https://securitynews.ms/products/microsoft-defender-xdr/Microsoft Defender XDR news and documented product changes, each linked to Microsoft's own source.enThu, 29 Oct 2026 16:00:00 +0000https://techcommunity.microsoft.com/t5/microsoft-defender-blog/defending-linux-in-the-age-of-ai-operated-attacks/ba-p/4557210https://techcommunity.microsoft.com/t5/microsoft-defender-blog/defending-linux-in-the-age-of-ai-operated-attacks/ba-p/4557210Thu, 29 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogLinux supports cloud services, containers, developer environments, business-critical applications, and a growing share of AI infrastructure. That makes Linux both essential to modern enterprises and increasingly attractive to attackers. AI is compressing the time required to research targets, vary payloads, and adapt…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/now-generally-available-discover-local-ai-agents-with-microsoft/ba-p/4568216https://techcommunity.microsoft.com/t5/microsoft-defender-blog/now-generally-available-discover-local-ai-agents-with-microsoft/ba-p/4568216Thu, 29 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogAs local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough. Unlike static software, local agents such as coding assistants, command-line agents, desktop applications, and agentic development environments can operate on endpoints with access to a…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/part-4-see-investigate-and-measure-email-and-collaboration/ba-p/4562274https://techcommunity.microsoft.com/t5/microsoft-defender-blog/part-4-see-investigate-and-measure-email-and-collaboration/ba-p/4562274Tue, 27 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogAttacks rarely stay in one channel. A flood of spam email, a Teams chat from an unfamiliar organization, and a call from "the helpdesk" can all be part of the same attempt. Security teams need a unified way to see where attacks…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/proofpoint-s-core-email-protection-api-solution-joins-the/ba-p/4567264https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/proofpoint-s-core-email-protection-api-solution-joins-the/ba-p/4567264Mon, 26 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogEmail remains the most exploited gateway for cyberattacks, as the threat landscape continues to get more sophisticated with attackers using AI to scale phishing, malware, and business email compromise. Microsoft Defender is a leading email security solution , helping organizations stay ahead…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/integrated-security-operations-center-in-microsoft-defender/ba-p/4559097https://techcommunity.microsoft.com/t5/microsoft-defender-blog/integrated-security-operations-center-in-microsoft-defender/ba-p/4559097Wed, 23 Sep 2026 16:00:00 +0000Microsoft Defender XDR BlogAI is transforming the attacker’s operating model, accelerating threats to unprecedented speed and scale. Yet many security operations centers still depend on fragmented data, tools, intelligence, and workflows. Analysts spend valuable time rebuilding context and coordinating action across systems, while the economics…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/reimagining-case-management-in-microsoft-defender/ba-p/4558044https://techcommunity.microsoft.com/t5/microsoft-defender-blog/reimagining-case-management-in-microsoft-defender/ba-p/4558044Wed, 23 Sep 2026 15:35:09 +0000Microsoft Defender XDR BlogSecurity work extends beyond the signal Identifying a threat, exposure, or data risk is only the start. Security teams still need to assign ownership, bring together the right context, coordinate investigation and response, document decisions, track actions, and maintain accountability through resolution…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/stop-identity-attacks-before-they-start-with-microsoft-ispm/ba-p/4549692https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/stop-identity-attacks-before-they-start-with-microsoft-ispm/ba-p/4549692Tue, 01 Sep 2026 16:00:00 +0000Microsoft Defender XDR BlogMany major breaches involve compromised identities, excessive privileges, or misconfigured access. Long before ransomware detonates or data leaves the building, adversaries are quietly abusing valid accounts, excessive privileges or other misconfigurations to move deeper into the environment. Identity has become…https://learn.microsoft.com/en-us/defender-xdr/whats-new#september-2026--integrated-security-operations-center-isoc-in-microsoft-defehttps://learn.microsoft.com/en-us/defender-xdr/whats-new#september-2026--integrated-security-operations-center-isoc-in-microsoft-defeTue, 01 Sep 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal. Starting September 23, 2026, it's available to eligible Microsoft 365 E5 and E7 customers without an…https://learn.microsoft.com/en-us/defender-xdr/whats-new#september-2026--identity-security-dashboard-and-coverage-maturityhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#september-2026--identity-security-dashboard-and-coverage-maturityTue, 01 Sep 2026 00:00:00 +0000Defender XDR · Microsoft Learn(GA) Identity Security dashboard and Coverage & Maturity : The Identity Security dashboard provides a centralized view of identity-related security risks and posture across the organization. Coverage & Maturity helps security teams understand how well their identity environment is protected…https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-is-converging-into-microsoft-sentinel-and-defender-xdr/4427991https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-is-converging-into-microsoft-sentinel-and-defender-xdr/4427991Tue, 11 Aug 2026 13:45:43 +0000Microsoft Defender XDR BlogIn today’s rapidly evolving threat landscape, organizations need threat intelligence (TI) that is woven seamlessly into every step of their security...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-automatic-file-and-url-detonation-analysis/4000489https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-automatic-file-and-url-detonation-analysis/4000489Tue, 11 Aug 2026 13:45:12 +0000Microsoft Defender XDR BlogWe are excited to announce the new file and URL intelligence (detonation) enhancement made in our Threat Intelligence blade within the Defender XDR user...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/what%e2%80%99s-new-mdti-interoperability-with-microsoft-365-defender/3799846https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/what%e2%80%99s-new-mdti-interoperability-with-microsoft-365-defender/3799846Tue, 11 Aug 2026 13:44:56 +0000Microsoft Defender XDR BlogMicrosoft Defender Threat Intelligence (MDTI) helps streamline security analyst triage, incident response, threat hunting, and vulnerability management...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-apis-in-microsoft-graph/3780350https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-apis-in-microsoft-graph/3780350Tue, 11 Aug 2026 13:44:53 +0000Microsoft Defender XDR BlogUnified APIs part of the Microsoft Graph with a single endpoint, permissions, auth model, and access token are now available. We’re happy to share that...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-intel-profiles-deliver-crucial-information-context-about-threats/3780076https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-intel-profiles-deliver-crucial-information-context-about-threats/3780076Tue, 11 Aug 2026 13:44:50 +0000Microsoft Defender XDR BlogMicrosoft is thrilled to introduce Intel Profiles within Microsoft Defender Threat Intelligence. This feature offers a single, reliable source of...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-at-microsoft-secure/3773576https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-at-microsoft-secure/3773576Tue, 11 Aug 2026 13:44:47 +0000Microsoft Defender XDR BlogToday, we are excited to announce several new features and capabilities that put more threat actor insights at our customers' fingertips and enhance SIEM...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/using-reputation-and-analyst-insights-features-for-quick-indicator-assessments/3658007https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/using-reputation-and-analyst-insights-features-for-quick-indicator-assessments/3658007Tue, 11 Aug 2026 13:44:32 +0000Microsoft Defender XDR BlogUnderstanding if a host, domain, or IP address is good, bad, or otherwise, can be difficult during your security incident triage process. Microsoft Defender...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/get-to-know-the-datasets-and-how-to-use-them-during-investigations/3658182https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/get-to-know-the-datasets-and-how-to-use-them-during-investigations/3658182Tue, 11 Aug 2026 13:44:26 +0000Microsoft Defender XDR BlogThe internet can be confusing sometimes. Understanding its datasets doesn't have to be. Come learn how Microsoft Defender Threat Intelligence's datasets can...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/exploring-target-user-functions-and-use-cases/3657289https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/exploring-target-user-functions-and-use-cases/3657289Tue, 11 Aug 2026 13:44:24 +0000Microsoft Defender XDR BlogMicrosoft Defender Threat Intelligence seems like an awesome product, but what are its use cases and who should use it? Check out this blog to learn more.https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-standalone-portal-retirement-and-transition-to-defender-xdr/4077806https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-standalone-portal-retirement-and-transition-to-defender-xdr/4077806Tue, 11 Aug 2026 13:30:42 +0000Microsoft Defender XDR BlogOn June 30th, 2024, the Microsoft Defender Threat Intelligence (MDTI) standalone portal will reach end-of-life and the Microsoft Defender XDR portal will...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-mdti-free-experience-for-microsoft-defender-xdr/3976635https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-mdti-free-experience-for-microsoft-defender-xdr/3976635Tue, 11 Aug 2026 13:30:30 +0000Microsoft Defender XDR BlogNow available in all Microsoft Defender XDR tenants. With the new Microsoft Defender Threat Intelligence (MDTI) free experience, security professionals of...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-hash-and-url-search-intelligence/3781430https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-hash-and-url-search-intelligence/3781430Tue, 11 Aug 2026 13:30:17 +0000Microsoft Defender XDR BlogMicrosoft Defender Threat Intelligence (Defender TI) now includes File Hash and URL Search capabilities, enabling researchers, analysts, hunters, and...https://techcommunity.microsoft.com/t5/microsoft-defender-blog/monthly-news-august-2026/ba-p/4544388https://techcommunity.microsoft.com/t5/microsoft-defender-blog/monthly-news-august-2026/ba-p/4544388Wed, 05 Aug 2026 22:15:47 +0000Microsoft Defender XDR BlogMicrosoft Defender Monthly news - August 2026 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the…https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/become-a-microsoft-defender-ninja/1789376https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/become-a-microsoft-defender-ninja/1789376Wed, 05 Aug 2026 13:23:57 +0000Microsoft Defender XDR BlogBecome a Microsoft Defender XDR Ninjahttps://techcommunity.microsoft.com/t5/microsoft-defender-blog/detecting-cve-2026-54121-certighost-with-microsoft-defender/ba-p/4542861https://techcommunity.microsoft.com/t5/microsoft-defender-blog/detecting-cve-2026-54121-certighost-with-microsoft-defender/ba-p/4542861Fri, 31 Jul 2026 17:41:07 +0000Microsoft Defender XDR BlogWhat is CVE-2026-54121? CVE-2026-54121 is an authentication-bypass vulnerability in Active Directory Certificate Services that allows an attacker to obtain certificates for arbitrary domain computer accounts, including Domain Controllers. A valid Domain Controller certificate enables escalation to full domain…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/mdti-convergence-in-microsoft-sentinel-and-defender-xdr-is/ba-p/4541279https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/mdti-convergence-in-microsoft-sentinel-and-defender-xdr-is/ba-p/4541279Wed, 29 Jul 2026 16:00:00 +0000Microsoft Defender XDR BlogBeginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal, giving customers real-time Microsoft threat intelligence across detection, investigation, response, hunting, and automation at no additional cost. Announced last year,…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/new-privileged-token-context-telemetry-boosts-advanced-hunting/ba-p/4528613https://techcommunity.microsoft.com/t5/microsoft-defender-blog/new-privileged-token-context-telemetry-boosts-advanced-hunting/ba-p/4528613Wed, 15 Jul 2026 16:00:00 +0000Microsoft Defender XDR BlogIn brief: Defenders can now easily identify logons involving high-privilege identities or special logon flags to better hunt threats and fine-tune detections. When a user logs on, Windows’ Local Security Authority (LSA) constructs an access token that represents the user’s security context…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/microsoft-defender-now-integrates-with-dragos-forescout-armis/ba-p/4534936https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/microsoft-defender-now-integrates-with-dragos-forescout-armis/ba-p/4534936Tue, 14 Jul 2026 13:46:58 +0000Microsoft Defender XDR BlogCo-author(s): Amit Cohen and Hadar Shindler Operational technology (OT) environments are unlike anything else in cybersecurity. The systems that run our factories, power grids, water treatment plants, pipelines, and transportation networks weren’t built with modern threats in mind — and they can’t…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/monthly-news-july-2026/ba-p/4532402https://techcommunity.microsoft.com/t5/microsoft-defender-blog/monthly-news-july-2026/ba-p/4532402Wed, 01 Jul 2026 09:30:09 +0000Microsoft Defender XDR BlogMicrosoft Defender Monthly news - July 2026 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the…https://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--threat-detection-for-microsoft-agent-365-agentshttps://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--threat-detection-for-microsoft-agent-365-agentsWed, 01 Jul 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) Threat detection for Microsoft Agent 365 agents : Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft…https://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--real-time-protection-for-microsoft-agent-365-tooling-servershttps://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--real-time-protection-for-microsoft-agent-365-tooling-serversWed, 01 Jul 2026 00:00:00 +0000Defender XDR · Microsoft Learn(GA) Real-time protection for Microsoft Agent 365 tooling servers : Microsoft Defender evaluates tool invocations and responses against security policies and can allow or block interactions with Work IQ MCP and customer MCP tools onboarded to Agent 365. For more…https://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--ai-agent-posture-risk-in-microsoft-defenderhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--ai-agent-posture-risk-in-microsoft-defenderWed, 01 Jul 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) AI agent posture risk in Microsoft Defender : Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/the-next-frontier-in-endpoint-security-securing-local-ai-agents/ba-p/4524651https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/the-next-frontier-in-endpoint-security-securing-local-ai-agents/ba-p/4524651Tue, 30 Jun 2026 03:19:36 +0000Microsoft Defender XDR BlogAI agents are now doing real work on the endpoint — reading files, running commands, browsing the web, and acting on behalf of the users they run under. That same power is also what makes them dangerous: agents act on whatever content…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/securing-the-invisible-workforce/ba-p/4528611https://techcommunity.microsoft.com/t5/microsoft-defender-blog/securing-the-invisible-workforce/ba-p/4528611Wed, 17 Jun 2026 12:35:52 +0000Microsoft Defender XDR BlogNon-human identities are now the majority of the identity estate in most enterprises. Service principals access organizational resources across SharePoint, Azure, and Microsoft 365, Service accounts run critical business processes on-premises, OAuth apps move data across SaaS boundaries, and AI agents increasingly…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--entity-enrichments-with-threat-intelligencehttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--entity-enrichments-with-threat-intelligenceMon, 01 Jun 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) Entity enrichments with threat intelligence : Entity pages for IP addresses, domains, URLs, and files now include a Threat Intelligence Insights tab that surfaces enrichment data from Microsoft Threat Intelligence directly in the investigation workflow. Enrichments include reputation scores…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--email-collaboration-content-emails-associated-with-alerts-rehttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--email-collaboration-content-emails-associated-with-alerts-reMon, 01 Jun 2026 00:00:00 +0000Defender XDR · Microsoft LearnThe Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration content: Emails associated with alerts (read) permission instead of the broader Email & Collaboration content: All Emails (read) permission. This least-privilege permission restricts…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--coverage-and-maturityhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--coverage-and-maturityMon, 01 Jun 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) On the Coverage and maturity page, the Review and improve coverage side panel for SaaS Identities now includes an Observed column and a Show Only Observed Applications toggle. By default, the panel shows only SaaS applications detected in your…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--preview-the-agentsinfo-table-in-advanced-hunting-is-now-avaihttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--preview-the-agentsinfo-table-in-advanced-hunting-is-now-avaiMon, 01 Jun 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--preview-local-ai-agent-runtime-protection-on-windows-endpoinhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--preview-local-ai-agent-runtime-protection-on-windows-endpoinMon, 01 Jun 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience , runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--preview-local-ai-agent-discovery-on-windows-endpoints-as-parhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--preview-local-ai-agent-discovery-on-windows-endpoints-as-parMon, 01 Jun 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience , Microsoft Defender now automatically discovers supported local AI agents running on onboarded Windows devices - including coding agents and IDE extensions, desktop AI…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--ga-the-following-advanced-hunting-schema-tables-are-now-genehttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--ga-the-following-advanced-hunting-schema-tables-are-now-geneMon, 01 Jun 2026 00:00:00 +0000Defender XDR · Microsoft Learn(GA) The following advanced hunting schema tables are now generally available: The DisruptionAndResponseEvents table contains information about automatic attack disruption events in Microsoft Defender XDR. The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/organize-your-multitenant-view-with-tenant-groups-in-microsoft/ba-p/4522992https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/organize-your-multitenant-view-with-tenant-groups-in-microsoft/ba-p/4522992Wed, 27 May 2026 16:00:00 +0000Microsoft Defender XDR BlogManaging security across many tenants shouldn’t mean drowning in a single, flat list. We’re excited to share a new capability, now in public preview in the Microsoft Defender multitenant (MTO) porta l : Tenant Groups —a flexible way to organize the tenants…https://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--the-hunting-graph-in-advanced-hunting-now-includes-new-identhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--the-hunting-graph-in-advanced-hunting-now-includes-new-identFri, 01 May 2026 00:00:00 +0000Defender XDR · Microsoft LearnThe hunting graph in advanced hunting now includes new identity-focused predefined scenarios. These scenarios help you discover attack paths, privilege escalation routes, and credential access risks across on-premises and cloud environments, including Kerberoast and AS-REP roast paths, domain compromise routes…https://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--take-actionhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--take-actionFri, 01 May 2026 00:00:00 +0000Defender XDR · Microsoft LearnIn advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results. Learn more .https://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--microsoft-defender-experts-for-servershttps://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--microsoft-defender-experts-for-serversFri, 01 May 2026 00:00:00 +0000Defender XDR · Microsoft LearnMicrosoft Defender Experts for Servers and Microsoft Defender Experts Hunting - Servers are now offered as standalone offerings for customers who wish to avail managed extended detection and response and threat hunting services for their on-premises and multicloud servers protected…https://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--defender-chat-experience-preview-is-an-open-prompt-chat-assihttps://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--defender-chat-experience-preview-is-an-open-prompt-chat-assiFri, 01 May 2026 00:00:00 +0000Defender XDR · Microsoft LearnDefender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender. It helps SOC analysts investigate threats, explore incidents, and answer security questions in plain language, without needing to navigate multiple screens or write complex queries.https://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--preview-automatic-attack-disruption-can-now-isolate-compromihttps://learn.microsoft.com/en-us/defender-xdr/whats-new#may-2026--preview-automatic-attack-disruption-can-now-isolate-compromiFri, 01 May 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) Automatic attack disruption can now isolate compromised devices from the network when high-confidence incident analysis indicates the device is being used as an active foothold. Isolation blocks attacker communication and lateral movement while keeping the device connected to security…https://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--defender-expertshttps://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--defender-expertsWed, 01 Apr 2026 00:00:00 +0000Defender XDR · Microsoft LearnMicrosoft Defender Experts MDR customers can now see Defender Experts as a distinct entry in the Microsoft Defender portal navigation menu. This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access…https://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--activitieshttps://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--activitiesWed, 01 Apr 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. Learn morehttps://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--preview-the-aiagentsinfo-table-in-advanced-hunting-now-incluhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--preview-the-aiagentsinfo-table-in-advanced-hunting-now-incluWed, 01 Apr 2026 00:00:00 +0000Defender XDR · Microsoft Learn(Preview) The AIAgentsInfo table in advanced hunting now includes additional columns that provide deeper visibility into AI agents operating in your Microsoft 365 environment. These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace…https://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--ga-built-in-alert-tuning-rules-are-now-generally-available-bhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#april-2026--ga-built-in-alert-tuning-rules-are-now-generally-available-bWed, 01 Apr 2026 00:00:00 +0000Defender XDR · Microsoft Learn(GA) Built-in alert tuning rules are now generally available. Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.