Microsoft Defender for Office 365

1. New feature

   New ApproverUpn field in the EmailPostDeliveryEvents table

   New ApproverUpn field in the EmailPostDeliveryEvents table : The EmailPostDeliveryEvents table in Microsoft Defender XDR Advanced Hunting now includes the ApproverUpn field. This field identifies the user or administrator who approved a remediation action, helping security teams investigate and audit…

   DocsEmailPostDeliveryEvents table in the advanced hunting schema

   EmailPostDeliveryEvents table in the advanced hunting schema Learn about post-delivery actions taken on Microsoft 365 emails in the EmailPostDeliveryEvents table of the advanced hunting schema

   Listed under October 2026 on Microsoft Learn
2. New feature

   Hunt across activities in Microsoft Teams calls and meetings

   Hunt across activities in Microsoft Teams calls and meetings : The CallActivityEvents table in Microsoft Defender XDR advanced hunting contains details about activities performed during Microsoft Teams calls and meetings in your organization, helping security teams investigate suspicious call activity.

   DocsCallActivityEvents table in the advanced hunting schemaNew

   CallActivityEvents table in the advanced hunting schema Learn about the CallActivityEvents table in the advanced hunting schema, which contains details about activities performed during Microsoft Teams calls.

   Listed under October 2026 on Microsoft Learn
3. New feature

   Expanding user reporting in Teams to include meetings

   Expanding user reporting in Teams to include meetings : Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that…

   DocsUser reported settings in TeamsNew

   User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

   Listed under October 2026 on Microsoft Learn

1. New feature

   Separating Teams user reporting settings from email settings

   Separating Teams user reporting settings from email settings : Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting…

   Docshttps://security.microsoft.com/securitysettings/teamsUserSubmission

   Listed under September 2026 on Microsoft Learn
2. New feature

   Expanding user reporting in Teams to include group calls

   Expanding user reporting in Teams to include group calls : Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings , reported calls are sent…

   DocsUser reported settings in TeamsNew·Configure user reported message settings in Microsoft Defender for …New

   User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

   Listed under September 2026 on Microsoft Learn

1. New feature

   Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations

   Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations : Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model…

   DocsConfigure Unified RBAC for Microsoft Defender for Office 365·MC1246006

   Configure Unified RBAC for Microsoft Defender for Office 365 Step-by-step guide to configure and activate Microsoft Defender unified role-based access control (Unified RBAC) for Microsoft Defender for Office 365, including role creation, persona templates, and migration from legacy roles.

   Listed under July 2026 on Microsoft Learn
2. New feature

   Prompt injection protection

   Prompt injection protection : Microsoft Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Microsoft Defender for Office 365 .

   DocsPrompt injection protection in Microsoft Defender for Office 365

   Prompt injection protection in Microsoft Defender for Office 365 Learn how Microsoft Defender for Office 365 detects prompt injection attacks hidden in email, how the detection technology works, and how it provides defense in depth for AI-based threats alongside built-in Microsoft Copilot protections.

   Listed under July 2026 on Microsoft Learn
3. New feature

   Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3

   Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3 : Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365…

   DocsWhy do I need Microsoft Defender for Office 365?

   Why do I need Microsoft Defender for Office 365? Learn how Microsoft Defender for Office 365 protects email and collaboration from phishing, malware, and business email compromise with Plan 1 and Plan 2 features.

   Listed under July 2026 on Microsoft Learn Related post
4. New feature

   Localized default Mark as and notify email templates

   Localized default Mark as and notify email templates : When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more…

   DocsAdmin review for user reported messagesNew

   Admin review for user reported messages Admins can learn how to review messages that were reported by users and give them feedback.

   Listed under July 2026 on Microsoft Learn

1. New feature

   Security Copilot email summary on the Email entity page

   Security Copilot email summary on the Email entity page : If you have a Microsoft Security Copilot subscription, you can generate an AI summary of email entity data directly from the Email entity page by selecting the Copilot action.

   DocsThe Email entity page in Defender for Office 365Updated·Get started with Microsoft Security Copilot

   The Email entity page in Defender for Office 365 Admins can learn about the Email entity page in Microsoft Defender for Office 365. This page shows many details about email messages. For example, email headers, threat detection details, the latest and original delivery locations, delivery actions, and IDs (for…

   Listed under April 2026 on Microsoft Learn
2. GA

   Remove users from Teams chats is generally available

   Remove users from Teams chats is generally available : The ability to remove internal users from Teams chats in the Teams message entity panel is now generally available.

   DocsInvestigate Teams Messages in Microsoft Defender for Office 365New

   Investigate Teams Messages in Microsoft Defender for Office 365 Describes the Teams message entity panel for Microsoft Teams in Microsoft Defender for Office 365, how it does post-breach work like ZAP and Safe Links and gives admins a single pane of glass on Teams chat and channel threats like…

   Listed under April 2026 on Microsoft Learn
3. Preview

   Promotions folder for bulk email (preview)

   Promotions folder for bulk email (preview) : You can configure anti-spam policies to deliver bulk mail below the BCL threshold to the Promotions folder in supported versions of Outlook. For more information, see Deliver bulk mail below the BCL threshold…

   DocsBulk email detectionNew

   Bulk email detection Admins can learn about bulk email detection, including the bulk complain level (BCL) values that are used in Microsoft 365.

   Listed under April 2026 on Microsoft Learn
4. New feature

   New RBAC permission for email content associated with alerts

   New RBAC permission for email content associated with alerts : A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more…

   DocsThe Email entity page in Defender for Office 365Updated

   The Email entity page in Defender for Office 365 Admins can learn about the Email entity page in Microsoft Defender for Office 365. This page shows many details about email messages. For example, email headers, threat detection details, the latest and original delivery locations, delivery actions, and IDs (for…

   Listed under April 2026 on Microsoft Learn

1. New feature

   Expanding User reporting in Teams to include Calls

   Expanding User reporting in Teams to include Calls : Users can reported completed or missed one-to-one Microsoft Teams calls from the call history as malicious (scam) or non malicious (non-scam) to the specified reporting mailbox, or Microsoft and the reporting…

   DocsUser reported settings in TeamsNew·Configure user reported message settings in Microsoft Defender for …New

   User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

   Listed under March 2026 on Microsoft Learn
2. New feature

   Added support for contextual Teams messages in User reported Teams Messages

   Added support for contextual Teams messages in User reported Teams Messages : When Users report Microsoft Teams messages from chats, channels (standard, shared, and private), and meeting conversations to Microsoft as malicious (security risk), up to fifteen messages before and…

   DocsUser reported settings in TeamsNew

   User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

   Listed under March 2026 on Microsoft Learn

1. New feature

   Expanding User reporting in Teams to Defender for Office 365 Plan 1

   Expanding User reporting in Teams to Defender for Office 365 Plan 1 : Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting…

   DocsUser reported settings in TeamsNew·Configure user reported message settings in Microsoft Defender for …New

   User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

   Listed under February 2026 on Microsoft Learn

1. New feature

   Expanding ZAP and Teams Admin quarantine to Plan 1

   Expanding ZAP and Teams Admin quarantine to Plan 1 : Zero-hour-auto-purge (ZAP) and admin management of quarantined Teams messages is available to Microsoft Defender for Plan 1 by default, bringing a post-delivery protection layer.

   DocsManage quarantined messages and files as an adminNew·Zero-hour auto purge in Microsoft Defender for Office 365

   Manage quarantined messages and files as an admin Admins can learn how to view and manage quarantined messages for all users in Microsoft 365 organizations with cloud mailboxes. Admins in organizations with Microsoft Defender for Office 365 can also manage quarantined files in SharePoint, OneDrive, and Microsoft Teams.

   Listed under January 2026 on Microsoft Learn
2. New feature

   Block communication from sender email address and domains in Teams

   Block communication from sender email address and domains in Teams : Admins can directly block malicious domains and email addresses from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains and users…

   DocsBlock domains and addresses in Microsoft Teams using the Tenant …

   Block domains and addresses in Microsoft Teams using the Tenant Allow/Block List Admins can learn how to block domains and addresses in Microsoft Teams using the Tenant Allow/Block List.

   Listed under January 2026 on Microsoft Learn

No changes match.