Microsoft Defender XDR

1. Preview

   Integrated Security Operations Center (ISOC) in Microsoft Defender

   (Preview) Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal. Starting September 23, 2026, it's available to eligible Microsoft 365 E5 and E7 customers without an…

   DocsIntegrated Security Operations Center (ISOC) in Microsoft DefenderNew

   Integrated Security Operations Center (ISOC) in Microsoft Defender Learn how Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI together, including eligibility and workspace requirements.

   Listed under September 2026 on Microsoft Learn Related post
2. GA

   Identity Security dashboard and Coverage & Maturity

   (GA) Identity Security dashboard and Coverage & Maturity : The Identity Security dashboard provides a centralized view of identity-related security risks and posture across the organization. Coverage & Maturity helps security teams understand how well their identity environment is protected…

   DocsView your identity coverage and maturityNew

   View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.

   Listed under September 2026 on Microsoft Learn

1. Preview

   Threat detection for Microsoft Agent 365 agents

   (Preview) Threat detection for Microsoft Agent 365 agents : Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft…

   DocsDetect and investigate threats to AI agents using Microsoft Defender …

   Detect and investigate threats to AI agents using Microsoft Defender (Preview) Learn how to detect, investigate, and hunt for threats to AI agents using Microsoft Defender.

   Listed under July 2026 on Microsoft Learn
2. GA

   Real-time protection for Microsoft Agent 365 tooling servers

   (GA) Real-time protection for Microsoft Agent 365 tooling servers : Microsoft Defender evaluates tool invocations and responses against security policies and can allow or block interactions with Work IQ MCP and customer MCP tools onboarded to Agent 365. For more…

   DocsProtect AI agents in real time using Microsoft DefenderUpdated

   Protect AI agents in real time using Microsoft Defender Learn how to block unsafe AI agent actions in real time and configure real-time protection rules in Microsoft Defender.

   Listed under July 2026 on Microsoft Learn
3. Preview

   AI agent posture risk in Microsoft Defender

   (Preview) AI agent posture risk in Microsoft Defender : Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access…

   DocsAI agent posture risk in Microsoft DefenderNew

   AI agent posture risk in Microsoft Defender Learn how Microsoft Defender assesses AI agent posture risk using risk indicators, risk levels, and security recommendations.

   Listed under July 2026 on Microsoft Learn

1. Preview

   Entity enrichments with threat intelligence

   (Preview) Entity enrichments with threat intelligence : Entity pages for IP addresses, domains, URLs, and files now include a Threat Intelligence Insights tab that surfaces enrichment data from Microsoft Threat Intelligence directly in the investigation workflow. Enrichments include reputation scores…

   DocsView threat intelligence in entity pages in Microsoft Defender

   View threat intelligence in entity pages in Microsoft Defender Learn how to view threat intelligence from Microsoft Threat Intelligence on IP, domain, URL, and file entity pages in the Microsoft Defender portal.

   Listed under June 2026 on Microsoft Learn
2. New feature

   Email & collaboration content: Emails associated with alerts (read)

   The Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration content: Emails associated with alerts (read) permission instead of the broader Email & Collaboration content: All Emails (read) permission. This least-privilege permission restricts…

   DocsMicrosoft Security Copilot Phishing Triage Agent in Microsoft Defender·Microsoft Security Copilot Security Alert Triage Agent in Microsoft …

   Microsoft Security Copilot Phishing Triage Agent in Microsoft Defender Learn how the Security Copilot Phishing Triage Agent in Microsoft Defender uses AI to triage and classify user-reported phishing emails, set up the agent, provide feedback, and monitor its performance.

   Listed under June 2026 on Microsoft Learn
3. Preview

   Coverage and maturity

   (Preview) On the Coverage and maturity page, the Review and improve coverage side panel for SaaS Identities now includes an Observed column and a Show Only Observed Applications toggle. By default, the panel shows only SaaS applications detected in your…

   DocsView your identity coverage and maturityNew

   View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.

   Listed under June 2026 on Microsoft Learn
4. GA

   (Preview) The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is tran

   (Preview) The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft…

   DocsAgentsInfo table in the advanced hunting schemaUpdated·Naming changes in the Microsoft Defender XDR advanced hunting schemaUpdated

   AgentsInfo table in the advanced hunting schema Learn about agent information in the AgentsInfo table of the advanced hunting schema

   Listed under June 2026 on Microsoft Learn
5. Preview

   (Preview) Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience

   (Preview) Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience , runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop…

   DocsSet up AI agent runtime protection with Microsoft Defender for …New·Protect AI assets from emerging threats and vulnerabilities using …

   Set up AI agent runtime protection with Microsoft Defender for Endpoint (Preview) Learn how to configure Microsoft Defender for Endpoint AI agent runtime protection to detect, audit, and block prompt injection on Windows devices.

   Listed under June 2026 on Microsoft Learn
6. Preview

   (Preview) Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience , Micros

   (Preview) Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience , Microsoft Defender now automatically discovers supported local AI agents running on onboarded Windows devices - including coding agents and IDE extensions, desktop AI…

   DocsDiscover local AI agents with Microsoft Defender for EndpointNew·Protect AI assets from emerging threats and vulnerabilities using …

   Discover local AI agents with Microsoft Defender for Endpoint Learn how to discover, view, and investigate local AI agents on Windows and macOS devices by using Microsoft Defender.

   Listed under June 2026 on Microsoft Learn
7. GA

   (GA) The following advanced hunting schema tables are now generally available: The DisruptionAndResponseEvents

   (GA) The following advanced hunting schema tables are now generally available: The DisruptionAndResponseEvents table contains information about automatic attack disruption events in Microsoft Defender XDR. The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by…

   DocsCloudDnsEvents table in the advanced hunting schemaUpdated·DisruptionAndResponseEvents table in the advanced hunting schema·CloudAuditEvents table in the advanced hunting schema·CloudProcessEvents table in the advanced hunting schema

   CloudDnsEvents table in the advanced hunting schema Learn about the CloudDnsEvents table in the advanced hunting schema, which contains information about DNS activity events from cloud infrastructure environments.

   Listed under June 2026 on Microsoft Learn

1. New feature

   The hunting graph in advanced hunting now includes new identity-focused predefined scenarios. These scenarios

   The hunting graph in advanced hunting now includes new identity-focused predefined scenarios. These scenarios help you discover attack paths, privilege escalation routes, and credential access risks across on-premises and cloud environments, including Kerberoast and AS-REP roast paths, domain compromise routes…

   DocsHunting graph in Microsoft Defender advanced huntingUpdated

   Hunting graph in Microsoft Defender advanced hunting Learn how to use the hunting graph in Microsoft Defender XDR advanced hunting to visualize threat scenarios as interactive graphs and trace attack paths.

   Listed under May 2026 on Microsoft Learn
2. New feature

   Take action

   In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results. Learn more .

   DocsTake action on advanced hunting results in Microsoft Defender XDR

   Take action on advanced hunting results in Microsoft Defender XDR Learn how to take response actions on devices, identities, files, and emails directly from advanced hunting query results in Microsoft Defender XDR.

   Listed under May 2026 on Microsoft Learn
3. New feature

   Microsoft Defender Experts for Servers

   Microsoft Defender Experts for Servers and Microsoft Defender Experts Hunting - Servers are now offered as standalone offerings for customers who wish to avail managed extended detection and response and threat hunting services for their on-premises and multicloud servers protected…

   DocsMicrosoft Defender Experts for Servers overview

   Microsoft Defender Experts for Servers overview Learn about Microsoft Defender Experts for Servers, a managed detection and response service for on-premises and multicloud server workloads.

   Listed under May 2026 on Microsoft Learn
4. Preview

   Defender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender. It helps SO

   Defender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender. It helps SOC analysts investigate threats, explore incidents, and answer security questions in plain language, without needing to navigate multiple screens or write complex queries.

   DocsMicrosoft Security Copilot and Chat in Microsoft DefenderUpdated

   Microsoft Security Copilot and Chat in Microsoft Defender Learn about Microsoft Security Copilot capabilities in Microsoft Defender. Use natural language to investigate threats, analyze scripts, and get AI-powered incident summaries.

   Listed under May 2026 on Microsoft Learn
5. Preview

   (Preview) Automatic attack disruption can now isolate compromised devices from the network when high-confidenc

   (Preview) Automatic attack disruption can now isolate compromised devices from the network when high-confidence incident analysis indicates the device is being used as an active foothold. Isolation blocks attacker communication and lateral movement while keeping the device connected to security…

   DocsTake response actions on a device in Microsoft Defender for EndpointUpdated·Automatic attack disruption in Microsoft Defender

   Take response actions on a device in Microsoft Defender for Endpoint Respond to attacks on a device in Microsoft Defender for Endpoint by isolating it, collecting an investigation package, running a scan, or restricting apps.

   Listed under May 2026 on Microsoft Learn

1. New feature

   Defender Experts

   Microsoft Defender Experts MDR customers can now see Defender Experts as a distinct entry in the Microsoft Defender portal navigation menu. This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access…

   DocsHow to use the Microsoft Defender Experts service

   How to use the Microsoft Defender Experts service Learn about the different in-portal experiences in Microsoft Defender where you can view and perform Defender Experts notifications and activities

   Listed under April 2026 on Microsoft Learn
2. Preview

   Activities

   (Preview) You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. Learn more

   DocsDetails and Results of an Automatic Attack Disruption Action

   Details and Results of an Automatic Attack Disruption Action Learn how to review automatic attack disruption results in Microsoft Defender XDR, including the summary card, Activities tab, Action center, and advanced hunting queries.

   Listed under April 2026 on Microsoft Learn
3. Preview

   (Preview) The AIAgentsInfo table in advanced hunting now includes additional columns that provide deeper visib

   (Preview) The AIAgentsInfo table in advanced hunting now includes additional columns that provide deeper visibility into AI agents operating in your Microsoft 365 environment. These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace…

   Listed under April 2026 on Microsoft Learn
4. GA

   (GA) Built-in alert tuning rules are now generally available. Built-in alert tuning rules suppress alerts from

   (GA) Built-in alert tuning rules are now generally available. Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.

   DocsInvestigate alerts in Microsoft Defender XDRUpdated

   Investigate alerts in Microsoft Defender XDR Investigate alerts seen across devices, users, and mailboxes.

   Listed under April 2026 on Microsoft Learn

1. Preview

   Identity security enhancements

   Identity security enhancements : New identity security capabilities help you monitor and manage identity security for human and non-human identities: (Preview) Identity Security dashboard: The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and…

   DocsView your identity coverage and maturityNew·Non-human identities in Microsoft DefenderNew·View the Identity inventoryUpdated·Investigate IdentitiesUpdated

   View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.

   Listed under March 2026 on Microsoft Learn
2. GA

   (Preview) The following advanced hunting schema tables are now available for preview: The CloudDnsEvents table

   (Preview) The following advanced hunting schema tables are now available for preview: The CloudDnsEvents table contains information about DNS activity events from cloud infrastructure environments. The CloudPolicyEnforcementEvents table contains policy enforcement evaluation decisions and metadata of security gating events for…

   DocsCloudDnsEvents table in the advanced hunting schemaUpdated·CloudPolicyEnforcementEvents table in the advanced hunting schema

   CloudDnsEvents table in the advanced hunting schema Learn about the CloudDnsEvents table in the advanced hunting schema, which contains information about DNS activity events from cloud infrastructure environments.

   Listed under March 2026 on Microsoft Learn
3. Preview

   (Preview) Customers can now use filters on very large incidents with many alerts and entities or hide specific

   (Preview) Customers can now use filters on very large incidents with many alerts and entities or hide specific entities to simplify complex incident graphs. By simplifying the graphs, security teams can focus their investigations on what matters most. Learn more

   DocsInvestigate incidents in the Microsoft Defender portal (Legacy)New

   Investigate incidents in the Microsoft Defender portal (Legacy) Investigate incidents on various assets from correlated signals of various Defender services and other Microsoft security products like Microsoft Sentinel.

   Listed under March 2026 on Microsoft Learn

1. New feature

   Microsoft Defender Experts Hunting customers can now set up Notification contacts . These contacts are the ind

   Microsoft Defender Experts Hunting customers can now set up Notification contacts . These contacts are the individuals or groups that Microsoft needs to notify if there are critical incidents or service updates.

   DocsSubscribe to Microsoft Defender Experts Hunting

   Subscribe to Microsoft Defender Experts Hunting If you're new to Microsoft Defender and Defender Experts Hunting, this is how you onboard, receive, and set up Defender Experts Notifications.

   Listed under February 2026 on Microsoft Learn
2. GA

   (GA) The following content types are now generally available for distribution across multiple tenants in the M

   (GA) The following content types are now generally available for distribution across multiple tenants in the Microsoft Defender multitenant portal: analytics rules, automation rules, and workbooks.

   DocsContent distribution using distribution profiles in multitenant …

   Content distribution using distribution profiles in multitenant management Learn about content distribution across tenants in the Microsoft Defender multitenant portal.

   Listed under February 2026 on Microsoft Learn
3. GA

   (GA) The following advanced hunting schema tables are now generally available: The IdentityAccountInfo table c

   (GA) The following advanced hunting schema tables are now generally available: The IdentityAccountInfo table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account. The…

   DocsIdentityAccountInfo table in the advanced hunting schema·EntraIdSignInEvents table in the advanced hunting schema (preview)·EntraIdSpnSignInEvents table in the advanced hunting schema (preview)·GraphAPIAuditEvents table in the advanced hunting schema

   IdentityAccountInfo table in the advanced hunting schema Learn about the IdentityAccountInfo table in the advanced hunting schema, which provides account information from various sources, including Microsoft Entra ID.

   Listed under February 2026 on Microsoft Learn

1. Preview

   (Preview) The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns and

   (Preview) The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns and information about behavior data types and alerts from User and Entity Behavior Analytics (UEBA), providing more insights on the relationships between identified behaviors and entities. Learn…

   DocsBehaviorInfo table in the advanced hunting schema·BehaviorEntities table in the advanced hunting schema·Translate raw security logs to behavioral insights using UEBA …

   BehaviorInfo table in the advanced hunting schema Learn about alert generation events in the BehaviorInfo table of the advanced hunting schema

   Listed under January 2026 on Microsoft Learn
2. Preview

   (Preview) In advanced hunting, if the query result exceeds the 64-MB size limit, the portal now returns the ma

   (Preview) In advanced hunting, if the query result exceeds the 64-MB size limit, the portal now returns the maximum number of records it can within this limit and displays a message indicating that the displayed results are partial due to…

   DocsAdvanced hunting overview in Microsoft Defender XDR

   Advanced hunting overview in Microsoft Defender XDR Learn about advanced hunting queries in Microsoft Defender and how to use them to proactively find threats and weaknesses in your network.

   Listed under January 2026 on Microsoft Learn
3. Preview

   (Preview) Custom detection rules in Microsoft Defender now support Near Real-Time (NRT) configuration on Micro

   (Preview) Custom detection rules in Microsoft Defender now support Near Real-Time (NRT) configuration on Microsoft Sentinel data .

   DocsCreate custom detection rules in Microsoft Defender XDRUpdated

   Create custom detection rules in Microsoft Defender XDR Learn how to create custom detection rules based on advanced hunting queries to proactively monitor events and take automated response actions.

   Listed under January 2026 on Microsoft Learn

1. GA

   Microsoft Defender for Cloud Apps permissions are now integrated with Microsoft Defender unified RBAC

   Integration of Microsoft Defender for Cloud Apps permissions with Microsoft Defender unified RBAC is now available worldwide.

   Listed under December 2025 on Microsoft Learn
2. GA

   (Preview) The following advanced hunting schema tables are now available for preview: The CampaignInfo table c

   (Preview) The following advanced hunting schema tables are now available for preview: The CampaignInfo table contains information about email campaigns identified by Microsoft Defender for Office 365. The FileMaliciousContentInfo table contains information about files that Microsoft Defender for Office 365…

   DocsCampaignInfo table in the advanced hunting schema·FileMaliciousContentInfo table in the advanced hunting schema

   CampaignInfo table in the advanced hunting schema Learn about the CampaignInfo table of the advanced hunting schema

   Listed under December 2025 on Microsoft Learn
3. Preview

   (Preview) Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an

   (Preview) Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an always-on, adaptive backend service that uncovers hidden threats across Defender and Microsoft Sentinel environments. Learn more

   DocsMicrosoft Security Copilot Dynamic Threat Detection Agent

   Microsoft Security Copilot Dynamic Threat Detection Agent Investigate incidents and alerts using the Microsoft Security Copilot Dynamic Threat Detection Agent in the Microsoft Defender portal.

   Listed under December 2025 on Microsoft Learn
4. GA

   (GA) The hunting graph in advanced hunting is now generally available. It also now has two new predefined thre

   (GA) The hunting graph in advanced hunting is now generally available. It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.

   DocsHunting graph in Microsoft Defender advanced huntingUpdated

   Hunting graph in Microsoft Defender advanced hunting Learn how to use the hunting graph in Microsoft Defender XDR advanced hunting to visualize threat scenarios as interactive graphs and trace attack paths.

   Listed under December 2025 on Microsoft Learn
5. GA

   (GA) The Microsoft Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender is now generally

   (GA) The Microsoft Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender is now generally available. It generates threat intelligence briefings based on the latest threat actor activity and both internal and external vulnerability information in a matter of minutes…

   DocsSecurity Copilot Threat Intelligence Briefing Agent in Microsoft …Updated

   Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender Learn what the Security Copilot Threat Intelligence Briefing Agent does in Microsoft Defender, how to set it up, view briefings, and provide feedback.

   Listed under December 2025 on Microsoft Learn
6. GA

   (GA) Microsoft Security Copilot in Microsoft Defender now lets you hunt for threats by using natural language

   (GA) Microsoft Security Copilot in Microsoft Defender now lets you hunt for threats by using natural language with the Threat Hunting Assistant . This agent delivers a complete, conversational threat hunting experience by not only generating queries but also interpreting…

   DocsMicrosoft Security Copilot Threat Hunting Assistant in advanced …

   Microsoft Security Copilot Threat Hunting Assistant in advanced hunting Learn how Microsoft Security Copilot Threat Hunting Assistant can help you investigate threats using natural language.

   Listed under December 2025 on Microsoft Learn
7. GA

   (GA) Advanced hunting now supports custom functions that use tabular parameters. By using tabular parameters,

   (GA) Advanced hunting now supports custom functions that use tabular parameters. By using tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. Learn more

   DocsUse custom functions in advanced hunting

   Use custom functions in advanced hunting Create reusable custom functions in advanced hunting to simplify and share query logic across hunting queries.

   Listed under December 2025 on Microsoft Learn

No changes match.