What's new in Microsoft Security: May 2026
Every Microsoft Security update in May 2026: 105 documentation changes and 30 official posts across Sentinel, Defender, Entra, Intune, Purview and Security Copilot, with GA and preview releases, retirements and links to the sources.
Announcements
Exposure Management
Introducing the updated exposure score in Microsoft Defender Vulnerability Management
We are introducing an updated exposure score model in Microsoft Defender Vulnerability Management, now available in public preview.
Microsoft Defender Vulnerability Management BlogMicrosoft Security
Malicious npm packages abuse dependency confusion to profile developer environments
A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments.
Microsoft Security BlogMicrosoft Security
Microsoft is named a Leader in the 2026 Gartner® Magic QuadrantTM for Endpoint Protection
Microsoft is named a Leader in the 2026 Gartner® Magic QuadrantTM for Endpoint Protection.
Microsoft Security BlogMicrosoft Security
Typosquatted npm packages used to steal cloud and CI/CD secrets
The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environments.
Microsoft Security BlogIntune
What’s new in Microsoft Intune – May
Whether it's Android app deployment, identity setup on macOS, certificate authority renewal, or faster compliance evaluations, the throughline is the same: less friction…
Action may be required
Microsoft Intune BlogThreat Intelligence
The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
Microsoft Threat Intelligence presents a comprehensive analysis of The Gentlemen, a Go-based ransomware deployed by affiliates of Storm-2697 that combines per-file…
Microsoft Threat IntelligenceExposure Management
How to exclude specific CVEs with CVE exceptions in Microsoft Defender Vulnerability Management
Not every CVE should be handled the same way, and choosing the wrong exception type can remove more risk visibility than intended.
Microsoft Defender Vulnerability Management BlogSentinel
Microsoft Security Community Spotlight: Marcel Graewer
Globally, Marcel shares practical detection engineering insights on Microsoft Sentinel and Microsoft Defender XDR through forums and blog posts.
Microsoft Security Community BlogDefender XDR
Organize your multitenant view with Tenant Groups in Microsoft Defender
Managing security across many tenants shouldn’t mean drowning in a single, flat list.
Microsoft Defender XDR BlogThreat Intelligence
From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots.
Microsoft Security BlogMicrosoft Security
Microsoft recognized as a Leader in The Forrester WaveTM for Workforce Identity Security Platforms
Microsoft has been recognized as a Leader in The Forrester WaveTM: Workforce Identity Security Platforms, Q2 2026, receiving the highest scores in both the current…
Microsoft Security BlogMicrosoft Security
From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
A multi-stage attack on Linux devices began with an exposed F5 BIG-IP edge appliance and pivoted to an internal Confluence server for credential theft and identity…
Microsoft Security BlogMicrosoft Security
Microsoft Security success stories: How St. Luke’s and ManpowerGroup are securing AI foundations
How Frontier firms secure AI at scale: read how Microsoft customers embed governance, identity, and cloud security to make protection an enabler of AI growth.
Microsoft Security BlogEntra
Find shadow tenants and reduce risk fast with Microsoft Entra Tenant Governance
Get continuous visibility into related tenants and the signals behind them—so you can reduce blind spots before they turn into incidents.
Microsoft Entra BlogMicrosoft Security
What’s new in Microsoft Security: May 2026
Microsoft Security’s latest updates extend visibility, control, and protection across expanding ecosystems as organizations accelerate AI adoption.
Microsoft Security BlogSentinelPreview
The Microsoft Copilot Data Connector for Microsoft Sentinel is Now in Public Preview
*Please note that this connector is now in GA status as of March, 2026* We are happy to announce a new data connector that is available to the public…
Microsoft Sentinel BlogMicrosoft Security
Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft
Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments.
Microsoft Security BlogMicrosoft Security
Securing the gaming culture of cultures
Read about the unique challenges and rewards of securing gaming platforms and how to better protect gaming communities.
Microsoft Security BlogMicrosoft Security
Introducing RAMPART and Clarity: Open source tools to bring safety into Agent development workflow
The AI systems shipping inside enterprises today are fundamentally different from the ones we were building even two years ago, because they have moved well past…
Microsoft Security BlogDefender for CloudPreview
Public preview: Expanded coverage and unified management for SQL VA Express Configuration
SQL Vulnerability Assessment (SQL VA) is a core capability in Defender for SQL that helps customers identify possible misconfigurations, excessive permissions, and other…
Microsoft Defender for Cloud BlogPurview
Securing AI Agents End‐to‐End: Connecting Purview DSPM, Agent 365, and the AI Security Dashboard
The Challenge:Organizations deploying Microsoft Copilot and custom AI agents face a critical gap: security visibility is fragmented across data protection…
Microsoft Security Community BlogThreat Intelligence
Exposing Fox Tempest: A malware-signing service operation
Fox Tempest is a financially motivated threat actor operating a malware‐signing‐as‐a‐service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm…
Microsoft Threat IntelligenceEdge
Security Review for Microsoft Edge version 148
We have reviewed the new settings in Microsoft Edge version 148 and determined that there are no additional security settings that require enforcement.
Microsoft Security Baselines BlogThreat Intelligence
How Storm-2949 turned a compromised identity into a cloud-wide breach
Storm-2949 turned stolen credentials into a cloud-wide breach, moving from identity compromise to large-scale data theft without using malware.
Microsoft Security BlogSentinel
Migrate Sentinel to Defender - Why It Is a Security Architecture Decision, Not Just a Portal Change
Microsoft will retire the Sentinel experience in Azure on March 31, 2027.
Microsoft Security Community BlogMicrosoft Security
State Explosion Security Problem in AI-Era Software Supply Chains
Introduction To see why this problem scales so quickly, start with the smallest possible change: a single line of code.
Microsoft Security Community BlogSentinel
Agent 365 connector: Monitor, hunt, and investigate AI agent activity in Microsoft Sentinel
As enterprises scale the use of AI agents, SOC teams need visibility into AI agent behavior.
Microsoft Sentinel BlogMicrosoft Security
How to better protect your growing business in an AI-powered world
See how built-in security helps keep your growing business running, protect customer trust, and support growth.
Microsoft Security BlogDefender for Endpoint
Introducing selective response actions for high-value assets in Microsoft Defender
Deploying Microsoft Defender on high-value assets (HVAs) such as domain controllers, ADFS servers, and other Tier-0 systems, requires a thoughtful approach to balance…
Microsoft Defender for Endpoint Blog
Retirements and deprecations
All retirements| Effective | What's changing | Product | Type | Source |
|---|---|---|---|---|
| May 1, 2026passed | Plan for change – Agent Registry consolidation into Microsoft Agent 365 What’s changing The Agent registry and Agent collections blades in the Entra admin center will be retired on May 1, 2026. Action may be required | Entra | Retirement | Microsoft Learn |
| November 2026passed | Public Preview - Workload identity-based authentication for SAP SuccessFactors provisioning integrations This change helps customers transition to a more secure authentication model in preparation for SAP’s plan to deprecate basic authentication for SuccessFactors APIs by November 2026 . Action may be required | Entra | Deprecation | Microsoft Learn |
| —not stated | Additional information [Update to support statement for Windows 10 in Intune] Stay secure with Windows 11, Copilot+ PCs, and Windows 365 before support ends for Windows 10 Windows 10 reaching end of support Enable Extended Security Updates … | Intune | Retirement | Microsoft Learn |
| —not stated | General availability of individual recommendations for Defender for Cloud in Azure portal and deprecation of legacy grouped recommendations General availability of individual recommendations for Defender for Cloud in Azure portal and deprecation of legacy grouped recommendations. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Non-FIPS compliant signing keys (P-256K) retirement Non-FIPS compliant signing keys (P-256K) retirement. | Entra | Retirement | Microsoft Learn |
Microsoft Sentinel
2 changes · product page- GA
Generate playbooks using AI in Microsoft Sentinel is now generally available (GA)
You can now generate playbooks using AI in Microsoft Sentinel . The SOAR playbook generator creates python based automation workflows coauthored through a conversational experience with Cline, an AI coding agent. For more information, see the Playbook Generation blog post…
DocsGenerate playbooks using AI in Microsoft Sentinelthe Playbook Generation blog post
Generate playbooks using AI in Microsoft Sentinel Generate playbooks through natural language conversations directly in the Defender portal.
- New feature
UEBA enhancements: New settings experience, Okta V2 support, and more GCP anomaly detections
We introduced a new entry point and created a consolidated view for the UEBA Settings and the Behaviors Settings. You can now access the UEBA settings from the new UEBA tab in the Microsoft Sentinel settings page. For more information…
DocsEnable entity behavior analytics to detect advanced threatsMicrosoft Sentinel User and Entity Behavior Analytics (UEBA) referenceAnomalies detected by the Microsoft Sentinel machine learning engine
Enable entity behavior analytics to detect advanced threats Enable User and Entity Behavior Analytics in Microsoft Sentinel, and configure data sources
Posts this month: Microsoft Security Community Spotlight: Marcel Graewer · The Microsoft Copilot Data Connector for Microsoft Sentinel is Now in Public Preview · Migrate Sentinel to Defender - Why It Is a Security Architecture Decision, Not Just a Portal Change · Agent 365 connector: Monitor, hunt, and investigate AI agent activity in Microsoft Sentinel
Microsoft Defender XDR
5 changes · product page- New feature
The hunting graph in advanced hunting now includes new identity-focused predefined scenarios. These scenarios
The hunting graph in advanced hunting now includes new identity-focused predefined scenarios. These scenarios help you discover attack paths, privilege escalation routes, and credential access risks across on-premises and cloud environments, including Kerberoast and AS-REP roast paths, domain compromise routes…
DocsHunting graph in Microsoft Defender advanced huntingUpdated
Hunting graph in Microsoft Defender advanced hunting Learn how to use the hunting graph in Microsoft Defender XDR advanced hunting to visualize threat scenarios as interactive graphs and trace attack paths.
- New feature
Take action
In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results. Learn more .
DocsTake action on advanced hunting results in Microsoft Defender XDR
Take action on advanced hunting results in Microsoft Defender XDR Learn how to take response actions on devices, identities, files, and emails directly from advanced hunting query results in Microsoft Defender XDR.
- New feature
Microsoft Defender Experts for Servers
Microsoft Defender Experts for Servers and Microsoft Defender Experts Hunting - Servers are now offered as standalone offerings for customers who wish to avail managed extended detection and response and threat hunting services for their on-premises and multicloud servers protected…
DocsMicrosoft Defender Experts for Servers overview
Microsoft Defender Experts for Servers overview Learn about Microsoft Defender Experts for Servers, a managed detection and response service for on-premises and multicloud server workloads.
- Preview
Defender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender. It helps SO
Defender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender. It helps SOC analysts investigate threats, explore incidents, and answer security questions in plain language, without needing to navigate multiple screens or write complex queries.
DocsMicrosoft Security Copilot and Chat in Microsoft DefenderUpdated
Microsoft Security Copilot and Chat in Microsoft Defender Learn about Microsoft Security Copilot capabilities in Microsoft Defender. Use natural language to investigate threats, analyze scripts, and get AI-powered incident summaries.
- Preview
(Preview) Automatic attack disruption can now isolate compromised devices from the network when high-confidenc
(Preview) Automatic attack disruption can now isolate compromised devices from the network when high-confidence incident analysis indicates the device is being used as an active foothold. Isolation blocks attacker communication and lateral movement while keeping the device connected to security…
DocsTake response actions on a device in Microsoft Defender for EndpointUpdatedAutomatic attack disruption in Microsoft Defender
Take response actions on a device in Microsoft Defender for Endpoint Respond to attacks on a device in Microsoft Defender for Endpoint by isolating it, collecting an investigation package, running a scan, or restricting apps.
Posts this month: Organize your multitenant view with Tenant Groups in Microsoft Defender
Microsoft Security Exposure Management
2 changes · product page- New feature
New predefined classification
The following predefined Device classification rule was added to the critical assets list: Classification Description Senior Executive User Workstation Devices in frequent use by users classified as senior executives. This rule logic relies on the predefined critical identity classifications whose…
DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated
Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.
- Preview
Enhanced exposure score in Defender Vulnerability Management
Enhanced exposure score in Defender Vulnerability Management. The new exposure score model in Defender Vulnerability Management is now available in preview. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors…
DocsExposure score in Defender Vulnerability ManagementSecurity recommendations
Exposure score in Defender Vulnerability Management Learn how the Microsoft Defender Vulnerability Management exposure score measures your organization's vulnerability to cybersecurity threats and how to reduce it.
Posts this month: Introducing the updated exposure score in Microsoft Defender Vulnerability Management · How to exclude specific CVEs with CVE exceptions in Microsoft Defender Vulnerability Management
Microsoft Defender for Endpoint
10 changes · product page- GA
Windows release: Windows Defender Antivirus: Platform 4.18.26040.7 / Engine 1.1.26040.8
Windows release: Windows Defender Antivirus: Platform 4.18.26040.7 / Engine 1.1.26040.8. See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Defender endpoint security solution for Windows 7 SP1 and Windows Server 2008 R2 SP1
Defender endpoint security solution for Windows 7 SP1 and Windows Server 2008 R2 SP1. The Defender for endpoint security solution for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices is now generally available. The solution provides advanced…
DocsOnboard previous versions of Windows on Microsoft Defender for …Use the Microsoft Defender deployment tool for WindowsNew
Onboard previous versions of Windows on Microsoft Defender for Endpoint Onboard supported previous versions of Windows devices so that they can send sensor data to the Microsoft Defender for Endpoint sensor
- GA
Custom data collection
Custom data collection. Custom data collection is now generally available. This feature enables organizations to expand and customize telemetry collection beyond default configurations with rule-based filtering for specific events from endpoint devices. The maximum event limit per rule has been…
DocsCustom data collection in Microsoft Defender for EndpointUpdated
Custom data collection in Microsoft Defender for Endpoint Custom data collection allows organizations to tailor telemetry collection to their specific threat hunting needs with customizable filters and enhanced visibility.
- GA
Configure offline security intelligence update settings for Linux from the Defender and Intune portals
Configure offline security intelligence update settings for Linux from the Defender and Intune portals. You can now configure offline security intelligence update settings for Linux directly from the Defender and Intune portals.
DocsConfigure offline security intelligence updates for Microsoft Defender …Updated
Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux devices with limited or no internet connectivity.
- Preview
Selective Response Actions
Selective Response Actions. Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering…
DocsSelective response actions on critical assets in Microsoft Defender …
Selective response actions on critical assets in Microsoft Defender for Endpoint Learn how to onboard Tier-0 and high-value assets with restricted security operations in Microsoft Defender for Endpoint to reduce operational risk.
- Preview
Schedule antivirus scans on Linux
Schedule antivirus scans on Linux. You can now configure scheduled antivirus scans on Microsoft Defender for Endpoint on Linux. Scheduled scans support hourly quick scans, interval-based quick scans, and weekly full scans, with options for low-priority execution, idle-time scheduling, and…
DocsSchedule Microsoft Defender for Endpoint antivirus scans on Linux
Schedule Microsoft Defender for Endpoint antivirus scans on Linux Learn how to schedule Microsoft Defender for Endpoint antivirus scans on Linux using the Microsoft Defender portal, Microsoft Intune, managed JSON, or the command line.
- Preview
Automatic device isolation (automatic attack disruption)
Automatic device isolation (automatic attack disruption). Microsoft Defender for Endpoint can now automatically isolate compromised devices as part of automatic attack disruption . Isolation blocks most network traffic while keeping the device connected to security services. The action is time-limited…
DocsTake response actions on a device in Microsoft Defender for EndpointUpdatedAutomatic attack disruption in Microsoft Defender
Take response actions on a device in Microsoft Defender for Endpoint Respond to attacks on a device in Microsoft Defender for Endpoint by isolating it, collecting an investigation package, running a scan, or restricting apps.
- Release
iOS · May 2026 · Platform Version: 1.1.77130101
Release details Platform version Release Date 1.1.77130101 May 15, 2026 Enhancements and features Feature Area Update Summary Fixes Fixed unexpected hang in Control Filter. Improvements Performance improvements and general bug fixes. Telemetry Enhanced telemetry for onboarding events.
- Release
Windows Antivirus · May 2026 · Platform 4.18.26050.15 · Engine 1.1.26050.11
Release details Component Version Date Platform 4.18.26050.15 June 9, 2026 Engine 1.1.26050.11 June 9, 2026 Security intelligence 1 1.453.4.0 June 9, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Release
Android · May 2026 · Platform: 1.0.8913.0101
Release details Platform version Release Date 1.0.8913.0101 May 18, 2026 Enhancements and features Feature Area Update Summary Feature Enhancements Android malware scanning now covers system apps, along with the existing support for installed apps. General Performance improvements and general bug…
Posts this month: Introducing selective response actions for high-value assets in Microsoft Defender
Microsoft Defender for Identity
5 changes · product page- New feature
Sensor v3.x supports all identity roles on domain controllers
Defender for Identity sensor v3.x now supports domain controllers running all identity roles, including Microsoft Entra Connect, AD FS, and AD CS identity roles. For deployment details, see Defender for Identity sensor v3.x prerequisites .
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
- New feature
New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Guest user account promoted to member User was created and assigned to Global Administrator role Failed credential abuse attempt in Entra…
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- New feature
Known limitation: Migration of domain controllers with Windows Server 2025 from sensor v2.x to sensor v3.x is not supported
When announced in May 2026, migration of Windows Server 2025 domain controllers from sensor v2.x to sensor v3.x wasn't supported. This limitation was resolved in July 2026. See Windows Server 2025 migration support and the current migration requirements .
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- New feature
Increased sensor capacity
Defender for Identity now supports up to 1,000 sensors per workspace, increased from the previous limit of 350. To add more than 1,000 sensors, contact Defender for Identity support.
- New feature
Defender for Identity sensor updates
Version number Updates 2.255.19247.44775 This sensor update adds properties to Group Policy (GPO) event collection and includes bug fixes.
Microsoft Entra
19 changes · product page- GA
Microsoft Entra ID account recovery
Microsoft Entra ID account recovery : Microsoft Entra ID account recovery with Verified ID is now generally available. For more information, see plan your verification solution .
DocsPlan your Microsoft Entra Verified ID verification solution
Plan your Microsoft Entra Verified ID verification solution Learn foundational information to plan and design your verification solution.
- GA
General Availability - System-preferred authentication expanded to first-factor in Microsoft Entra ID
Type: General Availability Service category: MFA Product capability: Identity Security & Protection We're extending system-preferred authentication to apply to the first factor in Microsoft-managed configurations (in addition to second factor). With this change, the system evaluates the credentials registered for…
- GA
General Availability - Support for passkeys in Microsoft Entra ID registration campaign
Type: General Availability Service category: MFA Product capability: Identity Security & Protection Microsoft Registration Campaigns now supports Passkeys (FIDO2) as an authentication method. Administrators can configure registration campaigns to nudge users to register passkeys during sign-in, helping organizations drive passkey…
- GA
General Availability - NetBiosName resolution test now informational
Type: Changed feature Service category: Entra Connect Product capability: Entra Connect The “NetBIOS Name Sysvol Connectivity resolution” test in the AD DS health monitoring agent has been reclassified from an alerting test to an informational test. Going forward, if this…
- GA
General Availability - Modernized My Account pages
Type: Changed feature Service category: Modernized My Account pages Product capability: End User Experiences We're excited to announce the upcoming general availability of three redesigned pages in the My Account portal (myaccount.microsoft.com), bringing a modernized experience to help end users…
- GA
General Availability - Manage Agent ID sponsorship lifecycle with Lifecycle Workflows
Type: General Availability Service category: Lifecycle Workflows Product capability: Identity Governance One of the most important parts of governing agent identities is making sure that a delegated human user is always assigned to make sure the agent identity's access to…
DocsAgent identity sponsor tasks in Lifecycle Workflows
Agent identity sponsor tasks in Lifecycle Workflows This article describes workflow tasks that involve sponsors of agent identities.
- GA
General Availability - High Scale Compatibility (HSC) mode for Microsoft Entra External ID
Type: General Availability Service category: B2C - Consumer Identity Management Product capability: B2B/B2C High Scale Compatibility (HSC) mode enables organizations to migrate to Microsoft Entra External ID while preserving their existing user directory . It's designed for large, established customer…
DocsEnable External ID High Scale Compatibility (HSC) mode
Enable External ID High Scale Compatibility (HSC) mode Enable HSC mode on your Azure AD B2C tenant to adopt Microsoft Entra External ID endpoints while keeping existing users and credentials in place.
- GA
General Availability - Cross tenant group synchronization
Type: General Availability Service category: Provisioning Product capability: Identity Lifecycle Management Cross tenant group synchronization allows organizations to synchronize security groups across Microsoft Entra tenants. This feature enables centralized management of group membership in a source tenant while making those…
DocsWhat is cross-tenant synchronization in Microsoft Entra ID?New
What is cross-tenant synchronization in Microsoft Entra ID? Learn about cross-tenant synchronization in Microsoft Entra ID.
- GA
General Availability - Account Discovery
Type: General Availability Service category: Provisioning Product capability: 3rd Party Integration Account discovery for connected applications is now generally available in Microsoft Entra ID Governance. This capability provides administrators with visibility into all accounts that exist within connected applications, including…
- New feature
Upcoming change - Enhanced admin authorization for Microsoft Entra Connect Sync configuration changes
Type: Changed feature Service category: Entra Connect Product capability: Entra Connect We're enhancing the security posture of Microsoft Entra Connect Sync by introducing interactive admin authorization for configuration changes. With this update, an authorized administrator will need to sign in…
DocsMicrosoft Entra Connect: Version release historyNewMicrosoft Entra Connect
Microsoft Entra Connect: Version release history This article lists all releases of Microsoft Entra Connect and Azure AD Sync.
- New feature
IDV partner gallery: 2 new Security Store partners
IDV partner gallery: 2 new Security Store partners : Added 1Kosmos and CLEAR to the IDV partner gallery as Security Store integration partners.
DocsMicrosoft Entra Verified ID - IDV partner galleryNew1KosmosCLEAR
Microsoft Entra Verified ID - IDV partner gallery Explore Microsoft Entra Verified ID identity verification partners and integrations for remote onboarding, secure access, and account recovery.
- New feature
Face Check device security FAQ
Face Check device security FAQ : Added frequently asked questions about device security requirements for Face Check on Android and iOS devices.
DocsTutorial - Use Face Check with Microsoft Entra Verified ID
Tutorial - Use Face Check with Microsoft Entra Verified ID Learn how to set up and use Face Check with Microsoft Entra Verified ID for high-assurance facial matching verifications that protect user privacy at enterprise scale.
- New feature
Expanded policy storage for passkeys (FIDO2) in Microsoft Entra ID
Type: Changed feature Service category: Authentications (Logins) Product capability: User Authentication We increased the passkey (FIDO2) policy size limit in the authentication methods policy to a dedicated 20-KB allocation. Previously, all authentication methods shared a single 20-KB policy size limit…
- Preview
Public Preview - Workload identity-based authentication for SAP SuccessFactors provisioning integrations
Type: New feature Service category: Provisioning Product capability: Inbound to Entra ID Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload…
DocsConfigure SuccessFactors inbound provisioning in AD and Microsoft …Configure SuccessFactors inbound provisioning in Microsoft Entra IDConfigure SAP SuccessFactors writeback in Microsoft Entra IDhttps://aka.ms/EntraSAPSFConnectivityGuide
Configure SuccessFactors inbound provisioning in AD and Microsoft Entra ID Learn how to configure inbound provisioning from SuccessFactors
- Preview
Public Preview - Sensitivity labels for Microsoft Entra security groups
Type: New feature Service category: Group Management Product capability: Platform Microsoft Entra ID now supports applying Microsoft Purview sensitivity labels to Entra cloud security groups in public preview. Administrators can use labels to govern security group settings such as guest…
- Preview
Public Preview - Enable soft-delete for Microsoft Entra Device objects
Type: New feature Service category: Device Access Management Product capability: Entra Backup and Recovery Device Soft Delete, now available in preview, enables administrators to safely remove device objects by moving them to a recoverable state instead of permanently deleting them…
- Preview
Public Preview - Azure Role assignments can now be governed via Entitlement Management
Type: New feature Service category: Entitlement Management Product capability: Identity Governance You can now govern eligible and active assignments to Azure roles at the Management Group, Subscription, and Resource Group levels directly through access packages. This brings role assignment into…
- Preview
Public Preview - Automate setting or clearing user attributes values in Lifecycle workflows
Type: New feature Service category: Lifecycle Workflows Product capability: Identity Governance We're excited to introduce the User Attribute Updates task in Lifecycle Workflows, extending existing attribute change trigger capabilities with a built-in, customer-ready way to automate attribute updates (set or…
- Retirement
Non-FIPS compliant signing keys (P-256K) retirement
Non-FIPS compliant signing keys (P-256K) retirement : Non-FIPS compliant signing keys (P-256K) will be retired on July 1, 2026. If you haven't already, upgrade your signing keys to become FIPS compliant.
Upgrade signing keys Learn how to upgrade Microsoft Entra Verified ID signing keys to become FIPS compliant.
Posts this month: Find shadow tenants and reduce risk fast with Microsoft Entra Tenant Governance
Microsoft Intune
33 changes · product page- New feature
Intune RBAC roles have access to Copilot in Intune
When Microsoft Intune is enabled as a data source in Security Copilot, by default: The Microsoft Entra ID Intune Administrator role automatically inherits Security Copilot owner access to Copilot in Intune. All the other built-in and custom…
DocsSecurity Copilot in Intune features overviewUnderstand authentication in Microsoft Security Copilot
Security Copilot in Intune features overview Microsoft Security Copilot in Intune is an AI platform. It can help you create policies, get information about existing policies, and show more details on specific settings, including their impacts on users and devices. You can also use Copilot to…
- New feature
Guidance for device-reported values in compliance reports
We updated documentation to clarify how to interpret device-reported values in compliance reports. Some compliance reports include a Setting column with values reported directly by the device, providing additional context for noncompliance in scenarios such as custom compliance…
DocsMonitor results of your device compliance policies in Microsoft Intune
Monitor results of your device compliance policies in Microsoft Intune Use the device compliance dashboard to understand overall device compliance the per policy and per setting device compliance results.
- New feature
Complete Platform SSO registration during macOS Automated Device Enrollment
On macOS devices enrolled with Automated Device Enrollment (ADE), you can run Platform SSO during device registration. Before you enroll, you: Create an Intune settings catalog policy and configure the Enable Registration During Setup setting. Deploy the Company…
DocsCreate a policy using settings catalog in Microsoft IntuneNewAdd Platform SSO policy to ADE Profile on macOS devices
Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…
- New feature
How does this change affect you or your users?
[Intune moving to support Android 10 and later for user-based management methods in October 2024] For user-based management methods (as listed above), Android devices running Android 9 or earlier won't be supported. For devices on unsupported Android OS versions: Intune…
- New feature
How does this change affect you or your users?
[Plan for Change: Implement strong mapping for SCEP and PKCS certificates] These changes will affect SCEP and PKCS certificates delivered by Intune for Microsoft Entra hybrid joined users or devices. If a certificate can't be strongly mapped, authentication will be…
DocsPost Support tip: Implementing strong mapping in Microsoft Intune …
Support tip: Implementing strong mapping in Microsoft Intune certificates Learn more about implementing strong mapping in Microsoft Intune certificates.
- New feature
How does this change affect you or your users?
[Plan for change: Intune is moving to support macOS 15 and higher later this year] This change only affects you if you currently manage, or plan to manage, macOS devices with Intune. If your users have likely already upgraded their…
- New feature
How does this change affect you or your users?
[Plan for Change: Intune is moving to support iOS/iPadOS 18 and later] If you're managing iOS/iPadOS devices, you might have devices that won't be able to upgrade to the minimum supported version (iOS 18/iPadOS 18). Given that Microsoft 365 mobile…
- New feature
How does this change affect you or your users?
[Plan for Change: New settings for Apple AI features; Genmojis, Writing tools, Screen capture] If you configured the APP "Send Org data to other apps" setting to a value other than "All apps", then the new "Genmoji", "Writing Tools" and…
DocsiOS/iPadOS App Protection Policy Settings
iOS/iPadOS App Protection Policy Settings This article describes the iOS/iPadOS app protection policy (APP) settings for iOS/iPadOS devices.
- New feature
How does this change affect you or your users?
[Update to the latest Intune App SDK and Intune App Wrapper for Android 15 support] If you have applications using the Intune App SDK or Intune App Wrapping Tool for Android, it's recommended that you update your app to the…
- New feature
How does this change affect you or your users?
[Warning notifications for iOS apps running unsupported SDK versions] Users running iOS apps with an Intune MAM SDK version lower than 20.8.0 will see a warning message. The warning will appear in iOS apps such as Microsoft Teams, Outlook, Edge…
- New feature
How does this change affect you or your users?
[Update firewall configurations to include new Intune network endpoints] If you've configured an outbound traffic policy for Intune IP address ranges or Azure service tags for your firewalls, routers, proxy servers, client-based firewalls, VPN, or network security groups, you'll need…
- New feature
How does this change affect you or your users?
[Plan for Change: Blocking screen capture in the latest Intune App SDK for iOS and Intune App Wrapping Tool for iOS] For apps that have updated to the latest Intune App SDK or Intune App Wrapping Tool versions screen capture…
DocsConfiguration Policies for Intune App SDK Managed Apps
Configuration Policies for Intune App SDK Managed Apps Learn how to configure policies for Intune App SDK managed apps.
- New feature
How does this change affect you or your users?
[Update to the latest Intune Company Portal for Android, Intune App SDK for iOS, and Intune App Wrapper for iOS] If your users haven't updated to the latest Microsoft or third-party app protection supported apps, they'll be blocked from launching…
- New feature
How does this change affect you or your users?
[Plan for change: User alerts on iOS for when screen capture actions are blocked] If APP has been configured to block screen capturing, users see an alert indicating that screen capture actions are blocked by their organization when they attempt…
- New feature
How does this change affect you or your users?
[Update to support statement for Windows 10 in Intune] Microsoft Intune continues to maintain core management functionality for Windows 10, including: Continuity of device management. Support for updates and migration workflows to Windows 11. Ability for ESU customers to deploy…
- New feature
How does this change affect you or your users?
[Plan for Change: Google Play strong integrity definition update for Android 13 or above] If you have targeted users with app protection policies and/or compliance policies that are using devices running Android 13 or above without a security update in…
- New feature
How does this change affect you or your users?
[Plan for Change: New Intune connector for deploying Microsoft Entra hybrid joined devices using Windows Autopilot] If you have Microsoft Entra hybrid joined devices using Windows Autopilot, you need to transition to the new connector to continue deploying and managing…
- New feature
How can you prepare?
[Plan for Change: Google Play strong integrity definition update for Android 13 or above] Review and update your policies as needed. Ensure users with devices running Android 13 or above are receiving timely security updates. You can use the app…
DocsHow to Monitor App Protection PoliciesAndroid App Protection Policy SettingsAndroid Enterprise compliance settings in Microsoft Intune
How to Monitor App Protection Policies This article describes how to monitor app protection policies in Intune.
- New feature
How can you prepare?
[Plan for Change: New Intune connector for deploying Microsoft Entra hybrid joined devices using Windows Autopilot] Update your environment to the new connector by following these steps: Download and install the new connector in the Intune admin center. Sign in…
DocsEnrollment for Microsoft Entra hybrid joined devicesNewMicrosoft Intune Connector for Active Directory security update
Enrollment for Microsoft Entra hybrid joined devices Use Windows Autopilot to enroll Microsoft Entra hybrid joined devices in Microsoft Intune.
- New feature
How can you prepare?
[Warning notifications for iOS apps running unsupported SDK versions] Notify users to update to the latest versions of Microsoft and third-party apps as soon as possible. The latest versions are available in Apple's App store . For example, you can…
DocsiOS/iPadOS App Protection Policy Settings
iOS/iPadOS App Protection Policy Settings This article describes the iOS/iPadOS app protection policy (APP) settings for iOS/iPadOS devices.
- New feature
How can you prepare?
[Plan for change: Intune is moving to support macOS 15 and higher later this year] Check your Intune reporting to see what devices or users might be affected. Go to Devices > All devices and filter by macOS. You can…
- New feature
How can you prepare?
[Plan for Change: New settings for Apple AI features; Genmojis, Writing tools, Screen capture] Review and update your app protection policies if you'd like more granular controls for blocking or allowing specific AI features. ( Apps > Protection > select…
- New feature
How can you prepare?
[Update to the latest Intune App SDK and Intune App Wrapper for Android 15 support] If you choose to build apps targeting Android API 35, you need to adopt the new version of the Intune App SDK for Android (v11.0.0)…
DocsIntune App SDK for AndroidIntune App Wrapping Tool for Android
- New feature
How can you prepare?
[Update to the latest Intune Company Portal for Android, Intune App SDK for iOS, and Intune App Wrapper for iOS] Plan to make the following changes before January 19, 2026 : For apps using the Intune App SDK, you must…
DocsConditional Access - Require approved app or app protection policyUpdatedv20.8.0 - Release 20.8.0 - microsoftconnect/ms-intune-app-sdk-ios | …v21.1.0 - Release 21.1.0 - microsoftconnect/ms-intune-app-sdk-ios | …v20.8.1 - Release 20.8.1 - …
Conditional Access - Require approved app or app protection policy Create a custom Conditional Access policy require approved app or app protection policy
- New feature
How can you prepare?
[Plan for Change: Implement strong mapping for SCEP and PKCS certificates] If you use SCEP or PKCS certificates for Microsoft Entra Hybrid joined users or devices, you'll need to take action before February 11, 2025 to either: (Recommended) Enable strong…
DocsPost Support tip: Implementing strong mapping in Microsoft Intune …KB5014754
Support tip: Implementing strong mapping in Microsoft Intune certificates Learn more about implementing strong mapping in Microsoft Intune certificates.
- New feature
How can you prepare?
[Intune moving to support Android 10 and later for user-based management methods in October 2024] Notify your helpdesk, if applicable, about this updated support statement. The following admin options are available to help warn or block users: Configure a conditional…
DocsManage device operating system versions with IntuneUpdatedAndroid App Protection Policy Settings
Manage device operating system versions with Intune Learn about the methods for managing device operating system versions supported by Microsoft Intune.
- New feature
How can you prepare?
[Plan for Change: Blocking screen capture in the latest Intune App SDK for iOS and Intune App Wrapping Tool for iOS] Review your app protection policies and if needed, create a Managed apps app configuration policy to allow screen capture…
DocsConfiguration Policies for Intune App SDK Managed AppsiOS/iPadOS App Protection Policy SettingsApp Configuration Policies for Microsoft Intune
Configuration Policies for Intune App SDK Managed Apps Learn how to configure policies for Intune App SDK managed apps.
- New feature
How can you prepare?
[Update to support statement for Windows 10 in Intune] Use the All devices report in the Intune admin center to identify devices still running Windows 10 and upgrade eligible devices to Windows 11. If devices cannot be upgraded in time…
- New feature
How can you prepare?
[Update firewall configurations to include new Intune network endpoints] Ensure that your firewall rules are updated and added to your firewall's allowlist with the other IP addresses documented under Azure Front Door by December 2, 2025 . Alternatively, you can…
DocsAzure service tags overviewNewNetwork endpoints for Microsoft IntuneUpdatedSecure traffic to originsNetwork endpoints for US government deployments
Azure service tags overview Learn about Azure service tags and how they simplify security rule creation for Azure Virtual Networks. Discover benefits and best practices.
- New feature
How can you prepare?
[Plan for change: User alerts on iOS for when screen capture actions are blocked] Update your IT admin documentation and notify your helpdesk or users as needed. You can learn more about blocking screen capture in the blog: New block…
DocsNew block screen capture for iOS/iPadOS MAM protected apps
- New feature
How can you prepare?
[Plan for Change: Intune is moving to support iOS/iPadOS 18 and later] Check your Intune reporting to see what devices or users might be affected. For devices with mobile device management (MDM), go to Devices > All devices and filter…
DocsManage device operating system versions with IntuneUpdated
Manage device operating system versions with Intune Learn about the methods for managing device operating system versions supported by Microsoft Intune.
- New feature
Enhanced app inventory with faster data updates
Intune enhanced app inventory brings faster, more detailed visibility into the apps in your environment to support identification of outdated or risky software. Improved data freshness and richer app metadata provide clearer insight into installed applications, while…
DocsWhat's new in previous months in the Microsoft IntuneNew
What's new in previous months in the Microsoft Intune Review older announcements from the Intune what's new page
- Retirement
Additional information
[Update to support statement for Windows 10 in Intune] Stay secure with Windows 11, Copilot+ PCs, and Windows 365 before support ends for Windows 10 Windows 10 reaching end of support Enable Extended Security Updates (ESU) Windows 10 release information…
DocsWindows 10 - release informationNewWindows 11 - release informationNewStay secure with Windows 11, Copilot+ PCs, and Windows 365 before …Windows 10 reaching end of support
Windows 10 - release information Learn release information for Windows 10 releases
Posts this month: What’s new in Microsoft Intune – May
Microsoft Edge
7 changes · product page- Security update
Edge security update: Stable 148.0.3967.96
Microsoft released the latest Microsoft Edge for Stable (Version 148.0.3967.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Android and iOS 148.0.3967.84
Microsoft released the latest Microsoft Edge for Android and iOS (Version 148.0.3967.84) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Android 148.0.3967.70 (1 CVE)
Microsoft released the latest Microsoft Edge for Android (Version 148.0.3967.70) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security fixes: Android-specific…
- Security update
Edge security update: iOS 148.0.3967.70 (1 CVE)
Microsoft released the latest Microsoft Edge for iOS (Version 148.0.3967.70) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security fixes: iOS-specific…
- Security update
Edge security update: Stable 148.0.3967.70 (3 CVEs)
Microsoft released the latest Microsoft Edge for Stable (Version 148.0.3967.70) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide This update contains the following Microsoft Edge specific security fixes: CVE-2026-45495 CVE-2026-45494…
DocsSecurity Update GuideCVE-2026-45495CVE-2026-45494CVE-2026-45492
- Security update
Edge security update: Android and iOS 148.0.3967.55 (3 CVEs)
Microsoft released the latest Microsoft Edge for Android and iOS (Version 148.0.3967.55) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security…
DocsSecurity Update GuideCVE-2026-42838CVE-2026-40416CVE-2026-41107
- Security update
Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 148.0.3967.54). (3 CVEs)
Microsoft released the latest Microsoft Edge Stable Channel (Version 148.0.3967.54). This release includes the most recent security updates from the Chromium project. Security Update Guide . This update contains the following Microsoft Edge specific security fixes: CVE-2026-40416 CVE-2026-41107 CVE-2026-42838
DocsSecurity Update GuideCVE-2026-40416CVE-2026-41107CVE-2026-42838
Posts this month: Security Review for Microsoft Edge version 148
Microsoft Defender for Cloud
13 changes · product page- Deprecation
General availability of individual recommendations for Defender for Cloud in Azure portal and deprecation of legacy grouped recommendations
May 5, 2026 Individual recommendations for Defender for Cloud that were previously represented as grouped recommendations are now generally available (GA) in the Azure portal. Azure portal secure score behavior: The classic secure score in the Azure portal is also…
DocsReview Security Recommendations in Microsoft Defender for CloudUpdatedTransition from grouped to individual recommendations in Defender for …Updated
Review Security Recommendations in Microsoft Defender for Cloud Learn how to review security recommendations in Microsoft Defender for Cloud to improve the security posture of your environments.
- GA
SQL Vulnerability Assessment Express Configuration now available for Azure SQL Managed Instance and Synapse (Preview)
May 17, 2026 SQL Vulnerability Assessment (VA) Express Configuration is now available in preview for Azure SQL Managed Instance and Azure Synapse Analytics Workspaces. This Microsoft-managed storage tool for vulnerability baselines and scan results extends the same experience already available…
DocsEnable SQL Vulnerability Assessment Express Configuration for Azure …UpdatedScan your Azure SQL databases for vulnerabilities
Enable SQL Vulnerability Assessment Express Configuration for Azure SQL Learn how to enable the express configuration of SQL vulnerability assessment on Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics.
- GA
Microsoft Defender for Open-Source Relational Databases on AWS RDS will become Generally Available
May 24, 2026 Microsoft Defender for Open-Source Relational Databases will be generally available for Amazon Web Services Relational Database Service (AWS RDS) instances on June 1, 2026 . Starting June 1, 2026, the plan will begin billing for AWS RDS…
DocsEnable Defender for Open-source Relational Databases on Amazon Web …UpdatedOverview of Defender for Open-Source Relational Databases
Enable Defender for Open-source Relational Databases on Amazon Web Services (AWS) Enable Defender for open-source relational databases on AWS RDS to detect suspicious activity and protect supported database engines.
- GA
General availability of on-demand malware scanning of Azure Files in Microsoft Defender for Storage
May 26, 2026 On-demand malware scanning of Azure Files in Microsoft Defender for Storage is now generally available. This feature extends on-demand malware scanning so you can scan Azure Storage accounts that contain blobs and files. You can start scans…
DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated
Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.
- GA
General availability of Microsoft Defender for Cloud and GitHub Advanced Security integration
May 3, 2026 The native integration between Microsoft Defender for Cloud and GitHub Advanced Security (GHAS) is now generally available. This integration connects runtime security signals from Defender for Cloud with code-level vulnerability management in GHAS, enabling developers and security…
DocsGitHub Advanced Security Integration with Microsoft Defender for CloudDeploy GitHub Advanced Security Integration with Microsoft Defender …Updated
GitHub Advanced Security Integration with Microsoft Defender for Cloud Learn how GitHub Advanced Security integrates with Microsoft Defender for Cloud to provide unified code-to-runtime security from development to production.
- GA
General availability of Defender for Cloud integration into the Defender portal
May 5, 2026 Microsoft Defender for Cloud is now integrated into the Microsoft Defender portal, unifying cloud security posture management and threat protection in a single experience. This integration provides a centralized view across hybrid and multicloud environments, including Azure…
DocsOverview of Defender for Cloud in Defender PortalUpdated
Overview of Defender for Cloud in Defender Portal Comprehensive overview of Microsoft Defender for Cloud in the Defender portal, including navigation hub, dashboard features, and unified security management capabilities.
- New feature
Updated Helm installation for Defender for Containers sensor
May 6, 2026 Defender for Containers sensor installation using Helm now uses direct Helm chart deployment instead of installation scripts. The updated flow includes environment-specific Helm commands for Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes…
DocsInstall Defender for Containers Sensor Using HelmUpdated
Install Defender for Containers Sensor Using Helm Install the Defender for Containers sensor on AKS, EKS, and GKE clusters by using Helm, including prerequisites, deployment steps, and upgrade guidance.
- New feature
Microsoft Defender Experts for Servers as a managed XDR option
May 18, 2026 Defender for Cloud is now partnered with Microsoft Defender Experts, as a managed extended detection and response (XDR) service for server workloads. Microsoft analysts and automation work together to detect, prioritize, and respond to threats on machines…
DocsOverview of Defender for Servers in Defender for CloudUpdated
Overview of Defender for Servers in Defender for Cloud Get an overview of the Defender for Servers plan in Microsoft Defender for Cloud, including its features and integration with other Defender services.
- New feature
Daily score calculation enhancement for risk-based Cloud secure score
May 5, 2026 We've improved how daily Cloud secure score values are calculated to more accurately reflect your posture and the impact of actions taken throughout the day. Daily scores represent end-of-day snapshots instead of averaged values over the course…
DocsCloud Secure Score in Microsoft Defender for Cloud
Cloud Secure Score in Microsoft Defender for Cloud Learn about the Microsoft Defender for Cloud secure score, which is part of the Microsoft cloud security benchmark.
- Preview
Scanning support for Docker Hardened container images (preview)
May 19, 2026 Microsoft Defender for Cloud's vulnerability scanner, powered by Microsoft Defender Vulnerability Management, is extending its scanning coverage to Docker Hardened container images, and identify vulnerabilities in Docker Images to validate that they're shipping the most secure builds…
DocsContainers support matrix in Defender for CloudUpdated
Containers support matrix in Defender for Cloud Review support requirements for container capabilities in Microsoft Defender for Cloud.
- Preview
Private clusters protection for gated deployment, binary drift detection, and malware detection (Preview)
May 31, 2026 Private clusters now support the Defender sensor for gated deployment, binary drift detection, and malware detection in preview. This update extends Defender for Containers coverage to private cluster scenarios where you use the sensor-based features for container…
DocsDeploy Defender for Containers to private clusters (Preview)Access patterns and private cluster support for Defender for …
Deploy Defender for Containers to private clusters (Preview) Learn how to deploy Microsoft Defender for Containers to private clusters by using preview Helm charts and the Azure Arc Preview release train.
- Preview
Malware detection for EKS and GKE nodes (Preview)
May 31, 2026 Malware detection is now in preview for Amazon Elastic Kubernetes Service (EKS) nodes and Google Kubernetes Engine (GKE) nodes. This update expands Kubernetes node malware coverage beyond Azure Kubernetes Service (AKS) so you can detect malware in…
DocsReview and Remediate Malware Alerts for Kubernetes NodesUpdatedOverview of Kubernetes Nodes Protection
Review and Remediate Malware Alerts for Kubernetes Nodes Defender for Containers uses the Microsoft Defender Antivirus anti-malware engine. Learn how to review and remediate malware alerts.
- Preview
Cloud security reporting in Microsoft Defender portal (Preview)
May 20, 2026 Microsoft Defender portal now includes integrated cloud security reporting capabilities, enabling you to create, customize, and share security insights across your organization. With cloud security reporting, you can: View built-in reports such as CNAPP Executive Summary and…
DocsCloud Security Reporting in Microsoft Defender PortalUpdated
Cloud Security Reporting in Microsoft Defender Portal Learn how to create, customize, and export cloud security reports in Microsoft Defender portal, including built-in reports and custom report options.
Posts this month: Public preview: Expanded coverage and unified management for SQL VA Express Configuration
Microsoft Defender for Cloud Apps
1 changes · product page- Preview
Disable informational alerts for unsanctioned app access (Preview)
You can now disable informational alerts generated when users access unsanctioned apps. A new Generate alert for blocked app access toggle in the Microsoft Defender for Endpoint settings lets you suppress these alerts while keeping blocking enforcement active. For more…
DocsGovern discovered apps using Microsoft Defender for Endpoint
Govern discovered apps using Microsoft Defender for Endpoint Use the Microsoft Defender for Cloud Apps integration with Defender for Endpoint to govern discovered cloud apps by blocking or warning on unsanctioned apps.
Microsoft Purview
8 changes · product page- GA
Data Security Posture Management
General availability (GA) : The new version of Data Security Posture Management is now generally available. Partner solutions for non-Microsoft data sources remain in preview, as does the Data Security Posture Agent. This current version provides guided workflows for proactive…
DocsLearn about Microsoft Purview Data Security Posture Management (DSPM)Application card for Microsoft Purview Data Security Posture …Considerations for deploying Microsoft Purview Data Security Posture …Set up a connector to manage Anthropic Claude data
Learn about Microsoft Purview Data Security Posture Management (DSPM) Learn how Microsoft Purview Data Security Posture helps you manage data security, automate risk detection and remediation, simplify compliance, and gain clear visibility across all environments—empowering your organization to adopt AI securely and confidently.
- GA
Data Governance
General availability (GA) : Standalone data asset data quality scan is now generally available. General availability (GA) : Incremental data quality scan is now generally available. General availability (GA) : Configurable data quality thresholds for data quality rules and data…
DocsData Quality Scan for a Data Asset in Unified CatalogIncremental Data Quality Scan in Unified CatalogData Quality Thresholds for data quality rules in Microsoft Purview …
Data Quality Scan for a Data Asset in Unified Catalog Learn how to run data quality scans on data assets not associated to a data product in Microsoft Purview Unified Catalog.
- GA
Agent 365
General availability (GA) : Data security and compliance protections for Microsoft Agent 365 .
DocsUse Microsoft Purview to manage data security & compliance for …
Use Microsoft Purview to manage data security & compliance for Microsoft Agent 365 Use Microsoft Purview to help you protect and manage data security and compliance protections for Microsoft Agent 365.
- New feature
Reports
Preview : Custom posture reports let admins build tailored views of information protection and DLP activity. Assemble metric and chart cards in sections to answer organization-specific questions that complement the built-in posture reports.
DocsMicrosoft Purview posture reports overview
Microsoft Purview posture reports overview Learn how Microsoft Purview posture reports help admins evaluate sensitivity-label adoption, DLP policy effectiveness, and information-protection coverage across your organization.
- New feature
Data Security Investigations
New : OCR support in Data Security Investigations. Image files are automatically processed with optical character recognition (OCR), and the extracted text is merged and vectorized for AI analysis. New : Custom examinations in Data Security Investigations. Define your own…
DocsSearch, review, and refine results in Data Security InvestigationsUpdatedLearn about AI analysis in Data Security InvestigationsUse AI analysis in Data Security Investigations
Search, review, and refine results in Data Security Investigations Discover how to search, review, and refine results in Data Security Investigations, including audit search for activity-based content identification.
- New feature
Data Loss Prevention
Updated : Added the admin permissions ( Directory Reader , Microsoft Edge administration , and Microsoft Intune administration ) required to activate DLP policies for unmanaged cloud apps in Microsoft Edge for Business. For more information, see Learn about Data…
DocsData Loss Prevention policy referenceNewMicrosoft Entra Built-in RolesUpdatedLearn about Data Loss Prevention for Cloud Apps in Edge for BusinessUpdatedHelp prevent sharing via Microsoft Edge for Business to unmanaged AI …Updated
Data Loss Prevention policy reference DLP policy component and configuration reference. This article provides a detailed anatomy of a DLP policy.
- Preview
Sensitivity labels
In preview : Rolling out, manual labeling support for MP4 files in SharePoint and OneDrive. For more information, see Video support (MP4 files . In preview : Rolling out, a new label policy setting for meetings , Apply meeting label…
DocsEnable sensitivity labels for files in SharePoint and OneDriveNewEnable sensitivity labels for files in SharePoint and OneDriveNewAutomatically apply a sensitivity label to Microsoft 365 dataNewUse sensitivity labels to protect calendar items, Teams meetings, and …
Enable sensitivity labels for files in SharePoint and OneDrive Administrators can enable sensitivity label support for Word, Excel, PowerPoint, and PDF files in SharePoint and OneDrive.
- Preview
Information protection scanner
In preview : Administrators can now enable, disable, and configure cluster-level scanner features from PowerShell. In preview : Custom Reporting populates additional columns and tables in the scanner cluster database so administrators can build their own reports directly against scan…
DocsConfigure Microsoft Purview Information Protection scanner features …Microsoft Purview Information Protection scanner Custom Reporting …
Configure Microsoft Purview Information Protection scanner features (preview) Use admin-controlled feature configuration to enable or disable Microsoft Purview Information Protection scanner features at the cluster level.
Posts this month: Securing AI Agents End‐to‐End: Connecting Purview DSPM, Agent 365, and the AI Security Dashboard
Built from the What's New and release-notes pages on Microsoft Learn. Entries are grouped by the month Microsoft lists them under (or, for changes detected later, the month we detected them). Every title links to the exact section on Microsoft Learn.