What's new in Microsoft Security: January 2026

New detections for Sentinel solution for SAP BTP

This update expands detection coverage for SAP BTP , strengthening visibility into high‑risk control plane, integration, and identity activities. SAP Integration Suite : Detects unauthorized changes to integration artifacts, access policies, JDBC data sources, and package imports that could enable…

DocsMicrosoft Sentinel Solution for SAP BTP - security content referenceNew

Microsoft Sentinel Solution for SAP BTP - security content reference Learn about the built-in security content provided by the Microsoft Sentinel Solution for SAP BTP.

UEBA behaviors layer aggregates actionable insights from raw logs in near-real time (Preview)

Microsoft Sentinel introduces a UEBA behaviors layer that transforms high-volume, low-level security logs into clear, human-readable behavioral insights in the Defender portal. This AI-powered capability aggregates and sequences raw events from supported data sources into normalized behaviors that explain "who…

DocsTranslate raw security logs to behavioral insights using UEBA …

Translate raw security logs to behavioral insights using UEBA behaviors in Microsoft Sentinel The Microsoft Sentinel UEBA behaviors layer translates security telemetry into normalized behavioral patterns for investigation, hunting, and detection engineering.

New Entity Behavior Analytics (UEBA) widget in the Defender portal home page (Preview)

The Defender portal home page now includes a UEBA widget where analysts can immediately have visibility into anomalous user behavior and therefore accelerate threat detection workflows. For more information, see How UEBA empowers analysts and streamlines workflows .

DocsAdvanced threat detection with User and Entity Behavior Analytics …

Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel Create behavioral baselines for entities (users, hostnames, IP addresses) and use them to detect anomalous behavior and identify zero-day advanced persistent threats (APT).

Enable UEBA directly from data connector configuration (Preview)

You can now enable UEBA for supported data sources directly from the data connector configuration page, reducing management time and preventing coverage gaps. When you enable new connectors, you can onboard the data source to UEBA without navigating to a…

DocsConnect Data Sources to Microsoft Sentinel by using Data Connectors

Connect Data Sources to Microsoft Sentinel by using Data Connectors Learn how to connect data sources to Microsoft Sentinel using data connectors for improved threat detection.

Updated date: Microsoft Sentinel in the Azure portal to be retired March 2027

Microsoft Sentinel is generally available in the Microsoft Defender portal , including for customers without Microsoft Defender XDR or an E5 license. This means that you can use Microsoft Sentinel in the Defender portal even if you aren't using other…

DocsIntegrated Security Operations Center (ISOC) in Microsoft DefenderNew·Microsoft Sentinel in the Microsoft Defender portalUpdated·Transition Your Microsoft Sentinel Environment to the Defender PortalUpdated·Post Planning your move to Microsoft Defender portal for all Microsoft …

Integrated Security Operations Center (ISOC) in Microsoft Defender Learn how Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI together, including eligibility and workspace requirements.

(Preview) The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns and

(Preview) The BehaviorInfo and BehaviorEntities tables in advanced hunting now include additional columns and information about behavior data types and alerts from User and Entity Behavior Analytics (UEBA), providing more insights on the relationships between identified behaviors and entities. Learn…

DocsBehaviorInfo table in the advanced hunting schema·BehaviorEntities table in the advanced hunting schema·Translate raw security logs to behavioral insights using UEBA …

BehaviorInfo table in the advanced hunting schema Learn about alert generation events in the BehaviorInfo table of the advanced hunting schema

(Preview) In advanced hunting, if the query result exceeds the 64-MB size limit, the portal now returns the ma

(Preview) In advanced hunting, if the query result exceeds the 64-MB size limit, the portal now returns the maximum number of records it can within this limit and displays a message indicating that the displayed results are partial due to…

DocsAdvanced hunting overview in Microsoft Defender XDR

Advanced hunting overview in Microsoft Defender XDR Learn about advanced hunting queries in Microsoft Defender and how to use them to proactively find threats and weaknesses in your network.

(Preview) Custom detection rules in Microsoft Defender now support Near Real-Time (NRT) configuration on Micro

(Preview) Custom detection rules in Microsoft Defender now support Near Real-Time (NRT) configuration on Microsoft Sentinel data .

DocsCreate custom detection rules in Microsoft Defender XDRUpdated

Create custom detection rules in Microsoft Defender XDR Learn how to create custom detection rules based on advanced hunting queries to proactively monitor events and take automated response actions.

New predefined classifications

The following predefined Device classification rule was added to the critical assets list: Classification Description WSUS Server Centralized Windows update management service used to approve and distribute Microsoft software updates and security patches to Windows devices across an organization. Compromise…

DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

Cloud software inventory in vulnerability management (Preview)

Cloud software inventory is available in preview in vulnerability management in the Microsoft Defender portal. This feature shows software in your cloud environment, application versions, assets where each software is installed, and related vulnerabilities. The software inventory helps you understand…

DocsMicrosoft Defender Vulnerability Management integration with Exposure …Updated

Microsoft Defender Vulnerability Management integration with Exposure Management Learn about the integration of Microsoft Defender Vulnerability Management into Microsoft Security Exposure Management.

Device vulnerabilities report enhancements

Device vulnerabilities report enhancements. To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes several changes and enhancements ( learn more ). Note : These changes are not yet visible to government cloud customers.

DocsVulnerable devices report

Vulnerable devices report A report showing vulnerable device trends and current statistics so you can understand the breath and scope of your device exposure.

macOS release: Build 101.25122.0007

macOS release: Build 101.25122.0007. Release version 20.125122.7.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.25122.0006

macOS release: Build 101.25122.0006. Release version 20.125122.6.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Linux release: Build 101.25102.0005

Linux release: Build 101.25102.0005. Release version 30.125102.0005.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS · January 2026 · Platform: 101.25122.0007

Release details Platform version Release version Engine version Signature version 101.25122.0007 20.125122.7.0 1.1.25100.4000 1.439.74.0 Enhancements and features Bug and performance fixes

macOS · January 2026 · Platform: 101.25122.0006

Release details Platform version Release version Engine version Signature version 101.25122.0006 20.125122.6.0 1.1.25100.4000 1.439.74.0 Enhancements and features Feature area Update summary General Bug and performance fixes.

Linux · January 2026 · Platform: 101.25102.0005

Release details Platform version Release version Engine version Signature version 101.25102.0005 30.125102.0005.0 1.1.25090.6000 1.439.338.0 Enhancements and features Feature area Update summary Vulnerability detection Enhanced vulnerability detection for React components through improved telemetry. This feature includes support for identifying (CVE-2025-55182) …

Docs(CVE-2025-55182)

Identity inventory enhancements are now generally available

Accounts tab in Identity Inventory : The new **Accounts*- tab provides a consolidated view of all accounts associated with an identity, including accounts from Active Directory, Microsoft Entra ID, and supported non-Microsoft identity providers. For more information, see Manage related…

DocsRemediation Actions for Compromised Users in Microsoft Defender for …Updated·Manage related identities and accounts in Microsoft Defender for …·IdentityAccountInfo table in the advanced hunting schema

Remediation Actions for Compromised Users in Microsoft Defender for Identity Learn how to respond to compromised users with remediation actions in Microsoft Defender for Identity

Sensor updates

Version number Updates 2.254 The sensor now supports a new DNS zone target for *.atp.gcc.azure.com. Make sure your sensors in GCC can access this zone with your sensor DNS prefix.

New security posture assessment: Locate accounts in built-in Operator Groups

This identity security posture assessment lists Active Directory accounts that are members of built-in Operator Groups, including direct and indirect membership. You can use this assessment to review legacy or unnecessary operator access and take action when elevated access isn't…

DocsAccounts security posture assessment

Accounts security posture assessment Lists all Microsoft Defender for Identity security posture assessments for Active Directory accounts, with detailed impacts and remediation steps to help improve your Secure Score.

New security posture assessment: Identify service accounts in privileged groups

This identity security posture assessment lists Active Directory service accounts with direct or nested membership in privileged groups. You can use this assessment to identify service accounts with elevated permissions and take action when privileged access isn't required. For more…

DocsAccounts security posture assessment

Accounts security posture assessment Lists all Microsoft Defender for Identity security posture assessments for Active Directory accounts, with detailed impacts and remediation steps to help improve your Secure Score.

New Health Alert: Sensor v3.x RPC Audit Misconfigured

Enhanced RPC auditing is required for some Microsoft Defender for Identity advanced identity detections. A new health alert helps identify v3.x sensors where this configuration is either missing or incorrectly applied. The alert is being rolled out gradually to customers…

DocsDeploy the Microsoft Defender for Identity sensor v3.xNew

Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.

New Entra ID user roles to support remediation actions

For some remediation actions , Defender for Identity creates an enterprise application in Microsoft Entra ID. The Microsoft Defender for Identity enterprise application is created automatically in the tenant and is used only to execute remediation actions. When a user…

DocsRemediation Actions for Compromised Users in Microsoft Defender for …Updated

Remediation Actions for Compromised Users in Microsoft Defender for Identity Learn how to respond to compromised users with remediation actions in Microsoft Defender for Identity

New Defender for Identity security alerts

These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Suspicious sign-in observed from Entra ID sync application to an uncommon resource app Suspicious sign-in observed to Entra ID sync application…

DocsMicrosoft Defender for Identity XDR security alertsUpdated

Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.

Automatic Windows event auditing configuration for Defender for Identity sensors v3.x

We're gradually rolling out automatic Windows event-auditing configuration for sensors v3.x, along with related health alerts. Automatic Windows event-auditing streamlines deployment by automatically applying the required auditing settings to new sensors and correcting misconfigurations on existing ones. This update might…

DocsConfigure Windows event auditingNew

Configure Windows event auditing Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.

New security posture assessments

Remove stale Active Directory accounts (Preview) lists any user accounts in Active Directory that are stale, meaning they haven't logged in at all during the past 90 days. Microsoft Entra ID privileged user accounts that are also privileged in Active…

DocsAccounts security posture assessment

Accounts security posture assessment Lists all Microsoft Defender for Identity security posture assessments for Active Directory accounts, with detailed impacts and remediation steps to help improve your Secure Score.

General Availability - Session Control Conditional Access Policies in Entra External ID

Type: New feature Service category: Conditional Access Product capability: B2B/B2C EEID admins can configure persistent browser session and sign‑in frequency in Conditional Access. For more information, see Conditional Access: Manage Session Controls Effectively .

DocsConditional Access: Manage Session Controls Effectively

Conditional Access: Manage Session Controls Effectively Learn how session controls in Microsoft Entra Conditional Access policies enable secure, limited experiences for cloud apps based on device compliance.

General Availability - Service Principal creation audit logs for alerting & monitoring

Type: New feature Service category: Audit Product capability: Monitoring & Reporting New audit log properties now make it easy for admins to understand why a service principal was created and who or what triggered it. The logs now surface the…

DocsUnderstand why a service principal was created in your tenant·How to analyze the Microsoft Entra provisioning logs

Understand why a service principal was created in your tenant Learn why a Microsoft Entra service principal was created in your tenant and who or what triggered the event through new properties that have been added audit log activity.

General Availability - Microsoft Entra ID Governance guest billing meter enforcement

Type: New feature Service category: Entitlement Management, Lifecycle Workflows Product capability: Entitlement Management, Lifecycle Workflows Enforcement for the Microsoft Entra ID Governance guest billing meter is now in effect for Entitlement Management and Lifecycle Workflows (Access Reviews will be enforced…

DocsMicrosoft Entra ID Governance licensing for guest usersNew

Microsoft Entra ID Governance licensing for guest users Learn how Microsoft Entra ID is licensed for guest users.

General Availability - Improved enforcement for All resources policies with resource exclusions

Type: Changed feature Service category: Conditional Access Product capability: Access Control Microsoft Entra Conditional Access is strengthening how policies that target All resources with resource exclusions are enforced in a narrow set of authentication flows. After this change, in user…

DocsScopes and permissions in the Microsoft identity platformUpdated·Targeting Resources in Conditional Access Policies

Scopes and permissions in the Microsoft identity platform Learn about openID connect scopes and permissions in the Microsoft identity platform endpoint.

General Availability - Entra Private Access for Domain Controllers

Type: New feature Service category: Private Access Product capability: Network Access Bring MFA to on‑premises applications when accessed from on‑premises, i.e., local‑to‑local access, while safeguarding domain controllers against identity threats. Enable secure access to private apps that use domain controllers…

DocsConfigure Microsoft Entra Private Access for Active Directory Domain …

Configure Microsoft Entra Private Access for Active Directory Domain Controllers - Global Secure Access Enforce Conditional Access and multifactor authentication for Kerberos authentication to Active Directory Domain Controllers through Microsoft Entra Private Access.

General Availability - Client Credentials in Microsoft Entra External ID

Type: New feature Service category: B2C - Consumer Identity Management Product capability: B2B/B2C We are pleased to announce the general availability of client credentials in Entra External ID. The OAuth 2.0 client credentials grant flow permits a web service (confidential…

DocsM2M Premium add‑on·OAuth 2.0 client credentials flow on the Microsoft identity platform

OAuth 2.0 client credentials flow on the Microsoft identity platform Build web applications by using the Microsoft identity platform implementation of the OAuth 2.0 authentication protocol.

General Availability - App-based branding via Branding themes in Entra External ID

Type: New feature Service category: B2C - Consumer Identity Management Product capability: B2B/B2C In Entra External ID (EEID), customers can create a single, tenant-wide, customized branding experience that applies to all apps. We're introducing a concept of Branding "themes" to…

DocsCustomize the sign-in experience for your application with branding …

Customize the sign-in experience for your application with branding themes Learn how to create branding themes and apply them to the sign-in experience for your application in Microsoft Entra ID.

General Availability - Ability to convert Source of Authority of synced on-premises AD users to cloud users is now available

Type: New feature Service category: User Management Product capability: Microsoft Entra Cloud Sync We’re pleased to announce the general availability of object-level Source of Authority (SOA) switching for Microsoft Entra ID. With this feature, administrators can transition individual users from…

DocsTransfer user SOA to Microsoft Entra IDUpdated

Transfer user SOA to Microsoft Entra ID Learn how to transfer user Source of Authority (SOA) to Microsoft Entra ID, minimize your AD DS footprint, and govern the full user lifecycle from the cloud.

PowerShell script installer for Win32 apps

When adding a Win32 app, you can upload a PowerShell script to serve as the installer instead of specifying a command line. Intune packages the script with the app content and runs it in the same context as…

DocsWin32 App Management in Microsoft Intune

Win32 App Management in Microsoft Intune Learn how to manage Win32 apps with Microsoft Intune. This article provides an overview of the Intune Win32 app delivery and management capabilities.

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.104) which incorporates the latest Secur

Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.104) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.92) which incorporates the latest Securi

Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.92) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.82) which incorporates the latest Securi (1 CVE)

Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.82) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security fixes: CVE-2026-21223

DocsSecurity Update Guide·CVE-2026-21223

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.139) which incorporates the latest Secur

Microsoft released the latest Microsoft Edge Stable Channel (Version 143.0.3650.139) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Microsoft Security Private Link (Preview)

January 8, 2026 Microsoft Defender for Cloud is announcing Microsoft Security Private Link in Preview. Microsoft Security Private Link enables private connectivity between Defender for Cloud and your workloads. The connection is established by creating private endpoints in your virtual…

DocsMicrosoft Security Private Link for Microsoft Defender for CloudUpdated

Microsoft Security Private Link for Microsoft Defender for Cloud Learn how Microsoft Security Private Link provides secure, private connectivity between your virtual network and Microsoft Defender for Cloud.

Workday connector updated to least-privilege permission model

The Workday connector now requires only “View” permissions to function. We have removed the “Modify” permission requirement to better align with the principle of least privilege. While existing configurations will continue to work, admins are encouraged to update the Workday…

DocsProtect your Workday environment

Protect your Workday environment Connect Workday to Microsoft Defender for Cloud Apps with the API connector to monitor user activity and detect anomalous behavior.

Expanding ZAP and Teams Admin quarantine to Plan 1

Expanding ZAP and Teams Admin quarantine to Plan 1 : Zero-hour-auto-purge (ZAP) and admin management of quarantined Teams messages is available to Microsoft Defender for Plan 1 by default, bringing a post-delivery protection layer.

DocsManage quarantined messages and files as an adminNew·Zero-hour auto purge in Microsoft Defender for Office 365

Manage quarantined messages and files as an admin Admins can learn how to view and manage quarantined messages for all users in Microsoft 365 organizations with cloud mailboxes. Admins in organizations with Microsoft Defender for Office 365 can also manage quarantined files in SharePoint, OneDrive, and Microsoft Teams.

Block communication from sender email address and domains in Teams

Block communication from sender email address and domains in Teams : Admins can directly block malicious domains and email addresses from within the Microsoft Defender portal, seamlessly adding targeted entries to the Teams Admin Center (TAC) blocked domains and users…

DocsBlock domains and addresses in Microsoft Teams using the Tenant …

Block domains and addresses in Microsoft Teams using the Tenant Allow/Block List Admins can learn how to block domains and addresses in Microsoft Teams using the Tenant Allow/Block List.