on Microsoft Learn

No changes match.