What's new in Microsoft Security: December 2025

Triage collection

Triage collection. Use triage collection to prioritize incidents and hunt threats with the Sentinel Model Context Protocol (MCP) server.

DocsTriage Tool Collection in Microsoft Sentinel MCP Server

Triage Tool Collection in Microsoft Sentinel MCP Server Explore the Microsoft Sentinel MCP triage tools for incident triage and hunting, including tools to fetch incidents, alerts, entities, and run hunting queries.

Microsoft Defender for Cloud Apps permissions are now integrated with Microsoft Defender unified RBAC

Integration of Microsoft Defender for Cloud Apps permissions with Microsoft Defender unified RBAC is now available worldwide.

(Preview) The following advanced hunting schema tables are now available for preview: The CampaignInfo table c

(Preview) The following advanced hunting schema tables are now available for preview: The CampaignInfo table contains information about email campaigns identified by Microsoft Defender for Office 365. The FileMaliciousContentInfo table contains information about files that Microsoft Defender for Office 365…

DocsCampaignInfo table in the advanced hunting schema·FileMaliciousContentInfo table in the advanced hunting schema

CampaignInfo table in the advanced hunting schema Learn about the CampaignInfo table of the advanced hunting schema

(GA) The hunting graph in advanced hunting is now generally available. It also now has two new predefined thre

(GA) The hunting graph in advanced hunting is now generally available. It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.

DocsHunting graph in Microsoft Defender advanced huntingUpdated

Hunting graph in Microsoft Defender advanced hunting Learn how to use the hunting graph in Microsoft Defender XDR advanced hunting to visualize threat scenarios as interactive graphs and trace attack paths.

(GA) The Microsoft Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender is now generally

(GA) The Microsoft Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender is now generally available. It generates threat intelligence briefings based on the latest threat actor activity and both internal and external vulnerability information in a matter of minutes…

DocsSecurity Copilot Threat Intelligence Briefing Agent in Microsoft …Updated

Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender Learn what the Security Copilot Threat Intelligence Briefing Agent does in Microsoft Defender, how to set it up, view briefings, and provide feedback.

(GA) Microsoft Security Copilot in Microsoft Defender now lets you hunt for threats by using natural language

(GA) Microsoft Security Copilot in Microsoft Defender now lets you hunt for threats by using natural language with the Threat Hunting Assistant . This agent delivers a complete, conversational threat hunting experience by not only generating queries but also interpreting…

DocsMicrosoft Security Copilot Threat Hunting Assistant in advanced …

Microsoft Security Copilot Threat Hunting Assistant in advanced hunting Learn how Microsoft Security Copilot Threat Hunting Assistant can help you investigate threats using natural language.

(GA) Advanced hunting now supports custom functions that use tabular parameters. By using tabular parameters,

(GA) Advanced hunting now supports custom functions that use tabular parameters. By using tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. Learn more

DocsUse custom functions in advanced hunting

Use custom functions in advanced hunting Create reusable custom functions in advanced hunting to simplify and share query logic across hunting queries.

(Preview) Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an

(Preview) Microsoft Security Copilot in Microsoft Defender now includes the Dynamic Threat Detection Agent, an always-on, adaptive backend service that uncovers hidden threats across Defender and Microsoft Sentinel environments. Learn more

DocsMicrosoft Security Copilot Dynamic Threat Detection Agent

Microsoft Security Copilot Dynamic Threat Detection Agent Investigate incidents and alerts using the Microsoft Security Copilot Dynamic Threat Detection Agent in the Microsoft Defender portal.

New Microsoft Secure Score recommendations

New Microsoft Secure Score recommendations. Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Disable Remote Registry service on Windows : Prevents remote access to the Windows registry, reducing attack surface and…

macOS release: Build 101.25102.0019

macOS release: Build 101.25102.0019. Release version 20.125102.19.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Windows release: Windows Defender Antivirus: Platform 4.18.25110.6 / Engine 1.1.25110.1

Windows release: Windows Defender Antivirus: Platform 4.18.25110.6 / Engine 1.1.25110.1. See enhancements and features for this release .

DocsMicrosoft Defender Antivirus updates - Previous versions for technical …

Microsoft Defender Antivirus updates - Previous versions for technical upgrade support Understand the type of technical support offered for previous versions of Microsoft Defender Antivirus

Linux release: Build 101.25092.0005

Linux release: Build 101.25092.0005. Release version 30.125092.0005.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Linux release: Build 101.25092.0002

Linux release: Build 101.25092.0002. Release version 30.125092.0002.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

CVE exceptions

CVE exceptions. CVE exceptions are now generally available, and also support the False positive justification and the status field as part of the response for the GET /api/vulnerabilities request. Learn more .

DocsExceptions in Microsoft Defender Vulnerability Management·Get all vulnerabilities

Exceptions in Microsoft Defender Vulnerability Management Learn how to create, view, and manage exceptions in Microsoft Defender Vulnerability Management to exclude data from remediation efforts and improve risk reporting.

Android release: Build 1.0.8412.0101

Android release: Build 1.0.8412.0101. Build 1.0.8412.0101 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Android release: Build 1.0.8321.0101

Android release: Build 1.0.8321.0101. Build 1.0.8321.0101 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS · December 2025 · Platform: 101.25102.0019

Release details Platform version Release version Engine version Signature version 101.25102.0019 20.125102.19.0 1.1.25090.2000 1.435.600.0 Enhancements and features Feature area Update summary Vulnerability Management CVE-2025-55182 (React2Shell) - Microsoft Defender Vulnerability Management (MDVM) can now surface devices that this vulnerability may affect.

DocsCVE-2025-55182 (React2Shell)

Linux · December 2025 · Platform: 101.25092.0005

Release details Platform version Release version Engine version Signature version 101.25092.0005 30.125092.0005.0 1.1.25090.4000 1.437.18.0 Enhancements and features Feature area Update summary Vulnerability detection Enhanced vulnerability detection for vulnerable React components through deeper component analysis and enhanced telemetry. This includes support…

Docs(CVE-2025-55182)

Linux · December 2025 · Platform: 101.25092.0002

Release details Platform version Release version Engine version Signature version 101.25092.0002 30.125092.0002.0 1.1.25090.4000 1.437.18.0 Enhancements and features Feature area Update summary Critical fix Includes critical fix related to machine identifier ensuring every endpoint is accurately identified as a unique device.

Android · December 2025 · Platform: 1.0.8412.0101

Release details Platform version Release Date 1.0.8412.0101 December 15, 2025 Enhancements and features Feature area Update summary General Performance improvement and bug fixes.

Android · December 2025 · Platform: 1.0.8321.0101

Release details Platform version Release Date 1.0.8321.0101 December 2, 2025 Enhancements and features Feature area Update summary Root detection Native root detection for Microsoft Defender is now GA. General Performance improvement and bug fixes.

ADWS LDAP search in Advanced Hunting

New ADWS LDAP search activity is now available in the 'IdentityQueryEvents' table in Advanced Hunting. This can provides visibility into directory queries performed through ADWS, helping customers track these operations and create custom detection based on this data. Version number…

New properties for 'sensorCandidate' resource type in Graph-API (preview)

Property Type Description domainName String The domain name of the sensor. senseClientVersion String The version of the Defender for Identity sensor client. This capability is currently in preview and available in API preview version. Learn more here

DocssensorCandidate resource type

sensorCandidate resource type Represents a Microsoft Defender for Identity sensor that's ready to be activated.

New Setup Assistant screens now generally available for iOS/iPadOS and macOS automated device enrollment profiles

You can hide or show 12 new Setup Assistant screens during automated device enrollment (ADE). The default is to show these screens in Setup Assistant. The screens you can skip during iOS/iPadOS enrollment, and the applicable versions, include…

DocsSet up automated device enrollment (ADE) for iOS/iPadOSNew·Set up automated device enrollment (ADE) for macOSNew

Set up automated device enrollment (ADE) for iOS/iPadOS Learn how to enroll corporate-owned iOS/iPadOS devices into Microsoft Intune with Apple Automated Device Enrollment (ADE).

ACME protocol support for iOS/iPadOS and macOS enrollment

As we prepare to support managed device attestation in Intune, we are starting a phased rollout of an infrastructure change for new enrollments that includes support for the Automated Certificate Management Environment (ACME) protocol . Now when new…

Secure enterprise browser managed by Intune (public preview)

Microsoft Intune now supports policy management for Microsoft Edge for Business as a secure enterprise browser. By implementing policies through Intune, admins can confidently transition from Windows-based desktop environments to secure, browser-based workflows for accessing corporate resources without…

DocsSecure Your Corporate Data in Intune with Microsoft Edge for Business

Secure Your Corporate Data in Intune with Microsoft Edge for Business Secure your corporate data in Microsoft Intune with Microsoft Edge for Business across all platforms.

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.96) which incorporates the latest Securi

Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.80) which incorporates the latest Securi

Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.80) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE‑2025‑14174 has an exploit in the wild, and this update contains a fix for it…

DocsCVE‑2025‑14174·Security Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.66) which incorporates the latest Securi (1 CVE)

Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.66) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security fixes: CVE-2025-62223

DocsSecurity Update Guide·CVE-2025-62223

Microsoft Defender for Cloud Apps permissions are now integrated with Microsoft Defender unified RBAC

Integration of Microsoft Defender for Cloud Apps permissions with Microsoft Defender unified RBAC is now available worldwide. For more information, see Map Microsoft Defender for Cloud Apps permissions to the Microsoft Defender unified RBAC permissions . To activate the Defender…

DocsMap Microsoft Defender unified role-based access control (RBAC) …Updated·What's new in Microsoft Defender unified role-based access control …·Activate Microsoft Defender unified role-based access control (URBAC)

Map Microsoft Defender unified role-based access control (RBAC) permissions Compare permissions and access to Microsoft Defender XDR Security portal experiences using role-based access control (RBAC)

Increased availability of App governance unused app insights feature (Preview)

The Microsoft Defender for Cloud Apps app governance unused app insights feature helps administrators identify and manage unused Microsoft 365-connected OAuth apps, enforce policy-based governance, and use advanced hunting queries for better security. This feature is now available for most…

DocsSecure OAuth apps with app governance hygiene features

Secure OAuth apps with app governance hygiene features Use app governance hygiene features to identify unused apps, manage unused credentials, and review expiring credentials in Microsoft Defender.