What's new in Microsoft Security: February 2026

Microsoft Sentinel UEBA behaviors layer is now generally available

The UEBA behaviors layer in Microsoft Sentinel is now generally available, summarizing clear, human‑readable behavioral insights from high-volume, raw security logs. The behaviors layer aggregates and sequences related events into normalized behaviors, helping analysts more quickly understand who did what…

DocsTranslate raw security logs to behavioral insights using UEBA …·Post Re: Extract data using text within set of data

Translate raw security logs to behavioral insights using UEBA behaviors in Microsoft Sentinel The Microsoft Sentinel UEBA behaviors layer translates security telemetry into normalized behavioral patterns for investigation, hunting, and detection engineering.

Generate playbooks using AI in Microsoft Sentinel (Preview)

You can now generate playbooks using AI in Microsoft Sentinel . The SOAR playbook generator creates python based automation workflows coauthored through a conversational experience with Cline, an AI coding agent. For more information, see the Playbook Generation blog post…

DocsGenerate playbooks using AI in Microsoft Sentinel·the Playbook Generation blog post

Generate playbooks using AI in Microsoft Sentinel Generate playbooks through natural language conversations directly in the Defender portal.

(GA) The following content types are now generally available for distribution across multiple tenants in the M

(GA) The following content types are now generally available for distribution across multiple tenants in the Microsoft Defender multitenant portal: analytics rules, automation rules, and workbooks.

DocsContent distribution using distribution profiles in multitenant …

Content distribution using distribution profiles in multitenant management Learn about content distribution across tenants in the Microsoft Defender multitenant portal.

(GA) The following advanced hunting schema tables are now generally available: The IdentityAccountInfo table c

(GA) The following advanced hunting schema tables are now generally available: The IdentityAccountInfo table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account. The…

DocsIdentityAccountInfo table in the advanced hunting schema·EntraIdSignInEvents table in the advanced hunting schema (preview)·EntraIdSpnSignInEvents table in the advanced hunting schema (preview)·GraphAPIAuditEvents table in the advanced hunting schema

IdentityAccountInfo table in the advanced hunting schema Learn about the IdentityAccountInfo table in the advanced hunting schema, which provides account information from various sources, including Microsoft Entra ID.

Microsoft Defender Experts Hunting customers can now set up Notification contacts . These contacts are the ind

Microsoft Defender Experts Hunting customers can now set up Notification contacts . These contacts are the individuals or groups that Microsoft needs to notify if there are critical incidents or service updates.

DocsSubscribe to Microsoft Defender Experts Hunting

Subscribe to Microsoft Defender Experts Hunting If you're new to Microsoft Defender and Defender Experts Hunting, this is how you onboard, receive, and set up Defender Experts Notifications.

Vulnerable components page renamed to Software components

Vulnerable components page renamed to Software components. To reflect Defender Vulnerability Management's visibility into all software components identified in your organization, the Vulnerable components page is now named Software components .

DocsSoftware components in Microsoft Defender Vulnerability Management

Software components in Microsoft Defender Vulnerability Management Use the Software components page in Defender Vulnerability Management to identify vulnerable software components and dependencies, review associated risks, and find remediation guidance.

Support for software product vulnerability data on Windows 7

Support for software product vulnerability data on Windows 7. To provide comprehensive vulnerability management capabilities across all supported Windows versions, Microsoft Defender Vulnerability Management now gathers software product vulnerability data on Windows 7 devices.

Improved Device Vulnerabilities report experience

Improved Device Vulnerabilities report experience. To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes the following changes and enhancements: - The Vulnerable devices by Windows 10/11 version over time section is now removed. -…

DocsVulnerable devices report

Vulnerable devices report A report showing vulnerable device trends and current statistics so you can understand the breath and scope of your device exposure.

macOS release: Build 101.26012.0012

macOS release: Build 101.26012.0012. Release version 20.126012.12.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.25122.0008

macOS release: Build 101.25122.0008. Release version 20.125122.8.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Windows release: Windows Defender Antivirus: Platform 4.18.26010.5 / Engine 1.1.26010.1

Windows release: Windows Defender Antivirus: Platform 4.18.26010.5 / Engine 1.1.26010.1. See enhancements and features for this release .

DocsMicrosoft Defender Antivirus updates - Previous versions for technical …

Microsoft Defender Antivirus updates - Previous versions for technical upgrade support Understand the type of technical support offered for previous versions of Microsoft Defender Antivirus

Windows release: Sense version 10.8821

Windows release: Sense version 10.8821. Release details are now available: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

What's new and release notes documentation updates

What's new and release notes documentation updates. The what's new and OS-specific release notes pages are now updated to provide better visibility and access to new features, improvements, and fixes: - The what's new page (this page) is now named…

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Linux release: Build 101.25122.0004

Linux release: Build 101.25122.0004. Release version 30.125122.0004.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Effective settings tab

Effective settings tab. The Effective settings tab under the device inventory Configuration management tab is now generally available. In this tab, you can view the actual value and configuration source of each security setting on a device. This helps identify…

DocsInvestigate devices in Microsoft Defender for Endpoint

Investigate devices in Microsoft Defender for Endpoint Learn how to investigate devices by reviewing alerts, timelines, network connections, and security assessments in Microsoft Defender for Endpoint.

Library management for live response

Library management for live response. You can now view and manage files and scripts used during live response sessions in the Microsoft Defender portal. With this enhancement, you get a centralized view of all uploaded files and their properties, and…

DocsManage the live response file library in Microsoft Defender for …

Manage the live response file library in Microsoft Defender for Endpoint Use Microsoft Defender for Endpoint to configure libraries for live response.

Enhanced Defender deployment tool for Windows

Enhanced Defender deployment tool for Windows. The new version of the tool streamlines onboarding and enhances security by: - Bundling the onboarding package directly into the tool's executable. - Generating a key during deployment package creation that is required for…

macOS · February 2026 · Platform: 101.25122.0008

Release details Platform version Release version Engine version Signature version 101.25122.0008 20.125122.8.0 1.1.25100.4000 1.439.74.0 Enhancements and features Bug and performance fixes

Windows · February 2026 · Platform: 10.8821

Release details OS KB Windows Server 2025, all editions KB5078740 Windows Server 2022 KB5078766 Windows Server 2019, Windows 10 1809 KB5078752 Windows 11 26H1 KB5077239 Windows 11 24H2, Windows 11 25H2 KB5077241 Windows 11 23H2 KB5078883 Windows 10 21H2, Windows…

DocsKB5078740·KB5078766·KB5078752·KB5077239

Linux · February 2026 · 101.25122.0004

Release details Platform version Release version Engine version Signature version 101.25122.0004 20.125122.0004 1.1.25110.3002 1.443.508.0 Enhancements and features Feature area Update summary Network configuration The following URLs must be allowed to enable Defender on Linux endpoints to receive internal configurations from…

DocsMicrosoft Defender for Endpoint streamlined connectivity URLs - …Updated·Microsoft Defender for Endpoint streamlined connectivity URLs - US …

Microsoft Defender for Endpoint streamlined connectivity URLs - commercial Get a list of the streamlined connectivity URLs required to onboard and maintain devices in Microsoft Defender for Endpoint in US commercial cloud environments.

New Defender for Identity security alerts

These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Suspicious user configuration change activity from Entra ID sync application Anomalous OAuth device code authentication activity Suspicious Graph API request made…

DocsMicrosoft Defender for Identity XDR security alertsUpdated

Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.

Defender for Identity sensor updates

Version number Updates 2.255 This sensor update includes bug fixes.

General Availability - Sign-in with username/alias

Type: New feature Service category: B2C - Consumer Identity Management Product capability: B2B/B2C In Microsoft Entra External ID (EEID), users who authenticate with a local email and password now can also sign in using a username (alias) as an alternate…

DocsSign in with alias

Sign in with alias Learn how to sign in and sign up with alias/username with External ID for customer identity and access management (CIAM). Get detailed steps to enable username as a sign-in identifier and create users with both email address and username.

General Availability - Revoke previously approved access package assignments in My Access

Type: New feature Service category: Entitlement Management Product capability: Identity Governance By end of March Microsoft Entra ID Governance approvers can now revoke access to an access package after an approval has already been granted. This gives approvers greater control…

DocsApprove or deny access requests - entitlement management

Approve or deny access requests - entitlement management Learn how to use the My Access portal to approve or deny requests to an access package in Microsoft Entra entitlement management.

General Availability - Microsoft Entra Provisioning Service available in Microsoft Azure operated by 21Vianet

Type: New feature Service category: Provisioning Product capability: Outbound to SaaS Applications The Microsoft Entra provisioning service can be used in the 21Vianet / China cloud for the following scenarios: API-driven provisioning, Cloud Sync, Cross-tenant sync between China tenants, SCIM…

DocsKnown issues for provisioning in Microsoft Entra ID

Known issues for provisioning in Microsoft Entra ID Learn about known issues when you work with automated application provisioning or cross-tenant synchronization in Microsoft Entra ID.

General Availability - Microsoft Entra Connect Sync now supports Windows Server 2025

Type: New feature Service category: Entra Connect Product capability: Entra Connect Microsoft Entra Connect Sync now officially supports Windows Server 2025 . This means you can confidently install and run Microsoft Entra Connect Sync on servers running Windows Server 2025…

DocsMicrosoft Entra Connect: Version release historyNew·Common hybrid scenarios with Microsoft Entra IDNew·Windows Server 2025·Microsoft Entra Connect

Microsoft Entra Connect: Version release history This article lists all releases of Microsoft Entra Connect and Azure AD Sync.

General Availability - External MFA is Generally Available

Type: New feature Service category: MFA Product capability: User Authentication We're excited to announce that external authentication methods in Microsoft Entra ID is now generally available under a new name: External Multifactor Authentication (External MFA). This capability enables organizations to…

DocsHow to manage external MFA in Microsoft Entra ID

How to manage external MFA in Microsoft Entra ID Learn how to manage external MFA methods for Microsoft Entra multifactor authentication

General Availability - Expanded attribute support in Lifecycle Workflows attribute changes trigger

Type: New feature Service category: Lifecycle Workflows Product capability: Identity Governance The Attribute Changes trigger in Lifecycle Workflows now supports additional attribute types, enabling broader detection of organizational changes. Previously, this trigger was limited to a set of core attributes…

DocsUse custom attribute triggers in lifecycle workflows

Use custom attribute triggers in lifecycle workflows This article discusses how to use Custom Attribute Triggers as an attribute change trigger within a workflow in Lifecycle Workflows.

General Availability - Device authorization grant flow in Microsoft Entra External ID

Type: New feature Service category: B2C - Consumer Identity Management Product capability: B2B/B2C Similar to Microsoft Entra ID (workforce tenants), Microsoft Entra External ID (external tenants) now supports device authorization grant flow, which allows users to sign in to input-constrained…

DocsOAuth 2.0 device authorization grant

OAuth 2.0 device authorization grant Sign in users without a browser. Build embedded and browser-less authentication flows using the device authorization grant.

General Availability - Delegated Workflow Management in Lifecycle Workflows

Type: New feature Service category: Lifecycle Workflows Product capability: Identity Governance Lifecycle workflows can now be managed with Administrative Units (AUs), enabling organizations to segment workflows and delegate administration to specific admins. This enhancement ensures that only authorized admins can…

DocsDelegated Workflow Management

Delegated Workflow Management This article informs a user about delegating management of workflows using Lifecycle workflows.

General Availability - Custom banned password lists supported in Microsoft Entra External ID

Type: New feature Service category: B2C - Consumer Identity Management Product capability: B2B/B2C In addition to the global banned password lists already supported, EEID admins can now add specific strings to block during password creation and reset. For more information…

DocsPassword protection in Microsoft Entra ID

Password protection in Microsoft Entra ID Learn how to dynamically ban weak passwords from your environment with Microsoft Entra Password Protection

General Availability - Custom Block pages

Type: New feature Service category: Internet Access Product capability: Network Access When you configure policies blocking your users from accessing a risky, NSFW, or unsanctioned sites or apps in GSA, they receive a clear HTML error message with Microsoft Entra…

DocsHow to Customize Global Secure Access Block Page - Global Secure …

How to Customize Global Secure Access Block Page - Global Secure Access Use custom block pages to display organization-specific messaging internet access policies block users from accessing websites.

Upcoming change – Microsoft Entra Connect security update to block hard match for users with Microsoft Entra roles

Type: Plan for change Service category: Entra Connect Product capability: Entra Connect What is Hard-matching in Microsoft Entra Connect Sync and Cloud Sync? When Microsoft Entra Connect or Cloud Sync adds new objects from Active Directory, the Microsoft Entra ID…

DocsMicrosoft Entra Built-in RolesUpdated·Microsoft Entra Connect: Design concepts·Configure Microsoft Entra Connect for an existing tenant·Microsoft Entra Connect: Troubleshoot errors during synchronization

Microsoft Entra Built-in Roles Learn what each Microsoft Entra built-in role can do, from Global Administrator to Reports Reader. Find role descriptions, permissions, and template IDs.

Upcoming Changes – Jailbreak/root Detection in Authenticator App

Type: New feature Service category: Microsoft Authenticator App Product capability: Identity Security & Protection Starting February 2026, Microsoft Authenticator will introduce jailbreak/root detection for Microsoft Entra credentials in the Authenticator app. The rollout progresses from warning mode → blocking mode…

Public Preview - New end user homepage in My Account

Type: New feature Service category: My Profile/Account Product capability: End User Experiences The homepage at https://myaccount.microsoft.com has been updated to provide a more task-focused experience. Users will see pending actions like renewing expiring groups, approving access package requests, and setting…

Public Preview - BYOD support for Windows client using Microsoft Entra registration

Type: New feature Service category: BYOD support Product capability: Network Access Bring Your Own Device (BYOD) support for Windows using Microsoft Entra‑registered devices is now available in public preview. Users and partners can access corporate resources from their own devices…

DocsLearn about bring your own device (BYOD) with the Global Secure Access …

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access - Global Secure Access Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Clarity Express for Intune by Rego Consulting Corporation Datadog by Datadog Inc. Qlik Analytics by Qlik Tier1 for Intune by SS&C Technologies, Inc. (iOS) For more information about…

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

Admin tasks in Microsoft Intune are now generally available

Admin tasks in the Intune admin center are out of preview and now generally available. Admin tasks provide a centralized view where admins can discover, organize, and act on common tasks that are otherwise spread throughout the Intune…

DocsCentrally manage Admin TasksUpdated

Centrally manage Admin Tasks Centrally manage admin tasks in Microsoft Intune. Use the unified Admin tasks view to organize and act on administrative tasks from Device Offboarding, Endpoint Privilege Management, and more.

Windows feature update reports support Windows 11, version 25H2

The Windows feature update compatibility risks report and Windows feature update device readiness report support Windows 11, version 25H2 as a selectable target OS. When you choose this version under Select target OS , the reports provide…

Update firewall configurations for new Intune network endpoints

As part of Microsoft's ongoing Secure Future Initiative (SFI) , Microsoft Intune began using Azure Front Door (AFD) IP addresses in addition to the existing Intune service IPs in December 2025. Customers that use IP-based allowlist, Azure service…

DocsNetwork endpoints for Microsoft IntuneUpdated·Secure Future Initiative (SFI)·Network endpoints for US government deployments·Post Support tip: Upcoming Microsoft Intune network changes

Network endpoints for Microsoft Intune Review endpoints for Intune. This page lists IP addresses and port settings needed for proxy settings in your Intune deployments.

New updates to the Apple settings catalog

The Settings Catalog lists all the settings you can configure in a device policy, and all in one place. For more information about configuring Settings Catalog profiles in Intune, see Create a policy using settings catalog . There…

DocsCreate a policy using settings catalog in Microsoft IntuneNew·Microsoft Intune admin center

Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…

New supported OEMConfig apps for Android Enterprise

The following OEMConfig apps are available in Intune for Android Enterprise: FCNT - Senior Care | com.fcnt.mobile_phone.seniorcareconfig FCNT - Schema | com.fcnt.mobile_phone.schematest Sonim | com.sonim.oemappconfig For more information about OEMConfig, see Use and manage Android Enterprise devices with…

DocsUse OEMConfig on Android Enterprise devices in Microsoft IntuneNew

Use OEMConfig on Android Enterprise devices in Microsoft Intune Use Microsoft Intune to manage and use devices running Android Enterprise with OEMConfig. See all the steps, including an overview, see the prerequisites, create the configuration profile in Intune, and see a list of supported OEMConfig apps.

New settings in the Windows settings catalog

There are new settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile ( Devices > Configuration profiles > Create profile > Windows 10 and later > Settings…

DocsShare on Windows: integrate the Windows Share SheetNew·Create a policy using settings catalog in Microsoft IntuneNew

Share on Windows: integrate the Windows Share Sheet Learn how to implement Share on Windows - integrate your app with the Windows Share Sheet to let users share content across Windows apps and services.

More options for assignment filters > Device Management Type property for managed apps on Android and iOS/iPadOS

When you create policies for your managed apps, you can use assignment filters to assign policies based on rules you create. In these rules, you can use different device and app properties, including the Device Management Type property…

DocsAssignment filter properties and operators referenceNew·Create assignment filters in Microsoft Intune·Configuration Policies for Intune App SDK Managed Apps

Assignment filter properties and operators reference Reference guide for device and app properties, operators, and rule syntax when creating assignment filters in Microsoft Intune. Includes examples and supported values.

Lenovo Device Orchestration (LDO) link in the Intune admin center

Microsoft Intune now includes a direct link to Lenovo Device Orchestration (LDO) in the Intune admin center. This integration expands the Partner portals experience by giving IT admins a single, secure entry point to manage supported Lenovo devices…

Intune certificate inventory integration with Zimperium mobile threat defense

You can now configure the Zimperium Mobile Threat Defense (MTD) connector to synchronize certificate inventory from your managed iOS devices. This enhancement helps you identify when a device threat level is elevated due to approved but potentially malicious…

DocsEnable Mobile Threat Defense connector in Microsoft IntuneUpdated

Enable Mobile Threat Defense connector in Microsoft Intune Enable the connector between your Mobile Threat Defense (MTD) partner and Microsoft Intune.

Filter by Android management mode in the settings catalog

The settings catalog includes hundreds of settings that you can configure. There are built-in features that help filter the available settings. When you create an Android settings catalog policy, there's a management mode filter option that filters the…

DocsCreate a policy using settings catalog in Microsoft IntuneNew·Android settings catalog in Microsoft Intune

Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…

Endpoint Privilege Management support on Azure Virtual Desktop

Endpoint Privilege Management (EPM) elevation policies now support deployment to users on Azure Virtual Desktop (AVD) single-session virtual machines. For information about using EPM, see Plan and Prepare for Endpoint Privilege Management Deployment .

DocsPlan and Prepare for Endpoint Privilege Management DeploymentNew

Plan and Prepare for Endpoint Privilege Management Deployment Plan your Endpoint Privilege Management deploying by understanding requirements, fundamentals, and security recommendations.

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 145.0.3800.82) which incorporates the latest Securi

Microsoft released the latest Microsoft Edge Stable Channel (Version 145.0.3800.82) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 145.0.3800.70) which incorporates the latest Securi

Microsoft released the latest Microsoft Edge Stable Channel (Version 145.0.3800.70) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Extended Stable Channel (Version 144.0.3719.130) which incorporates the lat (1 CVE)

Microsoft released the latest Microsoft Edge Extended Stable Channel (Version 144.0.3719.130) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-2441 has an exploit in the wild, and this update contains a fix for…

DocsCVE-2026-2441·Security Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 145.0.3800.58) which incorporates the latest Securi (2 CVEs)

Microsoft released the latest Microsoft Edge Stable Channel (Version 145.0.3800.58) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-2441 has an exploit in the wild, and this update contains a fix for it…

DocsCVE-2026-2441·Security Update Guide·CVE-2026-0102

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.115) which incorporates the latest Secur

Microsoft released the latest Microsoft Edge Stable Channel (Version 144.0.3719.115) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Updated CIEM recommendation logic

February 2, 2026 Cloud Infrastructure Entitlement Management (CIEM) recommendations are now available as a native capability in Microsoft Defender for Cloud across Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). This update changes how inactive identities and over-permissioned…

DocsIntegrate AWS CloudTrail LogsUpdated·Integrate GCP cloud logging·Cloud infrastructure entitlement management (CIEM)

Integrate AWS CloudTrail Logs AWS CloudTrail logs give Defender for Cloud visibility into permission changes and control-plane activity. Learn to enable and verify ingestion.

Simulate alerts for SQL servers on machines

February 9, 2026 Microsoft Defender for Cloud’s SQL simulated alerts is now generally available. Simulated alerts let security teams safely validate SQL protection, detections, and automated response workflows without introducing real risk. Simulated alerts generate realistic alerts with full SQL…

DocsSimulate Alerts for SQL Servers on MachinesUpdated

Simulate Alerts for SQL Servers on Machines Simulate alerts for SQL servers on machines to safely validate your Defender for Cloud detection and response workflows. Learn how to run and verify test alerts.

Scanning support for Minimus and Photon OS container images

February 10, 2026 Microsoft Defender for Cloud's vulnerability scanner, powered by Microsoft Defender Vulnerability Management, is extending its scanning coverage to Minimus and Photon OS container images to help validate that they're shipping the most secure builds possible. As additional…

DocsContainers support matrix in Defender for CloudUpdated

Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

Threat protection for AI agents (Preview)

February 2, 2026 Microsoft Defender for Cloud now includes threat protection for AI agents built with Foundry, available in preview as part of the Defender for AI Services plan. This new capability delivers advanced security from development through runtime, addressing…

DocsAlerts for AI services

Alerts for AI services This article lists the security alerts for AI services visible in Microsoft Defender for Cloud.

Database-level recommendations experience for SQL Vulnerability Assessment (Preview)

February 10, 2026 Microsoft Defender for SQL is introducing a database-level recommendations experience for SQL Vulnerability Assessment in preview. This update applies to SQL VA across all supported database types (PaaS and IaaS), including both Express and Classic configurations, and…

DocsReview and remediate SQL vulnerability assessment findings·SQL vulnerability assessment rules reference

Review and remediate SQL vulnerability assessment findings Learn how to find, review, and remediate SQL vulnerability assessment findings in Microsoft Defender for Cloud for Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics.

Container runtime anti-malware detection and blocking (Preview)

February 22, 2026 Microsoft Defender for Cloud is announcing container runtime anti-malware detection and prevention in preview. This feature provides real-time detection and prevention of malware in containerized workloads across Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and…

DocsContainer runtime antimalware detection and blocking

Container runtime antimalware detection and blocking Learn how to configure container runtime antimalware detection and blocking to block or alert on malware in Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) environments.

Binary drift now supports blocking (Preview)

February 22, 2026 Binary drift now supports blocking in preview. With this update, you can configure binary drift policies to not only detect but also block unauthorized changes to container images at runtime. This enhancement helps prevent potential security breaches…

DocsBinary drift detection and blocking

Binary drift detection and blocking Learn how binary drift detecting and blocking can help you detect unauthorized external processes within containers.

Expanding User reporting in Teams to Defender for Office 365 Plan 1

Expanding User reporting in Teams to Defender for Office 365 Plan 1 : Users can report external and intra-org Microsoft Teams messages from chats, standard, shared, and private channels, meeting conversations to Microsoft as malicious (security risk) the specified reporting…

DocsUser reported settings in TeamsNew·Configure user reported message settings in Microsoft Defender for …New

User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

Insider Risk Management

In preview : Microsoft Fabric indicators now include Lakehouse indicators. In preview : A new quick policy template for detecting data theft from non-Microsoft 365 apps by users leaving your organization is now available.

DocsConfigure policy indicators in Insider Risk Management·Create and manage Insider Risk Management policies

Configure policy indicators in Insider Risk Management Configure policy indicators in Microsoft Purview Insider Risk Management to define the type of risk activities that you want to detect and investigate.

Developers

Microsoft Purview enables software development companies to integrate governance, protection, and compliance capabilities into their applications using SDKs and APIs. A new list of partner integrations is now available, with links to partner documentation. For more information, see Software Developer…

DocsMicrosoft Purview extensibility

Microsoft Purview extensibility Learn about extending Microsoft Purview solutions by using third-party data connectors and Microsoft Graph APIs.

Sensitivity labels

New : The client-side improvements for sensitivity labels that extend SharePoint permissions to downloaded documents that started to roll out to Windows version 2601+ in January for the Current Channel is complete, and now also available with the Monthly Enterprise…

DocsConfigure SharePoint with a sensitivity label to extend permissions to …Updated

Configure SharePoint with a sensitivity label to extend permissions to downloaded documents Configure a SharePoint document library with a sensitivity label to extend existing permissions to documents that are downloaded, and protect files from being copied or moved.

Data Governance

In preview : Microsoft Purview Data Quality supports incremental data quality scans by using time-based filtering. By using incremental scans, you can choose between full scans, incremental scans, or both when you run data quality rules on data assets. In…

DocsIncremental Data Quality Scan in Unified Catalog·Data Quality Scan for a Data Asset in Unified Catalog·Data Quality Supported Sources and File Types in Unified Catalog·Connect to Data Sources for Data Quality in Unified Catalog

Incremental Data Quality Scan in Unified Catalog Use time-based filter to scan data quality incrementally in Microsoft Purview Unified Catalog.