What's new in Microsoft Security: July 2026
Every Microsoft Security update in July 2026: 69 documentation changes and 71 official posts across Sentinel, Defender, Entra, Intune, Purview and Security Copilot, with GA and preview releases, retirements and links to the sources.
Announcements
Threat Intelligence
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as…
Microsoft Threat IntelligenceDefender XDR
Detecting CVE-2026-54121 (Certighost) with Microsoft Defender
Microsoft Defender XDR BlogSentinel
What’s new in Microsoft Sentinel: July 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSecurity Copilot
Accelerate Your Security Copilot and Agentic Security Readiness with Virtual Technical Workshops
These virtual technical workshops for practitioners looking to build AI-for-Security expertise across Microsoft Entra, Intune, Purview, and Threat…
Microsoft Security Community BlogAzure securityPreview
Public Preview: Symmetric keys on Azure Key Vault Premium
We’re announcing post-quantum resilient symmetric keys on Azure Key Vault Premium are now available in public preview.
Azure UpdatesDefender for Cloud
Built to Protect: The Architecture Behind Codename MDASH
Information Table Defender Foundations Regional Operation AI & Data Containment Responsible Governance Built as a production Microsoft Security service, not an isolated…
Microsoft Defender for Cloud BlogMicrosoft Security
What’s new in Microsoft Security: July 2026
This month’s updates help security and IT teams secure their AI environments, use AI to defend, and strengthen the foundations that AI-powered operations depend on.
Microsoft Security BlogMicrosoft Security
The Microsoft AI and Agent Platform — The Platform Behind Intelligent Agents
Why the platform around the model is the real enterprise differentiator Enterprise AI has reached a turning point.
Microsoft Security Community BlogDefender XDR
MDTI convergence in Microsoft Sentinel and Defender XDR is complete
Beginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal, giving customers…
Microsoft Defender XDR BlogMicrosoft Security
Better security starts with better questions
Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems.
Microsoft Security BlogIntune
What’s new in Microsoft Intune – July
Ask an IT admin what a good day looks like, and it usually comes down to one word: control. Control means you push a change and know it landed.
Microsoft Intune BlogIntune
Registry Inventory in Microsoft Intune: Verifying What’s on Your Devices
By: Madison Cooks, Product Manager | Microsoft Intune IT admins need a reliable way to confirm how Windows devices are configured, especially when troubleshooting…
Intune Customer SuccessMicrosoft Security
Securing AI Agents at Runtime: Real-Time Protection and Threat Detection for Microsoft Agent 365
Organizations are rapidly adopting AI agents to automate workflows, access enterprise data, invoke tools, and take actions on behalf of users.
Microsoft Security Community BlogAzure securityGA
Generally Available: HTTP header insertion in Azure Firewall
Azure Firewall now supports HTTP header insertion, enabling organizations to add or overwrite HTTP/HTTPS request headers directly from Azure Firewall application rules.
Azure UpdatesMicrosoft Security
Level Up Your Security Skills This August with the Microsoft Defender Challenge and Learn Live
Security teams face an increasingly complex landscape. Threats span identities, endpoints, email, cloud workloads, and emerging AI environments.
Microsoft Security Community BlogMicrosoft Security
Rethinking security for the age of AI
The physics of cybersecurity are changing. Introducing security's new cyber stack: Project Perception.
Microsoft Security BlogMicrosoft Security
Enhancing AI security through global AI red teaming
Microsoft's External Red Team Alliance (EXTRA) is a global AI security initiative designed to advance AI safety research and red teaming.
Microsoft Security BlogExposure ManagementPreview
Prioritize exposure resolution with a new dashboard experience (public preview)
Cut Through the Noise and Focus on What Matters Most Security teams face a constant challenge: too many findings, too many dashboards, and not enough clarity on where to…
Microsoft Security Exposure Management BlogMicrosoft Security
How Nationwide stays ahead of attackers with Project Perception
Nationwide, the world’s largest building society, is among the first organizations to put Microsoft’s new agentic security system to work.
Microsoft Security Community BlogIntune
From the frontlines: Frontline worker management with Microsoft Intune
So, here we are. You’ve been asked to start managing frontline devices for your organization with Intune.
Microsoft Tech CommunityIntune
From hours to minutes: Rethinking Microsoft Intune compliance reporting with the Export API
By: Daniel Gerrity – Principal Product Manager | Microsoft Intune If you manage a large device fleet with Microsoft Intune, you’ve almost certainly needed to get…
Intune Customer SuccessEntra
Modernize SAP Identity Management with Microsoft Entra
Many organizations are rethinking how they manage identity across their SAP landscape as they move away from on-premises identity management systems and adopt a more…
Microsoft Entra BlogEntra
What's New in Microsoft Entra: July 2026
Welcome to the July edition of our monthly newsletter, summarizing the latest news and developments in the exciting, ever-evolving world of Microsoft Entra.
Microsoft Entra BlogIntune
Designing Intune enrollment for frontline workers: Choosing the right path for real-world devices
By: Shawn Catlin – Senior Product Manager | Microsoft Intune and Sucheta Gawade, Microsoft MVP (Azure & Security / Intune) Practitioner perspective from Sucheta Gawade…
Intune Customer SuccessAzure securityPreview
Public Preview: Azure DDoS Protection custom policy
Azure DDoS Protection custom policy is now in public preview.
Azure UpdatesMicrosoft Security
Email threat landscape: Q2 2026 trends and insights
In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major…
Microsoft Security BlogDefender for Office 365
Defending the Inbox Against Prompt Injection Attacks
AI assistants are quickly becoming part of everyday work—summarizing emails, drafting responses, triaging requests, and even potentially acting across connected business…
Microsoft Defender for Office 365 BlogMicrosoft Security
Real world incident response: Microsoft and AXA XL strengthen cyber resilience
Our collaboration with AXA XL brings Microsoft Incident Response services directly to cyber insurance policyholders, helping organizations coordinate technical…
Microsoft Security BlogEntra
Secure AI, web, and private apps with Zero Trust
Explore the latest Microsoft Entra capabilities to secure AI traffic, protect sensitive data, and extend identity-first Zero Trust controls across web and…
Microsoft Entra BlogEntra
Plan your Azure AD B2C migration with the Migration Policy Analyzer
Migration planning starts with visibility One of the first challenges organizations face when planning a migration from Azure AD B2C to Microsoft Entra…
Microsoft Entra BlogMicrosoft Security
Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks
Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and our reception.
Microsoft Security BlogThreat Intelligence
ACR Stealer: Two observed intrusion chains amid increased threat activity
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments.
Microsoft Threat IntelligenceMicrosoft Security
Least privilege for AI agents: Identity, access, and tool binding
As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure.
Microsoft Security BlogSentinel
Run agentless SAP connector cost-efficiently
The SAP agentless connector uses SAP Integration Suite (Cloud Integration/CPI) to fetch SAP audit log data and forward it to Microsoft Sentinel.
Microsoft Sentinel BlogThreat Intelligence
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm.
Microsoft Threat IntelligenceEntra
AI agents are everywhere. Are your access controls ready?
AI agents are multiplying fast. See what 150 identity pros said about sprawl, shadow AI, and governance at Identiverse 2026.
Microsoft Entra BlogThreat Intelligence
Turning threat intelligence into decisive action with Defender Experts
Security teams have never had more visibility, yet rarely have they felt more uncertain.
Microsoft Security BlogDefender XDR
New Privileged Token Context Telemetry Boosts Advanced Hunting in Microsoft Defender
In brief: Defenders can now easily identify logons involving high-privilege identities or special logon flags to better hunt threats and fine-tune detections.
Microsoft Defender XDR BlogSentinel
Announcing the ASIM Parser Creation Agentic Experience
Creating high-quality ASIM parsers has always required deep knowledge about source data and ASIM schemas, careful KQL design, and repeated validation cycles.
Microsoft Sentinel BlogDefender for Endpoint
Introducing scheduled antivirus scans on Microsoft Defender Linux
Security teams rely on scheduled scans to ensure consistent coverage across devices, detect dormant or missed threats, and meet compliance requirements.
Microsoft Defender for Endpoint BlogMicrosoft Security
New Windows Features to Secure Today’s Data in a Post-Quantum World
***July 14 Update: TLS Hybrid Key Exchange using ML-KEM groups is now available on Windows 11 starting with update KB5089573 for 24H2 and 25H2…
Microsoft Security Community BlogDefender XDR
Microsoft Defender now integrates with Dragos, Forescout, & Armis for OT Security
Co-author(s): Amit Cohen and Hadar Shindler Operational technology (OT) environments are unlike anything else in cybersecurity.
Microsoft Defender XDR BlogSentinel
Updating Content for CrowdStrike Solution
Update two CrowdStrike Falcon analytic rule YAMLs to prepend "Common Event Format (CEF) via AMA -" to the rule names (CriticalOrHighSeverityDetectionsByUser and…
Azure-Sentinel contentThreat Intelligence
Defending SaaS-based applications against ShinyHunters OAuth abuse
Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing)…
Microsoft Security BlogSentinel
Building toward an Agentic SOC: A Portable, Autonomous Malware Investigation Agent
Modern Security Operations Centers are not short on tools. They are short on continuity.
Microsoft Sentinel BlogEntra
Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID
Microsoft Entra ID makes passkeys the default sign-in experience and introduces a new model for SMS and voice authentication. Read about how to prepare.
Microsoft Security BlogSentinel
Updated Microsoft Entra ID Analytic Rule SigninAttemptsByIPviaDisabledAccounts to include the additional "ResultDescription" value: "The user account is disabled."
Change(s): - Updated `Microsoft Entra ID Analytic Rule SigninAttemptsByIPviaDisabledAccounts` to include the additional `"ResultDescription"` value: `"The user account…
Azure-Sentinel contentAzure security
Secure Native Access to Azure Kubernetes Service (AKS) Private Clusters with Azure Bastion
Written in Collaboration with AvirupChat ShabazShaik Mohit_Kumar YuriDiogenes Introduction: As organizations move toward containerized workloads such as Azure Kubernetes…
Azure Network Security BlogIntune
Build a patch strategy for today’s threat pace with Microsoft
AI-accelerated vulnerability discovery and remediation are changing how organizations manage risk.
Action may be required
Intune Customer SuccessMicrosoft Security
Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative
Microsoft’s latest Secure Future Initiative report outlines progress on secure foundations, AI-powered defense, and future-ready cybersecurity.
Microsoft Security BlogSentinel
Quality updates for Okta SSO Content
Required items, please complete Change(s): - Refine multiple Okta SSO analytic rules and hunting queries: improve KQL parsing and filtering, introduce configurable…
Azure-Sentinel contentSentinel
Harden ASIM tester workflow for fork PRs
Strengthens pull_request_target security controls in the ASIM schema/data tester workflow.
Azure-Sentinel contentAzure security
Azure DDoS Protection & Azure WAF: A Layered Defense for Modern DDoS Attacks
Introduction: The Need for Layered DDoS Defense Organizations today operate in an environment where Distributed Denial of Service (DDoS) attacks continue to evolve…
Azure Network Security BlogThreat Intelligence
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
GigaWiper, also tracked as BLUERABBIT, is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform.
Microsoft Threat IntelligenceSentinel
Use js-yaml load in YAML validators
Replaced deprecated `safeLoad` calls with `load` in both local validation scripts.
Azure-Sentinel contentSentinelDeprecation
Replace deprecated yaml.safeLoad with yaml.load
safeLoad was deprecated in js-yaml v4 and removed in favor of load.
Azure-Sentinel contentMicrosoft Security
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
At Microsoft we encompass these security requirements, along with threat knowledge, and operational frameworks in our Secure Future Initiative (SFI), to guide what a…
Microsoft Security BlogEntra
Govern AI agent identities and access the same way you govern your employees
Use Microsoft Entra Agent ID to assign accountable identities, control agent access, and automate sponsor lifecycle management at scale.
Microsoft Entra BlogAzure securityPreview
Public Preview: Exceptions in WAF for Azure Application Gateway and Azure Front Door
Azure Web Application Firewall (WAF) helps protect your web applications from common threats and attacks.
Azure UpdatesSentinel
Fix field references in Log4j WAF detection rule
Corrects the column_ifexists references in the Log4j vulnerability detection rule to use the proper field names from AdditionalFields.
Azure-Sentinel contentIntune
What’s new in Microsoft Intune – June
Editor's note (July 2026): This post has been updated since its original publication.
Microsoft Intune BlogDefender for Cloud
5 insights from Frost & Sullivan’s 2025 Frost RadarTM for Cloud Security Posture Management
Read five key learnings from the Frost & Sullivan 2025 Frost RadarTM for CSPM to learn how CSPM is evolving from point-in-time compliance to continuous risk management.
Microsoft Security BlogMicrosoft Security
Improving security posture across the Microsoft partner ecosystem
Read how Microsoft strengthens partner ecosystem security with CSP vetting, least privilege access, monitoring, and risk management best practices.
Microsoft Security BlogIntune
Migrating frontline mobile devices: Identity considerations for assigned and shared devices
By: Carol Burns - Principal Product Manager | Microsoft Intune and Sucheta Gawade, Microsoft MVP (Azure & Security / Intune) Practitioner perspective from Sucheta…
Intune Customer SuccessSentinel
Behind the Build with Gigamon: Enriching Microsoft Sentinel with Network-Derived Telemetry
Behind the Build is an ongoing series spotlighting standout Microsoft partner collaborations.
Microsoft Sentinel BlogDefender for CloudGA
Now generally available: Serverless posture coverage in Microsoft Defender CSPM
Serverless workloads are a foundation of modern application development, powering everything from low-code and no-code solutions to AI applications and agentic…
Microsoft Defender for Cloud BlogMicrosoft Security
Microsoft named a leader in the Frost Radar for cloud and application runtime security
Frost & Sullivan names Microsoft a leader as cloud and application security converge into unified, runtime risk reduction.
Microsoft Security BlogEntra
Extend data security to the network with Microsoft Purview and Microsoft Entra
Protection that keep s up with how data moves in the AI era Enterprise data used to be easier to contain.
Microsoft Security Community BlogIntuneGA
Advanced Microsoft Intune capabilities now available in Microsoft 365 E3 and E5
Across industries, customers are already using advanced Microsoft Intune Suite capabilities to solve real endpoint challenges, such as reducing standing privilege…
Microsoft Intune BlogDefender XDR
Monthly news - July 2026
Microsoft Defender Monthly news - July 2026 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the…
Microsoft Defender XDR Blog
Retirements and deprecations
All retirements| Effective | What's changing | Product | Type | Source |
|---|---|---|---|---|
| —not stated | Deprecation completed: Legacy grouped recommendations removed from Azure portal Deprecation completed: Legacy grouped recommendations removed from Azure portal. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | New container security capabilities are now generally available The following cluster-level recommendations are now deprecated: HostPath volume mount restrictions, allowed ports enforcement, host networking/ports restrictions, CAP_SYS_ADMIN capability restrictions, and AppArmor … | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Plan enablement API now blocks onboarding to five deprecated Defender plans Plan enablement API now blocks onboarding to five deprecated Defender plans. | Defender for Cloud | Deprecation | Microsoft Learn |
| —not stated | Replace deprecated yaml.safeLoad with yaml.load Replace deprecated yaml.safeLoad with yaml.load. safeLoad was deprecated in js-yaml v4 and removed in favor of load. | Sentinel | Deprecation | Azure-Sentinel content (merged pull requests) |
Microsoft Sentinel
1 changes · product page- Preview
Custom detection rules support in Microsoft Sentinel Repositories (Preview)
You can now manage custom detection rules as code in your GitHub or Azure DevOps repository using the Microsoft Security BICEP extension. Sync custom detection rules to Microsoft Sentinel using the Repositories feature, or deploy them directly using BICEP CLI…
DocsOverview of custom detections in Microsoft Defender XDRManage custom content with repository connections
Overview of custom detections in Microsoft Defender XDR Understand how you can use advanced hunting to create custom detections and generate alerts.
Posts this month: What’s new in Microsoft Sentinel: July 2026 · Run agentless SAP connector cost-efficiently · Announcing the ASIM Parser Creation Agentic Experience · Updating Content for CrowdStrike Solution · Building toward an Agentic SOC: A Portable, Autonomous Malware Investigation Agent · Updated Microsoft Entra ID Analytic Rule SigninAttemptsByIPviaDisabledAccounts to include the additional "ResultDescription" value: "The user account is disabled."
Microsoft Defender XDR
3 changes · product page- GA
Real-time protection for Microsoft Agent 365 tooling servers
(GA) Real-time protection for Microsoft Agent 365 tooling servers : Microsoft Defender evaluates tool invocations and responses against security policies and can allow or block interactions with Work IQ MCP and customer MCP tools onboarded to Agent 365. For more…
DocsProtect AI agents in real time using Microsoft DefenderUpdated
Protect AI agents in real time using Microsoft Defender Learn how to block unsafe AI agent actions in real time and configure real-time protection rules in Microsoft Defender.
- Preview
Threat detection for Microsoft Agent 365 agents
(Preview) Threat detection for Microsoft Agent 365 agents : Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft…
DocsDetect and investigate threats to AI agents using Microsoft Defender …
Detect and investigate threats to AI agents using Microsoft Defender (Preview) Learn how to detect, investigate, and hunt for threats to AI agents using Microsoft Defender.
- Preview
AI agent posture risk in Microsoft Defender
(Preview) AI agent posture risk in Microsoft Defender : Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access…
DocsAI agent posture risk in Microsoft DefenderNew
AI agent posture risk in Microsoft Defender Learn how Microsoft Defender assesses AI agent posture risk using risk indicators, risk levels, and security recommendations.
Posts this month: Detecting CVE-2026-54121 (Certighost) with Microsoft Defender · MDTI convergence in Microsoft Sentinel and Defender XDR is complete · New Privileged Token Context Telemetry Boosts Advanced Hunting in Microsoft Defender · Microsoft Defender now integrates with Dragos, Forescout, & Armis for OT Security · Monthly news - July 2026
Microsoft Security Exposure Management
4 changes · product page- GA
Codename MDASH - MAI-Augmented scan profile preview
The MAI-Augmented scan profile is now available in preview as part of Codename MDASH. The MAI-Augmented profile can be used when triggering a scan through the Defender CLI. It includes MAI-Cyber-1-Flash, a new cyber-specialized model that extends the current agentic…
DocsInstall and run Defender CLIUpdated
Install and run Defender CLI Download and install Defender CLI, then run agentic code scans from the terminal.
- GA
Codename MDASH - MAI-Augmented scan profile now available for on-demand scans preview
Expanding on the previously released Defender CLI support, the MAI-Augmented scan profile is now also available in preview for on-demand scans triggered from the Microsoft Defender portal. Security teams can select this profile when starting an on-demand scan from the…
DocsCreate an Azure DevOps connector for agentic code securityUpdated
Create an Azure DevOps connector for agentic code security Connect your Azure DevOps organization to Microsoft Defender to enable remote on-demand agentic code scans across your repositories.
- New feature
OT data connectors in Microsoft Security Exposure Management
Microsoft Security Exposure Management now supports operational technology (OT) data connectors for Armis, Dragos, and Forescout. OT data connectors bring OT asset and vulnerability data from supported third-party OT platforms into the Defender portal. This helps security teams view OT…
DocsOT data connectors in Microsoft Security Exposure ManagementUpdated
OT data connectors in Microsoft Security Exposure Management Learn how OT data connectors enrich Microsoft Security Exposure Management with third-party operational technology asset and vulnerability data.
- Preview
Codename MDASH - Agentic code scanner private preview
Codename MDASH - Agentic code scanner is now available in private preview in Microsoft Security Exposure Management. Codename MDASH uses a multi-model agentic AI system to detect code vulnerabilities with greater depth and accuracy than traditional static analysis. Security teams…
DocsCodename MDASH OverviewUpdated
Codename MDASH Overview Learn how Codename MDASH - Agentic code scanner uses a multi-model agentic AI system to detect code vulnerabilities with depth and accuracy beyond traditional static analysis.
Posts this month: Prioritize exposure resolution with a new dashboard experience (public preview)
Microsoft Defender for Endpoint
10 changes · product page- GA
macOS release: Build 101.26062.0009
macOS release: Build 101.26062.0009. Release version 20.126062.9.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26052.0016
macOS release: Build 101.26052.0016. Release version 20.126052.16.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
iOS release: Build 1.1.78290102
iOS release: Build 1.1.78290102. Release version 1.1.78290102 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Defender Deployment Tool for Linux
Defender Deployment Tool for Linux. Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation…
DocsDeploy Microsoft Defender endpoint security to Linux devices using the …Updated
Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool (preview) Learn how to use the Defender deployment tool to install and onboard Microsoft Defender for Endpoint on Linux devices and verify deployment.
- Preview
AI agent runtime protection updates
AI agent runtime protection updates. AI agent runtime protection includes these enhancements: - Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI…
DocsAI Agent Runtime Protection with Microsoft Defender for Endpoint …New
AI Agent Runtime Protection with Microsoft Defender for Endpoint (Preview) Learn how Microsoft Defender for Endpoint provides runtime protection for local AI agents by detecting and blocking prompt injection attacks.
- Release
iOS · July 2026 · Platform Version: 1.1.79080103
Release details Platform version Release Date 1.1.79080103 July 20, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes.
- Release
iOS · July 2026 · Platform Version: 1.1.78290102
Release details Platform version Release Date 1.1.78290102 July 3, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes. Feature Improvement in compliance flow.
- Release
Windows Antivirus · July 2026 · Platform 4.18.26070.9 · Engine 1.1.26070.7
Release details Component Version Date Platform 4.18.26070.9 August 5, 2026 Engine 1.1.26070.7 August 5, 2026 Security intelligence 1 1.457.11.0 August 5, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Release
Linux · July 2026 · 101.26052.0012
Release details Release version Engine version Signature version 30.126052.0012.0 1.1.26040.3001 1.449.136.0 Enhancements and features Feature area Update summary Visibility Improved antivirus enforcement visibility. The mdatp health command now includes a new antivirus_enforcement_level field that shows whether antivirus is running in…
- Release
Android · July 2026 · Platform: 1.0.9107.0101
Release details Platform version Release Date 1.0.9107.0101 July 21, 2026 Enhancements and features Feature Area Update Summary General Performance improvements and general bug fixes.
Posts this month: Introducing scheduled antivirus scans on Microsoft Defender Linux
Microsoft Defender for Identity
8 changes · product page- GA
Domain investigation
(GA) The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more…
DocsInvestigate an Active Directory domainUpdated
Investigate an Active Directory domain Learn how to investigate an Active Directory domain in Microsoft Defender. Review domain health scores, security policies, trust relationships, and recommendations.
- GA
General availability of the Domain investigation page
The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information…
DocsInvestigate an Active Directory domainUpdated
Investigate an Active Directory domain Learn how to investigate an Active Directory domain in Microsoft Defender. Review domain health scores, security policies, trust relationships, and recommendations.
- GA
General availability of sensor v2.x to v3.x migration
Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x .
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- New feature
Migration readiness reasons on the Sensors page
When a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see…
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- New feature
Migrate Windows Server 2025 domain controllers to sensor v3.x
You can now migrate domain controllers running Windows Server 2025 from sensor v2.x to sensor v3.x. For more information, see Migrate to Defender for Identity sensor v3.x .
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- New feature
Defender for Identity sensor updates
Version number Updates 2.255.19295.47272 This sensor update adds support for a new Event Tracing for Windows (ETW) provider and includes other improvements.
- New feature
Automatic RPC auditing on domain controllers
Defender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later. You no longer need to apply a tag manually to enable RPC auditing. For more information, see Configure RPC auditing…
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
- Preview
Expanded SaaS app support in Password protection (Preview)
The Password protection page now includes password risks from SaaS apps connected through Microsoft Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce…
DocsPassword protection in Microsoft DefenderUpdated
Password protection in Microsoft Defender Learn how the Password protection page in Microsoft Defender helps you find leaked credentials, exposed passwords, and weak password policies across your identity sources.
Microsoft Intune
16 changes · product page- New feature
Updated Visual Studio administrative templates in the Windows settings catalog
The Visual Studio administrative templates were refreshed to version 1.0.184.40051, which adds the latest Visual Studio policy settings to the Windows settings catalog. The new setting is: Disable Model Context Protocol (MCP) (DisableMCP) For more information, see the…
DocsAdmin controls for GitHub Copilot in Visual Studio - Visual Studio …UpdatedAdministrative Templates (ADMX) - Visual Studio (Windows)Updated
Admin controls for GitHub Copilot in Visual Studio - Visual Studio (Windows) Learn about the new features for administrators in GitHub Copilot for Visual Studio that enable admins to manage Copilot effectively.
- New feature
Skip Setup Assistant screens for tvOS and visionOS enrollment
Microsoft Intune now supports hiding or showing new Setup Assistant screens during automated device enrollment (ADE) for tvOS and visionOS devices. When you configure an enrollment profile, you can choose which screens, such as Apple ID , Diagnostics…
DocsSet up automated device enrollment (ADE) for tvOSSet up automated device enrollment (ADE) for visionOS
Set up automated device enrollment (ADE) for tvOS Learn how to enroll corporate-owned Apple TV devices into Microsoft Intune with Apple Automated Device Enrollment (ADE).
- New feature
Samsung Knox E-FOTA firmware update management for Android Enterprise devices
Microsoft Intune now integrates with Samsung Knox E-FOTA (Firmware Over-The-Air), so you can manage firmware updates for corporate-owned Samsung devices directly in the Microsoft Intune admin center. Control which firmware version each device receives, deploy updates without user…
DocsIntegrate Samsung Knox E-FOTA with Microsoft IntuneNew
Integrate Samsung Knox E-FOTA with Microsoft Intune Learn how to integrate Samsung Knox E-FOTA with Microsoft Intune to register Samsung devices, configure firmware updates, and monitor campaigns.
- New feature
Regional support for Microsoft Store apps
Microsoft Intune now supports regional selection for Microsoft Store apps. When you add a Microsoft Store app, you can choose the region (market) whose Store catalog to search and deploy from. Previously, Intune searched only the United States…
DocsAdd Microsoft Store Apps to Microsoft Intune
Add Microsoft Store Apps to Microsoft Intune Learn about adding Microsoft Store apps to Microsoft Intune.
- New feature
New settings available in the Windows settings catalog
Microsoft Intune now includes new settings in the Windows settings catalog for Windows devices. You can configure options for camera behavior, Keyboard Filter controls (for Windows Insider devices), and Windows Subsystem for Linux (WSL). To find them, go…
- New feature
New setting to disable the Get Started app
The new Disable Get Started setting prevents the Windows Get Started app from being available to users. For more information, see the Experience policy CSP . Applies to: Windows
DocsExperience Policy CSPNew
Experience Policy CSP Learn more about the Experience Area in Policy CSP.
- New feature
New option for the Remove Default Microsoft Store packages setting
The existing Remove Default Microsoft Store packages setting in the ApplicationManagement area has a new subsetting, Specify additional package family names to remove . It lets you provide a custom list of package family names (PFNs) to remove…
DocsApplicationManagement Policy CSPNew
ApplicationManagement Policy CSP Learn more about the ApplicationManagement Area in Policy CSP.
- New feature
New Windows App (Azure Virtual Desktop) settings in the Windows settings catalog
There are new Windows App settings in the Windows settings catalog. To see and configure them in Intune, create a Windows settings catalog profile ( Devices > Manage devices > Configuration > Create > New policy > Windows…
DocsConfigure Windows App Updates on WindowsUpdated
Configure Windows App Updates on Windows Learn how to configure Windows App update behavior on Windows, including automatic updates and registry settings.
- New feature
New OneDrive settings in the Windows settings catalog
There are new OneDrive settings in the Windows settings catalog: Set a custom name for the OneDrive folder – sets a custom name for the synced OneDrive folder on the user's device. Enable OpenID Connect (OIDC) authentication for…
DocsIT Admins - Use OneDrive policies to control sync settings - …New
IT Admins - Use OneDrive policies to control sync settings - SharePoint in Microsoft 365 Learn how admins can use OneDrive policies to configure the OneDrive sync app settings by using Group Policy.
- New feature
New Microsoft Edge settings in the Windows settings catalog
The Microsoft Edge administrative templates were refreshed to Microsoft Edge 149 (version 149.0.4022.21), which adds the latest Microsoft Edge 148 and 149 policy settings to the Windows settings catalog. The new settings are: Allow Local Fonts permission on…
DocsMicrosoft Edge Browser Policy Documentation LocalFontsAllowedForUrlsNewMicrosoft Edge Browser Policy Documentation LocalFontsBlockedForUrlsNewMicrosoft Edge Browser Policy Documentation …NewMicrosoft Edge Browser Policy Documentation …New
Microsoft Edge Browser Policy Documentation LocalFontsAllowedForUrls Windows and Mac documentation for supported Microsoft Edge Browser policy: Allow Local Fonts permission on these sites
- New feature
Improved on-demand device sync for Windows & iOS/iPadOS devices
Microsoft Intune now supports a more comprehensive on-demand sync for Windows and iOS/iPadOS devices. When you select the Sync device action in the Microsoft Intune admin center, Intune initiates a full synchronization across key workloads, including configuration policies…
Device Action: Sync Learn how to use the device sync action in Intune to apply policy, app, and configuration updates to managed devices.
- New feature
Dedicated RBAC permission for zero-touch enrollment
Microsoft Intune now provides a dedicated role-based access control (RBAC) permission for Google zero-touch enrollment portal access. Previously, the zero-touch enrollment iframe in the Microsoft Intune admin center required the Update app sync permission, which also grants rights…
DocsEnroll Android Enterprise dedicated, fully managed, or corporate-owned …New
Enroll Android Enterprise dedicated, fully managed, or corporate-owned work profile devices in Intune Learn how to enroll Android Enterprise dedicated, fully managed, or corporate-owned work profile devices in Intune.
- New feature
Custom compliance settings for macOS
Microsoft Intune now supports custom compliance settings for macOS. As an admin, you can define compliance checks using scripts and JSON rules, similar to existing support for Windows and Linux. This capability lets you evaluate device configuration, security…
DocsUse custom compliance settings in Microsoft IntuneUpdated
Use custom compliance settings in Microsoft Intune Manage custom compliance settings on managed devices by using JSON files and discovery scripts in Microsoft Intune.
- New feature
Collect Windows registry data with the properties catalog
Microsoft Intune now lets you collect Windows registry data through the properties catalog. When you create a device inventory policy, you can define specific registry keys and values to collect from enrolled Windows devices, including a single value…
DocsCollect Device Properties With Intune Properties CatalogUpdated
Collect Device Properties With Intune Properties Catalog Use Microsoft Intune properties catalog to collect device properties—including hardware, registry values, and security signals—from Windows devices.
- New feature
APP Multiple Managed Accounts
Microsoft Intune mobile application management now extends support for Multiple Managed Accounts to Microsoft Outlook on iOS/iPadOS (v5.2626.0 or later), letting users add and manage more than one managed account within the same app. Note This feature is…
DocsMultiple Managed Accounts for App Protection Policies
Multiple Managed Accounts for App Protection Policies Learn how the Multiple Managed Accounts (MMA) feature in Microsoft Intune MAM enables users to manage more than one work or school account within a single app.
- Preview
Controlled Configuration for Microsoft Defender antivirus settings (preview)
In preview, Microsoft Intune now supports Controlled Configuration for Microsoft Defender antivirus settings. When you enable it, the Defender antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management become authoritative and override configurations from…
DocsManage antivirus settings with endpoint security policies in Microsoft …
Manage antivirus settings with endpoint security policies in Microsoft Intune Configure and deploy policies and use reports for devices you manage with endpoint security antivirus policy in Microsoft Intune.
Posts this month: What’s new in Microsoft Intune – July · Registry Inventory in Microsoft Intune: Verifying What’s on Your Devices · From the frontlines: Frontline worker management with Microsoft Intune · From hours to minutes: Rethinking Microsoft Intune compliance reporting with the Export API · Designing Intune enrollment for frontline workers: Choosing the right path for real-world devices · Build a patch strategy for today’s threat pace with Microsoft
Microsoft Edge
11 changes · product page- Security update
Edge security update: Stable 151.0.4129.59 (15 CVEs)
Microsoft released the latest Microsoft Edge for Stable (Version 151.0.4129.59) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide This update contains the following Microsoft Edge specific security fixes: CVE-2026-65802 CVE-2026-65804…
DocsSecurity Update GuideCVE-2026-65802CVE-2026-65804CVE-2026-66310
- Security update
Edge security update: Android and iOS 150.0.4078.96
Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Stable 150.0.4078.99
Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.99) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Stable 150.0.4078.96
Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Android and iOS 150.0.4078.81
Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.81) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Stable 150.0.4078.83
Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.83) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Stable 150.0.4078.80
Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.80) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Android and iOS 150.0.4078.65
Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.65) which incorporates latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Stable 150.0.4078.65
Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.65) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Stable 150.0.4078.48
Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.48) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Android and iOS 150.0.4078.50
Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.50) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
Microsoft Defender for Cloud
6 changes · product page- Deprecation
Plan enablement API now blocks onboarding to five deprecated Defender plans
July 5, 2026 Effective immediately, onboarding is blocked through the plan-enablement API for five deprecated Microsoft Defender for Cloud pricing plans. This update aligns with Microsoft deprecation policy and matches existing portal behavior, where these plans are already blocked in…
- Deprecation
Deprecation completed: Legacy grouped recommendations removed from Azure portal
July 31, 2026 Retirement of legacy grouped recommendations (sub-assessments) has started. Customers can no longer access the deprecated data through the API. The Azure portal and Azure Resource Graph might take a few days to reflect the change. Individual recommendations…
DocsTransition from grouped to individual recommendations in Defender for …Updated
Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.
- GA
New container security capabilities are now generally available
July 1, 2026 The following container security capabilities in Microsoft Defender for Cloud are now generally available: Container-level misconfiguration recommendations for Kubernetes : Agentless, container-level KSPM recommendations in Defender CSPM that assess individual containers rather than entire clusters. The following…
DocsReference table for all container security recommendations in …Review and Remediate Kubernetes Node VulnerabilitiesUpdatedView and Remediate Vulnerabilities for Running ContainersUpdatedContainers support matrix in Defender for CloudUpdated
Reference table for all container security recommendations in Microsoft Defender for Cloud This article lists all Microsoft Defender for Cloud container security recommendations that help you harden and protect your resources.
- GA
Kubernetes misconfiguration enforcement in Defender for Containers is now generally available
July 1, 2026 Kubernetes misconfiguration enforcement in Microsoft Defender for Containers is now generally available. This feature evaluates Kubernetes resource configurations at admission time and can audit or block deployments that don't meet Microsoft security best-practice rules. With this release…
DocsKubernetes Misconfiguration EnforcementUpdated
Kubernetes Misconfiguration Enforcement Learn about Kubernetes misconfiguration enforcement in Microsoft Defender for Containers to audit or block misconfigured workloads at deployment time.
- GA
Discovery and posture for serverless container workloads is now generally available
July 1, 2026 Discovery and posture for serverless container workloads is now generally available in Microsoft Defender for Cloud. This capability provides inventory visibility, security recommendations for misconfigurations and vulnerability assessment findings, and attack path analysis for Azure Container Apps…
DocsDiscovery and posture for serverless container workloads
Discovery and posture for serverless container workloads Learn how Microsoft Defender for Cloud uses Defender cloud security posture management (Defender CSPM) to provide inventory, recommendations, and attack path visibility for serverless containers.
- GA
Database-level recommendations for SQL Vulnerability Assessment (GA)
July 26, 2026 The SQL vulnerability assessment recommendations created as part of the transition from grouped to individual recommendations are now generally available. Each SQL vulnerability assessment rule is surfaced as its own recommendation, reported directly on the affected SQL…
DocsTransition from grouped to individual recommendations in Defender for …UpdatedSQL vulnerability assessment rules referenceReview and remediate SQL vulnerability assessment findings
Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.
Posts this month: Built to Protect: The Architecture Behind Codename MDASH · 5 insights from Frost & Sullivan’s 2025 Frost RadarTM for Cloud Security Posture Management · Microsoft Defender for Cloud Customer Newsletter · Now generally available: Serverless posture coverage in Microsoft Defender CSPM
Microsoft Defender for Office 365
4 changes · product page- New feature
Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations
Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations : Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model…
DocsConfigure Unified RBAC for Microsoft Defender for Office 365MC1246006
Configure Unified RBAC for Microsoft Defender for Office 365 Step-by-step guide to configure and activate Microsoft Defender unified role-based access control (Unified RBAC) for Microsoft Defender for Office 365, including role creation, persona templates, and migration from legacy roles.
- New feature
Prompt injection protection
Prompt injection protection : Microsoft Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Microsoft Defender for Office 365 .
DocsPrompt injection protection in Microsoft Defender for Office 365
Prompt injection protection in Microsoft Defender for Office 365 Learn how Microsoft Defender for Office 365 detects prompt injection attacks hidden in email, how the detection technology works, and how it provides defense in depth for AI-based threats alongside built-in Microsoft Copilot protections.
- New feature
Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3
Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3 : Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365…
DocsWhy do I need Microsoft Defender for Office 365?
Why do I need Microsoft Defender for Office 365? Learn how Microsoft Defender for Office 365 protects email and collaboration from phishing, malware, and business email compromise with Plan 1 and Plan 2 features.
- New feature
Localized default Mark as and notify email templates
Localized default Mark as and notify email templates : When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more…
DocsAdmin review for user reported messagesNew
Admin review for user reported messages Admins can learn how to review messages that were reported by users and give them feedback.
Posts this month: Defending the Inbox Against Prompt Injection Attacks
Microsoft Purview
6 changes · product page- New feature
Shared capabilities
Update : Microsoft Purview role-group assignments can be configured with an expiration date so that access is revoked automatically. Temporary assignments can last from one day to two years and are supported by most built-in and custom role groups, except…
DocsPermissions in the Microsoft Purview portal
Permissions in the Microsoft Purview portal Learn about managing role group and role permissions for users who perform tasks in the Microsoft Purview portal.
- New feature
Information Protection
Updated : Added a checklist to help administrators understand auditing, regional availability, label scope, encryption settings, sensitive information types, file eligibility, and required roles before creating an auto-labeling policy. Updated : Troubleshoot why a specific SharePoint or OneDrive file was…
DocsAutomatically apply a sensitivity label to Microsoft 365 dataNew
Automatically apply a sensitivity label to Microsoft 365 data When you create a sensitivity label, you can automatically assign a label to data stored in Microsoft 365, or you can prompt users to select the label that you recommend.
- New feature
Data lifecycle management
Updated : Priority cleanup policies now require three separate approvals before content can be permanently deleted: one Priority Cleanup administrator, one retention manager, and one eDiscovery administrator.
DocsUse priority cleanup to expedite the permanent deletion of sensitive …
Use priority cleanup to expedite the permanent deletion of sensitive information from mailboxes Use priority cleanup to expedite the permanent deletion of sensitive information from mailboxes, even if they have existing holds for retention or eDiscovery.
- New feature
Data Governance
Updated : Microsoft Purview protection policies no longer support Azure SQL Database . New : Configure a manual business continuity and disaster recovery environment for Microsoft Purview Data Map . The guidance covers creating a secondary account, mirroring scans, validating…
DocsData sources that connect to Microsoft Purview Data MapDisaster Recovery for Microsoft Purview Data Map
Data sources that connect to Microsoft Purview Data Map Learn about the data sources and file types that can connect to Microsoft Purview Data Map.
- Preview
Insider Risk Management
In preview : Unified alert experience combines the Triage Agent and Standard alert dashboards into a single alerts list page. View and manage both classic and agent-triaged alerts from one location, with the ability to preview agent summaries, alert and…
DocsInvestigate Microsoft Purview Insider Risk Management activitiesManage the workflow with the Insider Risk Management users dashboardTake action on Insider Risk Management cases
Investigate Microsoft Purview Insider Risk Management activities Learn how to investigate and triage Insider Risk Management alerts in Microsoft Purview. Review risk factors, explore activities, and create cases.
- Preview
Data Loss Prevention
In preview : Protect sensitive data in text and prompts by integrating with Microsoft Entra Global Secure Access (GSA). This integration enables organizations to intercept and inspect text and AI interactions at the network layer, enforce restrictive actions based on…
DocsLearn about Microsoft Purview Network Data SecurityUpdatedConfigure default protection for classification failures in DLP for …Get started with DLP for Fabric and Power BI
Learn about Microsoft Purview Network Data Security Network data security extends Microsoft Purview classification to network traffic
Built from the What's New and release-notes pages on Microsoft Learn. Entries are grouped by the month Microsoft lists them under (or, for changes detected later, the month we detected them). Every title links to the exact section on Microsoft Learn.