https://securitynews.ms/products/microsoft-defender-for-endpoint/Microsoft Defender for Endpoint news and documented product changes, each linked to Microsoft's own source.enSun, 01 Nov 2026 00:00:00 +0000https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#november-2026--macos-release-build-101-26092-0012https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#november-2026--macos-release-build-101-26092-0012Sun, 01 Nov 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26092.0012. Release version 20.126092.12.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--november-2026--101261010000https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--november-2026--101261010000Sun, 01 Nov 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Release version Engine version Signature version 30.126101.0000.0 1.1.26090.3000 1.459.148.0 Enhancements and features Feature area Update summary Security Upgraded OpenSSL version to 3.6.4 Bug fix Fixed missing CentOS minor patch version in the Defender portal General Optimized memory usage…https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/secure-linux-desktops-with-microsoft-defender/ba-p/4560822https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/secure-linux-desktops-with-microsoft-defender/ba-p/4560822Wed, 14 Oct 2026 16:00:00 +0000Microsoft Defender for Endpoint BlogAs more developers begin to use Linux desktops, they become more attractive to attackers: high-privilege, high-value, and easy for admins to overlook. A developer using Linux for day-to-day development may interact with source code repositories, continuous integration and continuous delivery (CI/CD) pipelines…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--macos-release-build-101-26092-0009https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--macos-release-build-101-26092-0009Thu, 01 Oct 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26092.0009. Release version 20.126092.9.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--macos-release-build-101-26082-0012https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--macos-release-build-101-26082-0012Thu, 01 Oct 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26082.0012. Release version 20.126082.12.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--october-2026--platform-418261004--engine-11261004https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--october-2026--platform-418261004--engine-11261004Thu, 01 Oct 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Component Version Date Platform 4.18.26100.4 October 27, 2026 Engine 1.1.26100.4 October 27, 2026 Security intelligence 1 1.463.1.0 October 27, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--local-ai-agent-discovery-on-windows-and-macoshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--local-ai-agent-discovery-on-windows-and-macosThu, 01 Oct 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnLocal AI agent discovery on Windows and macOS. Discover supported local AI agents and their configured MCP servers on onboarded Windows and macOS devices, and investigate them in the AI agent inventory and advanced hunting. Windows requires Microsoft Defender Antivirus…https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--october-2026--101260910004https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--october-2026--101260910004Thu, 01 Oct 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Release version Engine version Signature version 30.126091.0004.0 1.1.26070.5001 1.457.364.0 Enhancements and features Feature area Update summary Platform Support Added support for Azure Linux 4. Visibility Added TCP socket bind telemetry, improving visibility into processes binding to local network…https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--october-2026--101260910003https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--october-2026--101260910003Thu, 01 Oct 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Release version Engine version Signature version 30.126091.0003.0 1.1.26090.3000 1.461.35.0 Enhancements and features Feature area Update summary Security Upgraded libcurl to version 8.22.0 to address CVE-2026-9546. Security Hardened quarantine operations by enforcing authorization checks and protecting against file-path manipulation…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--antivirus-audit-mode-for-linuxhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--antivirus-audit-mode-for-linuxThu, 01 Oct 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnAntivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--macos-release-build-101-26072-0017https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--macos-release-build-101-26072-0017Tue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26072.0017. Release version 20.126072.17.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--september-2026--platform-418260909--engine-11260909https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--september-2026--platform-418260909--engine-11260909Tue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Component Version Date Platform 4.18.26090.9 October 12, 2026 Engine 1.1.26090.9 October 12, 2026 Security intelligence 1 1.461.1.0 October 12, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--microsoft-defender-support-for-linux-desktopshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--microsoft-defender-support-for-linux-desktopsTue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnMicrosoft Defender support for Linux Desktops. Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Deployment methods and security capabilities remain consistent across both…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--microsoft-defender-for-endpoint-plug-in-support-for-wsl-conthttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--microsoft-defender-for-endpoint-plug-in-support-for-wsl-contTue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnMicrosoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--microsoft-defender-for-endpoint-plug-in-support-for-wsl-cont-1https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--microsoft-defender-for-endpoint-plug-in-support-for-wsl-cont-1Tue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnMicrosoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--memory-scan-for-linuxhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--memory-scan-for-linuxTue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnMemory scan for Linux. Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are…https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--september-2026--101260810010https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--september-2026--101260810010Tue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Release version Engine version Signature version 30.126081.0010.0 1.1.26090.3000 1.459.287.0 Enhancements and features Feature area Update summary Device identity Fixed an issue where cloned Linux virtual machines could retain the source image's machine identifier, causing multiple endpoints to appear…https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--september-2026--101260720005https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--september-2026--101260720005Tue, 01 Sep 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Release version Engine version Signature version 30.126072.0005.0 1.1.26070.5001 1.459.239.0 Enhancements and features Feature area Update summary Security Memory scanning (preview) adds process memory scanning to detect known malicious behaviors and memory-resident threats, which strengthens protection against in-memory attacks…https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/become-a-microsoft-defender-for-endpoint-ninja/1515647https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/become-a-microsoft-defender-for-endpoint-ninja/1515647Wed, 05 Aug 2026 13:25:51 +0000Microsoft Defender for Endpoint BlogDo you want to become a ninja for Microsoft Defender for Endpoint? We can help you get there!https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--macos-release-build-101-26062-0012https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--macos-release-build-101-26062-0012Sat, 01 Aug 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26062.0012. Release version 20.126062.12.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--macos-release-build-101-26062-0011https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--macos-release-build-101-26062-0011Sat, 01 Aug 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26062.0011. Release version 20.126062.11.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--august-2026-2--platform-418260804--engine-11260803https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--august-2026-2--platform-418260804--engine-11260803Sat, 01 Aug 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Component Version Date Platform 4.18.26080.4 September 17, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--august-2026--platform-418260803--engine-11260803https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--august-2026--platform-418260803--engine-11260803Sat, 01 Aug 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Component Version Date Platform 4.18.26080.3 September 1, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--tamper-protection-in-audit-mode-for-linuxhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--tamper-protection-in-audit-mode-for-linuxSat, 01 Aug 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnTamper protection in audit mode for Linux. Detects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--offboarding-api-support-for-linuxhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--offboarding-api-support-for-linuxSat, 01 Aug 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnOffboarding API support for Linux. Enables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale. Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--antivirus-audit-mode-for-linuxhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#august-2026--antivirus-audit-mode-for-linuxSat, 01 Aug 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnAntivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-scheduled-antivirus-scans-on-microsoft-defender/ba-p/4524578https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-scheduled-antivirus-scans-on-microsoft-defender/ba-p/4524578Wed, 15 Jul 2026 14:05:55 +0000Microsoft Defender for Endpoint BlogSecurity teams rely on scheduled scans to ensure consistent coverage across devices, detect dormant or missed threats, and meet compliance requirements. However, managing scans on Linux has traditionally required custom scripts and cron-based setups, which can be hard to scale and maintain…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--macos-release-build-101-26062-0009https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--macos-release-build-101-26062-0009Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26062.0009. Release version 20.126062.9.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--macos-release-build-101-26052-0016https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--macos-release-build-101-26052-0016Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26052.0016. Release version 20.126052.16.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--july-2026--platform-version-1179080103https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--july-2026--platform-version-1179080103Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Platform version Release Date 1.1.79080103 July 20, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes.https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--july-2026--platform-version-1178290102https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--july-2026--platform-version-1178290102Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Platform version Release Date 1.1.78290102 July 3, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes. Feature Improvement in compliance flow.https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--ios-release-build-1-1-78290102https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--ios-release-build-1-1-78290102Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearniOS release: Build 1.1.78290102. Release version 1.1.78290102 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--july-2026--platform-418260709--engine-11260707https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--july-2026--platform-418260709--engine-11260707Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Component Version Date Platform 4.18.26070.9 August 5, 2026 Engine 1.1.26070.7 August 5, 2026 Security intelligence 1 1.457.11.0 August 5, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--july-2026--101260520012https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux--july-2026--101260520012Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Release version Engine version Signature version 30.126052.0012.0 1.1.26040.3001 1.449.136.0 Enhancements and features Feature area Update summary Visibility Improved antivirus enforcement visibility. The mdatp health command now includes a new antivirus_enforcement_level field that shows whether antivirus is running in…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--defender-deployment-tool-for-linuxhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--defender-deployment-tool-for-linuxWed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnDefender Deployment Tool for Linux. Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation…https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#android--july-2026--platform-1091070101https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#android--july-2026--platform-1091070101Wed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Platform version Release Date 1.0.9107.0101 July 21, 2026 Enhancements and features Feature Area Update Summary General Performance improvements and general bug fixes.https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--ai-agent-runtime-protection-updateshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#july-2026--ai-agent-runtime-protection-updatesWed, 01 Jul 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnAI agent runtime protection updates. AI agent runtime protection includes these enhancements: - Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI…https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/reduce-unnecessary-internet-exposure-with-microsoft-defender/ba-p/4525654https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/reduce-unnecessary-internet-exposure-with-microsoft-defender/ba-p/4525654Thu, 11 Jun 2026 16:00:00 +0000Microsoft Defender for Endpoint BlogIn today’s threat landscape, internet exposure , i.e. devices that allow inbound connectivity from the public internet, continues to be a major vector for initial access and compromise. Devices that are exposed to the public internet can significantly increase an organization’s attack…https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-now-monitors-rpc-activity/ba-p/4523368https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-now-monitors-rpc-activity/ba-p/4523368Tue, 09 Jun 2026 16:55:28 +0000Microsoft Defender for Endpoint BlogRemote procedure call (RPC) is a protocol commonly abused by attackers that allows functions implemented in a separate process, and potentially on a remote machine, to be called as if they were local. Many core Windows and Active Directory capabilities are built…https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/elevate-your-telemetry-using-custom-data-collection-in-microsoft/ba-p/4512530https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/elevate-your-telemetry-using-custom-data-collection-in-microsoft/ba-p/4512530Tue, 09 Jun 2026 16:00:00 +0000Microsoft Defender for Endpoint BlogAt Ignite in November, we announced that Microsoft Defender is now the only endpoint protection solution that allows data-hungry security teams to meet specific telemetry needs by optimizing their data collection right within the Defender portal, without the need to rely on…https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-microsoft-defender-used-predictive-shielding-to-proactively/ba-p/4519498https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-microsoft-defender-used-predictive-shielding-to-proactively/ba-p/4519498Mon, 01 Jun 2026 17:16:47 +0000Microsoft Defender for Endpoint BlogModern ransomware attacks are increasingly designed to blend in with normal IT operations, using trusted administrative tools to quietly weaken defenses and distribute malicious payloads at scale. In a recent real‐world incident, a human‐operated ransomware actor attempted to do exactly that by…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--macos-release-build-101-26042-0020https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--macos-release-build-101-26042-0020Mon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnmacOS release: Build 101.26042.0020. Release version 20.126042.20.0 released: See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--june-2026--platform-version-1178020101https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--june-2026--platform-version-1178020101Mon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Platform version Release Date 1.1.78020101 June 11, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes.https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--june-2026--platform-version-1177280101https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#ios--june-2026--platform-version-1177280101Mon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Platform version Release Date 1.1.77280101 June 1, 2026 Enhancements and features Feature Area Update Summary Feature Enhancements The Trust this network option is now only applicable to unsecure networks. Suspicious/rogue networks can't be trusted by users. Improvements Performance…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--windows-release-windows-defender-antivirus-platform-4-18-260https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--windows-release-windows-defender-antivirus-platform-4-18-260Mon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnWindows release: Windows Defender Antivirus: Platform 4.18.26050.15 / Engine 1.1.26050.11. See enhancements and features for this release .https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--june-2026--platform-418260603008--engine-11260603008https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#windows-antivirus--june-2026--platform-418260603008--engine-11260603008Mon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnRelease details Component Version Date Platform 4.18.26060.3008 June 30, 2026 Engine 1.1.26060.3008 June 30, 2026 Security intelligence 1 1.455.25.0 June 30, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--selective-response-actionshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--selective-response-actionsMon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnSelective Response Actions. Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--local-ai-agent-runtime-protectionhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--local-ai-agent-runtime-protectionMon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnLocal AI agent runtime protection. Runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--local-ai-agent-discovery-macos-support-and-new-agentshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--local-ai-agent-discovery-macos-support-and-new-agentsMon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnLocal AI agent discovery — macOS support and new agents. Local AI agent discovery now supports macOS endpoints in addition to Windows. This update also adds discovery support for new agents including Junie CLI, Kiro CLI, Warp, Hermes Agent, Goose…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--local-ai-agent-discoveryhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--local-ai-agent-discoveryMon, 01 Jun 2026 00:00:00 +0000Defender for Endpoint · Microsoft LearnLocal AI agent discovery. Microsoft Defender for Endpoint now automatically discovers supported local AI agents running on onboarded Windows devices — including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as…