What's new in Microsoft Security: April 2026

Entity analyzer is now generally available

Entity analyzer in the Microsoft Sentinel Model Context Protocol (MCP) data exploration tool collection lets you get out-of-the-box, explainable entity risk assessments for URLs and identities using threat intelligence, prevalence, and organizational context. Important Starting April 1, 2026, you're charged…

DocsData Exploration Tool Collection in Microsoft Sentinel MCP Server·Microsoft Sentinel MCP server pricing, limits, and availability

Data Exploration Tool Collection in Microsoft Sentinel MCP Server Learn how to search tables, run KQL queries, analyze entities, and explore graphs by using the data exploration tools in the Microsoft Sentinel MCP server.

AI-powered SIEM migration tool is now generally available

Accelerate migrations to Microsoft Sentinel from Splunk and QRadar using an AI-assisted SIEM migration experience designed to reduce manual effort and speed time-to-value. For more information, see Migrate to Microsoft Sentinel with the SIEM migration experience .

DocsUse the SIEM Migration Experience

Use the SIEM Migration Experience Migrate security monitoring use cases from other Security Information and Event Management (SIEM) systems to Microsoft Sentinel.

[Updated] Call to action: update automation by July 1, 2026 - Account Name is now consistently the UPN prefix for analytics rule alerts

Microsoft Sentinel is updating how the account entity's Account Name value is populated for analytics rule alerts when the full UPN is mapped into Account Name. This change improves consistency for downstream automation rules and Logic Apps playbooks. This change…

DocsPost Update: Changing the Account Name Entity Mapping in Microsoft Sentinel

Update: Changing the Account Name Entity Mapping in Microsoft Sentinel The upcoming update introduces more consistent and predictable entity data across analytics, incidents, and automation by standardizing how the Account Name...

Transform data with filter and split features (Preview)

Native filtering and splitting in the Microsoft Defender portal helps you reduce noise before ingestion, control costs, and intelligently route data between analytics and data lake tiers so you can optimize what gets analyzed versus retained. For more information, see…

DocsTransform data using filter and split in Microsoft Sentinel

Transform data using filter and split in Microsoft Sentinel Learn how to use filter and split data transformations to streamline ingestion, reduce costs, and route data between Analytics and Data lake tiers in Microsoft Sentinel.

Microsoft Sentinel data federation (Preview)

Powered by Microsoft Fabric, Microsoft Sentinel data federation lets you analyze security data where it already lives, without copying or duplicating it. You can federate data from Microsoft Fabric, Azure Data Lake Storage, and Azure Databricks into Microsoft Sentinel data…

DocsData federation overview in Microsoft Sentinel data lake

Data federation overview in Microsoft Sentinel data lake Learn how data federation in Microsoft Sentinel data lake enables seamless querying of external data sources including Azure Databricks, ADLS Gen 2, and Microsoft Fabric.

Cost estimation tool for customers and partners (Preview)

A guided, meter-level Microsoft Sentinel cost estimator with three-year projections helps organizations model data growth, predict spend, and plan Microsoft Sentinel adoption with confidence. For more information, see Microsoft Sentinel pricing .

DocsMicrosoft Sentinel pricing

Configure row-level access using Microsoft Sentinel scoping (Preview)

Microsoft Sentinel now supports scoping (row-level RBAC) to control access to specific subsets of Sentinel data without requiring workspace separation. Administrators can define logical scopes, tag data at ingestion time, and assign users or groups to scopes using Unified RBAC…

DocsConfigure Microsoft Sentinel scoping (row-level RBAC)

Configure Microsoft Sentinel scoping (row-level RBAC) Create and apply Microsoft Sentinel scopes to control access to data at the row level.

Build custom graphs (Preview)

Build tailored security graphs across the Sentinel data lake and third-party data to uncover attack paths, blast radius, and hidden relationships. These graphs also serve as a foundation for advanced investigations and AI agents. For more information, see Custom Graph…

DocsCustom Graphs in Microsoft Sentinel Overview (Preview)

Custom Graphs in Microsoft Sentinel Overview (Preview) Learn how custom graphs in Microsoft Sentinel help you model connected security data from Sentinel data lake and external sources to visualize attack paths, uncover hidden relationships, and improve investigations.

Accelerate Microsoft Sentinel connector development with Visual Studio Code connector builder agent (Preview)

An AI-powered, low-code agent in Visual Studio Code helps you build Microsoft Sentinel connectors in minutes, bringing in new data sources faster and unlocking security outcomes sooner. For more information, see Get started with custom connectors using AI agent in…

DocsBuild custom connectors with AI in Microsoft Sentinel

Build custom connectors with AI in Microsoft Sentinel Build custom Microsoft Sentinel data connectors in minutes with the AI connector builder agent in Visual Studio Code. Reduce development time from weeks to hours.

(GA) Built-in alert tuning rules are now generally available. Built-in alert tuning rules suppress alerts from

(GA) Built-in alert tuning rules are now generally available. Built-in alert tuning rules suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting Automated Investigation and Response (AIR) investigations and email notifications.

DocsInvestigate alerts in Microsoft Defender XDRUpdated

Investigate alerts in Microsoft Defender XDR Investigate alerts seen across devices, users, and mailboxes.

Defender Experts

Microsoft Defender Experts MDR customers can now see Defender Experts as a distinct entry in the Microsoft Defender portal navigation menu. This feature adds to the existing home page status card as in-portal experiences that provide consistent and predictable access…

DocsHow to use the Microsoft Defender Experts service

How to use the Microsoft Defender Experts service Learn about the different in-portal experiences in Microsoft Defender where you can view and perform Defender Experts notifications and activities

Activities

(Preview) You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page. Learn more

DocsDetails and Results of an Automatic Attack Disruption Action

Details and Results of an Automatic Attack Disruption Action Learn how to review automatic attack disruption results in Microsoft Defender XDR, including the summary card, Activities tab, Action center, and advanced hunting queries.

(Preview) The AIAgentsInfo table in advanced hunting now includes additional columns that provide deeper visib

(Preview) The AIAgentsInfo table in advanced hunting now includes additional columns that provide deeper visibility into AI agents operating in your Microsoft 365 environment. These fields expand coverage beyond Copilot Studio to all agent types, including Microsoft Foundry, third-party marketplace…

Security Analyst Agent - Public preview

Type: New feature Experience: Standalone / Embedded The Security Analyst Agent in Security Copilot helps security analysts quickly identify, assess, and prioritize risks. The agent performs deep, multi-step investigations across Microsoft Defender and Microsoft Sentinel telemetry to surface high-impact risks…

DocsDeploy AI agents in Microsoft Defender

Deploy AI agents in Microsoft Defender Learn about AI agents in Microsoft Defender that can help you perform your security tasks easily.

New predefined classifications

The following predefined Cloud resource classification rule was added to the critical assets list: Classification Description APIs with Sensitive Data This rule applies to APIs that contain sensitive data. This often indicates that the API is used for critical production…

DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

New Microsoft Secure Score recommendation

New Microsoft Secure Score recommendation. Microsoft Secure Score now includes the Ensure devices are updated to Secure Boot 2023 certificates and boot manager , which helps identify devices that haven't yet transitioned to the new Secure Boot 2023 certificates required…

DocsAssess Secure Boot status with Microsoft Defender (blog)

macOS release: Build 4.18.25040.1

macOS release: Build 4.18.25040.1. Release version 4.18.25040.1 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.26032.0016

macOS release: Build 101.26032.0016. Release version 20.126032.16.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.26022.0020

macOS release: Build 101.26022.0020. Release version 20.126022.20.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.26022.0018

macOS release: Build 101.26022.0018. Release version 20.126022.18.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Windows release: Windows Defender Antivirus: Platform 4.18.26030.3011 / Engine 1.1.26030.3008

Windows release: Windows Defender Antivirus: Platform 4.18.26030.3011 / Engine 1.1.26030.3008. See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Linux release: Build 101.26032.0000

Linux release: Build 101.26032.0000. Release version 30.126032.0000.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Android release: Build 1.0.8805.0103

Android release: Build 1.0.8805.0103. Build 1.0.8805.0103 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

View action status in the Activities tab (Preview)

View action status in the Activities tab (Preview). You can now view the current status of automatic attack disruption and predictive shielding actions related to a specific incident. You view this data in the Activities tab of the incident page…

DocsDetails and Results of an Automatic Attack Disruption Action·Take response actions on a device in Microsoft Defender for EndpointUpdated

Details and Results of an Automatic Attack Disruption Action Learn how to review automatic attack disruption results in Microsoft Defender XDR, including the summary card, Activities tab, Action center, and advanced hunting queries.

Windows Antivirus · April 2026 · Platform 4.18.26040.7 · Engine 1.1.26040.8

Release details Component Version Date Platform 4.18.26040.7 May 12, 2026 Engine 1.1.26040.8 May 5, 2026 Security intelligence 1 1.451.6.0 May 12, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…

DocsSecurity intelligence updates for Microsoft Defender Antivirus and …·CVE-2026-41091·CVE-2026-45498·CVE-2026-45584

Linux · April 2026 · 101.26032.0000

Release details Release version Engine version Signature version 30.126032.0000.0 1.1.26010.1004 1.445.617.0 Enhancements and features Feature area Update summary Visibility Expanded visibility into Linux kernel module (.ko) file activity - including creation, rename, and deletion. Configuration Offline security intelligence updates now…

Android · April 2026 · Platform: 1.0.8805.0103

Release details Platform version Release Date 1.0.8805.0103 April 7, 2025 Enhancements and features Feature area Update summary General Performance improvement and bug fixes.

Automatic Windows event auditing configuration for sensors v3.x is now generally available

The Automatic Windows event-auditing configuration for sensors v3.x is now generally available. Automatic Windows event-auditing streamlines deployment by automatically applying the required auditing settings to new sensors and correcting misconfigurations on existing ones.

DocsConfigure Windows event auditingNew

Configure Windows event auditing Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.

Identity Explorer (Preview)

The Identity page now includes the Identity Explorer tab for customers with a Microsoft Sentinel Data Lake license. This tab uses the hunting graph to visualize identity attack paths and exposure scenarios as interactive graphs. Use predefined identity scenarios to…

DocsHunting graph in Microsoft Defender advanced huntingUpdated·Investigate IdentitiesUpdated

Hunting graph in Microsoft Defender advanced hunting Learn how to use the hunting graph in Microsoft Defender XDR advanced hunting to visualize threat scenarios as interactive graphs and trace attack paths.

Custom account correlation rules (Preview)

Custom account correlation rules let you link accounts that belong to the same identity, such as privileged accounts with unique naming conventions. You can correlate accounts that don't share strong identifiers such as account ID, SID, object ID, or UPN…

DocsAccount correlation rules in Microsoft Defender for Identity (Preview)Updated

Account correlation rules in Microsoft Defender for Identity (Preview) Learn how to add, edit, and remove account correlation rules in Microsoft Defender for Identity for accounts that don't share strong identifiers.

General Availability – Enabling Social Identity Providers in Entra External ID Native Authentication via browser‑delegated (web‑view) flows using SDKs for applications

Type: General Availability Service category: B2C - Consumer Identity Management Product capability: Developer Experience Build secure sign‑in and sign‑up experiences for applications in Entra External ID using Native Authentication, with Social Identity Provider support such as Google, Facebook, and Apple…

DocsNative authentication

Native authentication Learn how to set up native authentication in Microsoft Entra External ID. Customize the user interface for mobile and desktop apps, and provide a seamless sign-in experience.

General Availability - Prefetch Workday termination data to customize account disable logic

Type: General Availability Service category: Provisioning Product capability: Inbound to Entra ID This Workday connector update resolves termination processing delays observed for workers in APAC and ANZ regions. Admins can now enable termination lookahead setting to prefetch data and tailor…

Docshttps://aka.ms/WorkdayTerminationLookaheadDoc

General Availability - Network Content Filtering based on File Types

Type: General Availability Service category: Internet Access Product capability: Network Access Global Secure Access supports network-based content filtering based on file types. This allows you to monitor and control file transfers across the network to GenAI and SaaS apps to…

DocsCreate content policies for network content filtering - Global Secure …Updated

Create content policies for network content filtering - Global Secure Access Discover how to configure network content filtering with Global Secure Access to enforce data protection policies for files and text content in real time.

General Availability - Microsoft Identity Manager (MIM) 2016 Service Pack 3 (SP3)

Type: General Availability Service category: Microsoft Identity Manager Product capability: Identity Governance Microsoft Identity Manager (MIM) 2016 Service Pack 3 (SP3) is now available. SP3 focuses on stability and supportability, modernizes compatibility with current platform components (SQL Server, SharePoint, and…

DocsMicrosoft Identity Manager licensing and downloadsUpdated·Upgrade Microsoft Identity Manager 2016 From Service Pack 2 to Service …Updated

Microsoft Identity Manager licensing and downloads This article outlines the approaches for licensing Microsoft Identity Manager (MIM) 2016, with pointers on where to download the software.

General Availability - Microsoft Entra Certificate-based authentication (CBA) support on iOS and CBA as second factor

Type: General Availability Service category: Authentications (Logins) Product capability: User Authentication Microsoft Entra Certificate-Based Authentication (CBA) is now generally available on iOS. Native iOS sign-ins now avoid unnecessary password and MFA prompts, enabling CBA as a supported second factor and…

DocsMicrosoft Entra certificate-based authentication on Apple devices

Microsoft Entra certificate-based authentication on Apple devices Learn about Microsoft Entra certificate-based authentication on Apple devices that run macOS or iOS

General Availability - Microsoft Entra Agent ID platform

Type: General Availability Service category: Other Product capability: Identity Security & Protection The Microsoft Entra Agent ID platform is now generally available. The Agent ID platform provides an identity and authorization framework built specifically for AI agents operating in enterprise…

DocsWhat is Microsoft Entra Agent ID?

What is Microsoft Entra Agent ID? Learn about Microsoft Entra Agent ID, the identity and security framework that enables organizations to build, discover, govern, and protect AI agent identities at enterprise scale.

General Availability - License Usage

Type: General Availability Service category: Reporting Product capability: Monitoring & Reporting The License Usage page in the Microsoft Entra admin center helps customers optimize their Entra licenses by providing visibility into feature usage across their tenant. It shows how many…

DocsMicrosoft Entra license usage insights

Microsoft Entra license usage insights Learn how to use the license usage insights page in the Microsoft Entra admin center to monitor license usage and entitlements.

General Availability - Issuer Hints for Microsoft Entra CBA

Type: General Availability Service category: Authentications (Logins) Product capability: User Authentication Issuer Hints is generally available now and helps improve the sign‑in experience for Entra Certificate‑Based Authentication (CBA) by ensuring users are prompted to select only certificates that are trusted…

DocsMicrosoft Entra CBA Technical Concepts

Microsoft Entra CBA Technical Concepts Learn how Microsoft Entra certificate-based authentication (CBA) works and the technical concepts you need to set up and manage CBA.

General Availability - GSA iOS client support

Type: General Availability Service category: iOS client Product capability: Network Access We are excited to announce the general availability of the iOS Global Secure Access (GSA) client. The Global Secure Access client on iOS and iPadOS requires no new agent…

General Availability - GSA Cloud Firewall for Remote Networks

Type: General Availability Service category: Internet Access Product capability: Network Access Customer can use GSA cloud firewall to apply admin configurable, 5-tuple (source IP, destination IP, protocol, source port, destination port) based filtering for all internet traffic acquired from branch…

DocsConfigure cloud firewall for remote networks - Global Secure AccessUpdated

Configure cloud firewall for remote networks - Global Secure Access Learn how to configure and use cloud firewall to protect against unauthorized internet access from branch offices using Remote Networks for Internet Access.

General Availability - Entra CBA as third option in system-preferred MFA methods

Type: General Availability Service category: Authentications (Logins) Product capability: User Authentication General Availability - Due to known issues on iOS platform, the Entra certificate-based authentication (CBA) method was not allowed as a second factor on iOS and CBA was moved…

DocsSystem-preferred authentication in Microsoft Entra IDNew

System-preferred authentication in Microsoft Entra ID Learn how system-preferred authentication evaluates methods to prompt users with the most secure sign-in option for both first-factor and second-factor authentication.

General Availability - Entra CBA Certificate Authority (CA) scoping

Type: General Availability Service category: Authentications (Logins) Product capability: User Authentication Entra CBA Certificate Authority (CA) scoping in Microsoft Entra allows tenant administrators to restrict the use of specific certificate authorities (CAs) to defined user groups. This feature enhances the…

DocsMicrosoft Entra CBA Technical Concepts

Microsoft Entra CBA Technical Concepts Learn how Microsoft Entra certificate-based authentication (CBA) works and the technical concepts you need to set up and manage CBA.

General Availability - Enforce Conditional Access policies like MFA on every PIM activation

Type: General Availability Service category: Privileged Identity Management Product capability: Privileged Identity Management Generally available feature for configuring reauthentication with Conditional Access for Microsoft Entra Privileged Identity Management role activation. For more information see: On activation, require Microsoft Entra Conditional…

DocsConfigure PIM for Groups settings

Configure PIM for Groups settings Learn how to configure PIM for Groups settings.

General Availability - Configurable Token Lifetime Policies

Type: General Availability Service category: Authentications (Logins) Product capability: Platform Configurable token lifetime policies are now generally available in Microsoft Entra ID. This feature allows administrators to customize the lifetimes of access tokens, ID tokens, and SAML tokens issued by…

DocsConfigurable Token Lifetimes

Configurable Token Lifetimes Learn how to configure token lifetimes for access, SAML, and ID tokens in Microsoft Identity Platform to enhance security.

General Availability - As an AP requestor, I can see in My Access who my approver(s) are if the access package owner allows me to

Type: General Availability Service category: Entitlement Management Product capability: Entitlement Management In May, requestors will be able to see the name and email address of approvers for their pending access package requests directly in the My Access portal will be…

DocsRequest an access package - entitlement management

Request an access package - entitlement management Learn how to use the My Access portal to request access to an access package in Microsoft Entra entitlement management.

Upcoming Change - Migrate from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync

Type: Plan for change Service category: Entra Connect Product capability: Entra Connect As organizations look to strengthen identity security and advance their Zero Trust strategies, many are looking for simpler, more reliable ways to manage hybrid identity. To support these…

DocsWhat is Microsoft Entra Cloud Sync?New·Migrate to Microsoft Entra Cloud SyncNew·Tutorial - Migrate to Microsoft Entra Cloud Sync for a Synced Active …New·Microsoft Entra Cloud Sync migration decision guideNew

What is Microsoft Entra Cloud Sync? Learn how Microsoft Entra Cloud Sync synchronizes users, groups, and contacts from Active Directory to Microsoft Entra ID, and how enabled device sync supports hybrid join.

Plan for change - Update SCIM provisioning applications to use modern authentication

Type: Plan for change Service category: Provisioning Product capability: Outbound to SaaS Applications What is changing. SCIM provisioning applications that use the OAuth 2.0 Authorization Code grant will be updated to support modern authentication methods, such as OAuth 2.0 Client…

Plan for change - Switch from basic auth to workload identity based auth for SAP SuccessFactors provisioning integrations

Type: Plan for change Service category: Provisioning Product capability: Inbound to Entra ID Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra…

DocsConfigure SuccessFactors inbound provisioning in AD and Microsoft …·Configure SuccessFactors inbound provisioning in Microsoft Entra ID·Configure SAP SuccessFactors writeback in Microsoft Entra ID

Configure SuccessFactors inbound provisioning in AD and Microsoft Entra ID Learn how to configure inbound provisioning from SuccessFactors

Public Preview - Microsoft Entra ID federation with External ID (EEID)

Type: Public Preview Service category: B2C - Consumer Identity Management Product capability: 3rd Party Integration Microsoft Entra ID federation with External ID (EEID) enables organizations to let users sign in to customer‑facing applications using their existing workforce Entra ID identities…

DocsAdd Microsoft Entra ID for customer sign-inNew

Add Microsoft Entra ID for customer sign-in Learn how to configure a Microsoft Entra ID tenant as an OpenID Connect identity provider in Microsoft Entra External ID, enabling users to sign in using their existing organizational accounts.

Public Preview - App-based branding via Branding themes in Microsoft Entra tenants

Type: Public Preview Service category: User Experience and Management Product capability: User Authentication In Microsoft Entra tenants, customers can create a single, tenant-wide, customized branding experience that applies to all apps. We are introducing a concept of Branding "themes" to…

Public Preview - Account Discovery

Type: Public Preview Service category: Provisioning Product capability: 3rd Party Integration Microsoft Entra ID Governance now supports account discovery for connected applications in public preview. This capability provides administrators with visibility into all accounts that exist within connected applications, including…

Docshttps://aka.ms/accountDiscoveryDocumentation

Public Preview - $count filtering in sign-ins API

Type: Public Preview Service category: MS Graph Product capability: Monitoring & Reporting The ability to use $count in sign-ins API requests is now here, allowing customers to perform count computations directly in API requests. For more information, see: Customize Microsoft…

DocsCustomize Microsoft Graph Responses with Query Parameters

Customize Microsoft Graph Responses with Query Parameters Discover how to use query parameters with Microsoft Graph APIs to control data retrieval and efficiently customize API responses and improve performance.

Updated security baseline for Microsoft Edge v139

Microsoft Edge version 139 security baseline is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for the Microsoft Edge browser and is the latest available Edge security baseline in Intune. The Edge v139 security…

DocsConfigure security baseline policies in Microsoft Intune·Post Security baseline for Microsoft Edge version 139·Settings list for the Microsoft Edge security baseline in Intune

Configure security baseline policies in Microsoft Intune Deploy security baselines that establish a default and recommended security postures on Windows devices you manage with Microsoft Intune.

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Harvey AI by Harvey AI Corporation (iOS) Continia Expense App by Continia Software A/S For more information about protected apps, see Microsoft Intune protected apps .

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

Updated minimum version for Intune Management Extension on Windows

Windows devices managed by Intune need to run Intune Management Extension version 1.58.103.0 or later. Devices on earlier versions no longer receive configurations or updates that depend on the Intune Management Extension, including Win32 app deployments, PowerShell scripts…

Support for Ubuntu 26.04 LTS

Microsoft Intune now supports Ubuntu 26.04 LTS. Support for Ubuntu 22.04 LTS ends in August 2026. Devices already enrolled on Ubuntu 22.04 remain enrolled, but you should notify users to upgrade to a supported Ubuntu version. You can…

DocsLinux device enrollment guide for Microsoft Intune

Linux device enrollment guide for Microsoft Intune Enroll Linux devices in Intune using the Intune app. Set an overview of the administrator and end user tasks to enroll devices.

New remote actions to suspend and restore Managed Home Screen on Android devices

Intune has two new remote actions that allow admins to temporarily suspend and restore Managed Home Screen (MHS) on Android devices. These actions let users exit MHS and access the device's default launcher for a defined period, without…

DocsDevice Action: Suspend Managed Home ScreenUpdated·Device Action: Restore Managed Home ScreenUpdated

Device Action: Suspend Managed Home Screen Learn how to suspend the Managed Home Screen with Microsoft Intune.

Microsoft Intune supports userless ADE for visionOS and tvOS devices

Microsoft Intune has added support for userless Apple automated device enrollment (ADE) for visionOS and tvOS devices, enabling you to enroll and manage Apple Vision Pro and Apple TV through Apple Business Manager or Apple School Manager. This…

DocsOverview of Apple Automated Device Enrollment for iOS/iPadOS in IntuneNew·Create a policy using settings catalog in Microsoft IntuneNew·Device Actions - Wipe, Lock, Locate, and MoreNew

Overview of Apple Automated Device Enrollment for iOS/iPadOS in Intune Learn about automated device enrollment (ADE) for Apple mobile devices in Microsoft Intune, including supported scenarios, key features, and how to get started.

Expanded support for Endpoint Privilege Management support approved elevation requests

Intune's Endpoint Privilege Management (EPM) now supports support approved elevation requests from all users of a device. This update expands the utility of support approved file elevations and helps to improve scenarios that involve shared devices. Previously, file…

DocsUse EPM support approvals for file elevation requests with Intune

Use EPM support approvals for file elevation requests with Intune Manage support approvals for elevation requests when you use Endpoint Privilege Management for Microsoft Intune.

Direct Android line-of-business app management

You can now manage Android line-of-business (LOB) apps directly in Microsoft Intune without publishing them to Managed Google Play on Android Enterprise corporate-owned fully managed (COBO) and dedicated (COSU) devices. With direct LOB app management, admins can upload…

DocsAdd an Android Line-of-Business App to Microsoft Intune

Add an Android Line-of-Business App to Microsoft Intune Learn about how to add a Android line-of-business (LOB) app to Microsoft Intune.

Configure credential manager permissions for Android Enterprise devices

You can now control which applications act as system-level credential providers on managed Android Enterprise devices running Android 14 and higher. Credential providers are responsible for password autofill and passkey storage. To configure credential manager permissions, go to…

DocsConfigure Managed Android Apps with Microsoft IntuneNew

Configure Managed Android Apps with Microsoft Intune Use Microsoft Intune app configuration policies to supply settings to Managed Google Play, Android LOB, and AOSP referenced apps on managed devices.

Block location setting for Android Enterprise can keep Location services enabled

On Android Enterprise devices, you can use the General > Block location in the settings catalog to disable the location services on the device and prevent users from turning it on. This setting is now called Location and…

DocsAndroid settings catalog in Microsoft Intune

Android settings catalog in Microsoft Intune Review Android settings available in the Microsoft Intune settings catalog, including supported enrollment types, values, defaults, and requirements.

Autopatch update risk visibility report

The Autopatch update risk visibility report extends the security update status dashboard with granular insight into patch compliance and risk across your managed devices. It classifies devices as Current , Exposed , or Critical and highlights policies contributing…

DocsProtect your estate: Reassess your Windows update policies

Access management for Apple services

You can now use Apple access management settings in Apple Business Manager and Apple School Manager to configure service access for Apple accounts on organization-owned devices. These controls let you choose what devices users can sign in to…

DocsConfigure Apple account service access

Configure Apple account service access Use Apple access management settings to control how Apple accounts are used on organization‐owned devices managed by Microsoft Intune.

New reporting considerations for compliance policies

New guidance has been added to the Microsoft Intune compliance policy reporting documentation to help explain how device compliance results appear in Intune reports. This update clarifies expected reporting behavior related to device check-in timing and user association…

DocsMonitor results of your device compliance policies in Microsoft Intune

Monitor results of your device compliance policies in Microsoft Intune Use the device compliance dashboard to understand overall device compliance the per policy and per setting device compliance results.

Support for Android XR devices

Microsoft Intune now supports management of Android XR devices using Android Enterprise dedicated and fully managed enrollment modes. You can enroll Android XR devices, deploy apps through managed Google Play, and apply core security and compliance policies. Android…

DocsPost Microsoft Intune announces Android Enterprise management support for …

Microsoft Intune announces Android Enterprise management support for Android XR Microsoft Intune now supports the Android XR platform, including management of the Samsung Galaxy XR headset, built on Android XR platform.

New TeamViewer connector experience in Microsoft Intune

There is a new TeamViewer integration in Microsoft Intune that simplifies onboarding and improves reliability for remote assistance workflows. The new connector replaces the existing TeamViewer connector experience and provides a more streamlined experience in the Intune admin…

DocsUse the latest TeamViewer integration in Microsoft IntuneUpdated

Use the latest TeamViewer integration in Microsoft Intune Learn how to use the latest TeamViewer integration in Microsoft Intune to initiate remote assistance sessions for managed devices.

Preview the new device page in the Intune admin center (preview)

In the Intune admin center, when you go to Devices > All Devices and select a device, you can see device-specific info, like device properties. This page is redesigned and is available for you to preview. To enable…

DocsMicrosoft Intune admin center

Change Review Agent suggestions available inline in Multi Admin Approval (preview)

The Change Review Agent now provides risk-based recommendations directly in the Multi Admin Approval experience for Windows PowerShell scripts. On the My requests and All requests tabs, a new Agent Response column displays when a suggestion is available…

DocsUse Multi Admin Approval in Intune·Change Review Agent Overview

Use Multi Admin Approval in Intune Configure Multi Admin Approval to protect your tenant against the use of compromised administrative accounts in Intune.

Intune Data Warehouse (beta) connector retirement in Power BI

The Intune Data Warehouse (beta) connector v1 in Power BI is retired. If you use Power BI reports that rely on this connector, you need to transition to Intune connector v2 or the OData Feed connector before…

DocsUse the Intune Data Warehouse

Use the Intune Data Warehouse Use the Intune Data Warehouse to build reports that provide insight into your enterprise mobile environment.

Edge security update: Stable 147.0.3912.98

Microsoft released the latest Microsoft Edge for Stable (Version 147.0.3912.98) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Android 147.0.3912.87

Microsoft released the latest Microsoft Edge for Android (Version 147.0.3912.87) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 147.0.3912.86) which incorporates the latest Securi

Microsoft released the latest Microsoft Edge Stable Channel (Version 147.0.3912.86) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 147.0.3912.72) and Microsoft Edge Extended Stable C

Microsoft released the latest Microsoft Edge Stable Channel (Version 147.0.3912.72) and Microsoft Edge Extended Stable Channel (Version 146.0.3856.130) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 147.0.3912.60). (2 CVEs)

Microsoft released the latest Microsoft Edge Stable Channel (Version 147.0.3912.60). This release includes the most recent security updates from the Chromium project. Security Update Guide . This update contains the following Microsoft Edge specific security fixes: CVE-2026-33118 CVE-2026-33119

DocsSecurity Update Guide·CVE-2026-33118·CVE-2026-33119

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 146.0.3856.97) which incorporates the latest Securi (1 CVE)

Microsoft released the latest Microsoft Edge Stable Channel (Version 146.0.3856.97) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-5281 has an exploit in the wild, and this update contains a fix for it…

DocsCVE-2026-5281·Security Update Guide

General availability of container security capabilities in Azure Government cloud

April 1, 2026 The service helps U.S. federal and government agencies, including the Department of Defense (DoD) and civilian agencies, secure Kubernetes workloads by providing cloud security posture management, vulnerability assessment, and runtime threat protection for containerized environments. The Defender…

DocsContainers support matrix in Defender for CloudUpdated·Introduction to Microsoft Defender for Containers

Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

General availability of Defender for Storage integration in Azure portal Storage Center

April 20, 2026 This integration brings Defender for Storage insights directly into the native storage management experience. This approach makes it easier for customers to understand and improve their storage security posture at scale. Customers can now view Defender for…

DocsAbout Blob (object) storage

About Blob (object) storage Azure Blob storage stores massive amounts of unstructured object data, such as text or binary data. Blob storage also supports Azure Data Lake Storage for big data analytics.

Defender for Containers runtime protection on EKS Bottlerocket is now generally available

April 30, 2026 Defender for Containers runtime protection now supports AWS Bottlerocket operating systems on Amazon Elastic Kubernetes Service (EKS) in general availability. Learn more about Defender for Containers runtime protection .

DocsContainers support matrix in Defender for CloudUpdated

Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

DNS Detection for Kubernetes is now generally available

April 30, 2026 DNS Detection for Kubernetes is now generally available in Defender for Containers for Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes Engine (GKE). DNS Detection monitors DNS queries from containerized workloads to detect…

DocsContainers support matrix in Defender for CloudUpdated

Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.

Anti-malware detection and blocking is now generally available

April 30, 2026 Container runtime anti-malware detection and blocking is now generally available in Defender for Containers for Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes Engine (GKE). Anti-malware detection and blocking detects and blocks malware…

DocsContainer runtime antimalware detection and blocking

Container runtime antimalware detection and blocking Learn how to configure container runtime antimalware detection and blocking to block or alert on malware in Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) environments.

Update to Defender for SQL servers on machines plan for Fairfax customers

April 1, 2026 The Defender for SQL Server on machines plan in Microsoft Defender for Cloud protects SQL Server instances hosted on Azure, AWS, GCP, and on-premises machines. To simplify onboarding and improve protection coverage, we're releasing an enhanced agent…

DocsUpdate Defender for SQL Servers on Machines Configuration for …Updated·Verify SQL Machine ProtectionUpdated·Troubleshoot Defender for SQL on Machines ConfigurationUpdated

Update Defender for SQL Servers on Machines Configuration for Automatic Registration Learn how to update the Defender for SQL Servers on Machines configuration to enable automatic registration for Azure VMs, on-premises, and hybrid environments.

Remove users from Teams chats is generally available

Remove users from Teams chats is generally available : The ability to remove internal users from Teams chats in the Teams message entity panel is now generally available.

DocsInvestigate Teams Messages in Microsoft Defender for Office 365New

Investigate Teams Messages in Microsoft Defender for Office 365 Describes the Teams message entity panel for Microsoft Teams in Microsoft Defender for Office 365, how it does post-breach work like ZAP and Safe Links and gives admins a single pane of glass on Teams chat and channel threats like…

Security Copilot email summary on the Email entity page

Security Copilot email summary on the Email entity page : If you have a Microsoft Security Copilot subscription, you can generate an AI summary of email entity data directly from the Email entity page by selecting the Copilot action.

DocsThe Email entity page in Defender for Office 365Updated·Get started with Microsoft Security Copilot

The Email entity page in Defender for Office 365 Admins can learn about the Email entity page in Microsoft Defender for Office 365. This page shows many details about email messages. For example, email headers, threat detection details, the latest and original delivery locations, delivery actions, and IDs (for…

New RBAC permission for email content associated with alerts

New RBAC permission for email content associated with alerts : A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more…

DocsThe Email entity page in Defender for Office 365Updated

The Email entity page in Defender for Office 365 Admins can learn about the Email entity page in Microsoft Defender for Office 365. This page shows many details about email messages. For example, email headers, threat detection details, the latest and original delivery locations, delivery actions, and IDs (for…

Promotions folder for bulk email (preview)

Promotions folder for bulk email (preview) : You can configure anti-spam policies to deliver bulk mail below the BCL threshold to the Promotions folder in supported versions of Outlook. For more information, see Deliver bulk mail below the BCL threshold…

DocsBulk email detectionNew

Bulk email detection Admins can learn about bulk email detection, including the bulk complain level (BCL) values that are used in Microsoft 365.

Shared capabilities

General availability (GA) : Export policy configuration as a ZIP file containing a point-in-time snapshot of all policy configurations in XML format for DLP and sensitivity label publishing policies. Use the export for support requests, configuration reference, and local analysis…

DocsExport policy configuration in Microsoft Purview

Export policy configuration in Microsoft Purview Learn how to export your Microsoft Purview policy configuration as a ZIP file for support requests, configuration backup, and policy analysis.

Sensitivity labels

General availability (GA) : Auto-labeling policies introduce a new flow where you must decide whether to automatically apply a sensitivity label, or remove a label when the configured conditions apply for files in SharePoint and OneDrive. When you chose to…

DocsAutomatically apply a sensitivity label to Microsoft 365 dataNew·Enable sensitivity labels for files in SharePoint and OneDriveNew·Enable co-authoring for encrypted documentsUpdated·Export policy configuration in Microsoft Purview

Automatically apply a sensitivity label to Microsoft 365 data When you create a sensitivity label, you can automatically assign a label to data stored in Microsoft 365, or you can prompt users to select the label that you recommend.

Developers

Documentation update: Added Scenarios and API overview section. This new section helps developers identify which APIs to use for specific scenarios. For more information, see Scenarios and API overview .

DocsOverview of Microsoft Purview APIs - purview-sdk

Overview of Microsoft Purview APIs - purview-sdk Use Microsoft Purview APIs in Microsoft Graph to build secure, compliant applications (AI, line-of-business, SaaS) with data loss prevention and governance.

Data Loss Prevention

Updated : Restructured the just-in-time (JIT) protection documentation. Updated : The Get started with just-in-time protection article now focuses on deployment and configuration steps. New : A new conceptual article, Learn about just-in-time protection , now covers JIT concepts, terms…

DocsData Loss Prevention policy referenceNew·Learn about Endpoint DLP just-in-time protection·Get started with Endpoint DLP Just-in-time protection·Data loss prevention policy tip reference for Outlook for Android, …

Data Loss Prevention policy reference DLP policy component and configuration reference. This article provides a detailed anatomy of a DLP policy.

Data Lifecycle Management

New : Newly created Teams call data records (often abbreviated to CDRs, and sometimes also called call detail records or just call records ) are no longer included with Teams chat retention policies. Instead, they are included in the new…

DocsAutomatically retain or delete content by using retention policiesUpdated

Automatically retain or delete content by using retention policies Use a retention policy to efficiently keep control of the content that users generate with email, documents, conversations, and call logs. Keep what you want and get rid of what you don't.

Collection Policies

Preview : Collection policies support sensitivity labels as a condition for scoping detection to items with specific sensitivity labels applied. This condition is supported with browser and network cloud apps detection.

DocsCollection policies policy referenceUpdated

Collection policies policy reference Collection policy component and configuration reference. This article provides a detailed anatomy of a collection policy.

eDiscovery

In preview : Organizations using Customer Key can now enable customer-managed key (CMK) encryption for direct export packages in eDiscovery. When enabled, exported investigation data is encrypted at rest using tenant-specific encryption scopes backed by customer-managed keys. Updated : The…

DocsExport search results in eDiscoveryUpdated·Set up Customer Key·Limits in eDiscovery·Search content in a review set with the Advanced review set explorer …

Export search results in eDiscovery Learn about exporting search results for a case in eDiscovery in the Microsoft Purview portal.

Insider Risk Management

In preview : Preview content while triaging alerts to quickly identify false positives, confirm the presence of sensitive data, and decide whether the alert warrants escalation.

DocsInvestigate Microsoft Purview Insider Risk Management activities

Investigate Microsoft Purview Insider Risk Management activities Learn how to investigate and triage Insider Risk Management alerts in Microsoft Purview. Review risk factors, explore activities, and create cases.

Data Security Posture Management (preview)

New : Microsoft Sentinel with partner solutions now also supports Varonis to provide holistic data insights for Salesforce.

DocsSetup tasks for Microsoft Purview Data Security Posture Management

Setup tasks for Microsoft Purview Data Security Posture Management Learn about the setup tasks in Microsoft Purview Data Security Posture Management to help you discover, protect, and investigate data across your digital environments.

Data Security Investigations

In preview : Proactive AI insights from Data Security Posture Management (DSPM) automatically create and refresh a single investigation for your tenant every 24 hours. The DSPM exfiltration objective card displays risk counts across five fixed categories, giving security teams…

DocsAssign permissions in Data Security Investigations·Create an investigation in Data Security Investigations

Assign permissions in Data Security Investigations Assign permissions in Data Security Investigations to enable access to Microsoft Purview features. Learn how to configure roles and role groups effectively.

Data Governance

In preview : Use a one-time glossary migration and asset enablement process to curate data assets and columns with glossary terms. This process allows you to centralize the management of glossary terms by migrating glossary terms created in the classic…

DocsMigrate Classic Glossary Terms and Enable Asset Curation in Unified …·Create and Manage Glossary Terms in Unified Catalog·Create and Manage Data Products in Unified Catalog·Critical Data Elements in Unified Catalog (Preview)

Migrate Classic Glossary Terms and Enable Asset Curation in Unified Catalog (Preview) Learn how to migrate glossary terms (preview) created in the classic Microsoft Purview governance portal to Microsoft Purview Unified Catalog. This process allows you to curate data assets and columns in Unified Catalog.