What's new in Microsoft Security: August 2026
Every Microsoft Security update in August 2026: 57 documentation changes and 108 official posts across Sentinel, Defender, Entra, Intune, Purview and Security Copilot, with GA and preview releases, retirements and links to the sources.
Announcements
Purview
Close the gaps: layered data protection with Microsoft Purview across endpoint, browser, and network
Three layers that work like a good team and slides to show it Data Loss Prevention (DLP) is not new, many use it daily without ever even knowing it, but with AI bringing…
Microsoft Purview BlogSentinel
Introducing Multi-Account Support for Connectors in Microsoft Sentinel
We're excited to announce that Microsoft Sentinel's data connectors for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud now support multi-account ingestion…
Microsoft Security Community BlogIntune
From GPO to Microsoft Intune: A practical guide to cloud-first policy management
By: Per Larsen - Senior Product Manager | Microsoft Intune For many organizations, Group Policy Objects (GPOs) remain an important part of Windows configuration.
Intune Customer SuccessSentinel
What’s new in Microsoft Sentinel: August 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSentinel
One SOC, Many Tenants: Centralizing Microsoft Sentinel with Azure Lighthouse
Most large organizations don’t live in a single Microsoft Entra ID tenant.
Microsoft Security Community BlogEdge
Security baseline for Microsoft Edge version 151
We are pleased to announce the enterprise-ready release of the security baseline for Microsoft Edge version 151!
Microsoft Security Baselines BlogThreat Intelligence
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting…
Microsoft Threat IntelligenceIntune
What’s new in Microsoft Intune – August
At scale, endpoint management becomes a different job. A two-minute task on one device can become months of work across thousands of devices.
Microsoft Intune BlogMicrosoft Security
What’s new in Microsoft Security: August 2026
This month’s updates provide new capabilities to help organizations gain insights into agent activity, expand security coverage across supported environments, and…
Microsoft Security BlogIntune
Introducing device association for Windows Autopilot device preparation
By: Maggie Dakeva, Senior Product Manager - Microsoft Intune We’ve heard organizations want Windows deployment to be simple for employees and predictable for IT admins.…
Intune Customer SuccessSentinel
[Salesforce] - Corrected the parser metadata version
Reverted back the parser version from 3.x.x to 1.0.1…
Azure-Sentinel contentAzure securityGA
Generally Available: Azure Bastion shareable link expiration
Azure Bastion shareable link expiration is now generally available.
Azure UpdatesAzure securityPreview
Public Preview: IPv6 dual-stack support for Azure Bastion
Azure Bastion support for IPv4 and IPv6 dual-stack configurations is now available in public preview.
Azure UpdatesAzure securityGA
Generally Available: Connect to AKS clusters using Azure Bastion
Azure Bastion integration with Azure Kubernetes Service is now generally available.
Azure UpdatesAzureGA
Generally Available: Azure SRE Agent VNet Integration
Azure SRE Agent VNet Integration is now generally available.
Azure UpdatesMicrosoft Security
When AI infrastructure becomes the target: Securing gateways and control points
Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining…
Microsoft Security BlogMicrosoft Security
The patch window is collapsing: Why security needs a new control plane
Organizations need protection that operates in the gap between discovery and remediation.
Microsoft Security BlogAzure securityGA
Generally Available: Custom block response code and body for Application Gateway WAF
Announcing the General Availability of custom block response code and body for WAF integrated with Application Gateway Azure WAF integrated with Application Gateway now…
Azure UpdatesIntune
Support tip: Restore the Managed Home Screen Exit PIN
We identified and resolved a recent issue (IT1450132) that could cause the configured Managed Home Screen exit PIN to be removed from some existing Android Enterprise…
Intune Customer SuccessEntra
Microsoft Entra ID enhances security of branded sign-ins
Microsoft Entra ID blocks custom CSS positioning properties to help deliver more secure and trusted branded sign-ins.
Microsoft Entra BlogMicrosoft Security
Microsoft named a Leader in the Frost RadarTM: Cloud Workload Protection Platforms, 2026
Microsoft is named a visionary leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, recognized for unified runtime security with Microsoft Defender…
Microsoft Security BlogIntune
Configure Delivery Optimization for Windows to save bandwidth and speed up deployments
Intune Customer SuccessSentinel
Smarter signals, broader coverage: UEBA anomalies on top of Behaviors layer and new data sources
Co-authors: Ron Shlomo and Ryan Smith Security teams don't struggle with a lack of security signals.
Microsoft Sentinel BlogAzure securityPreview
Public Preview: Ipv6 support in Azure Firewall
Azure Firewall now supports IPv6 in public preview, enabling customers to configure Azure Firewall and Firewall Policy in dual-stack mode for both IPv4 and IPv6 traffic.
Azure UpdatesMicrosoft Security
Hunting MacSync Stealer infrastructure through behavioral pivots
MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent.
Microsoft Security BlogEntra
Why Active Directory alone is no longer enough
Most organizations have moved their applications, devices, and business processes to the cloud, but identity often remains dependent on Active Directory.
Microsoft Entra BlogEdge
Security Review for Microsoft Edge version 150
We have reviewed the new settings in Microsoft Edge version 150 and determined that there are no additional security settings that require enforcement.
Microsoft Security Baselines BlogIntune
Support tip: Known issues in reporting and viewing compliance policies
The Intune team is aware of compliance reporting behavior in the Microsoft Endpoint Manager admin center that causes confusion among some of our customers.
Intune Customer SuccessSentinelRetirement
Retirement: Containerized data connector agent for the Microsoft Sentinel solution for SAP applications
On September 14, 2026 we will retire the containerized data connector agent for the Microsoft Sentinel solution for SAP applications.
Azure UpdatesAzure securityPreview
Public Preview: Azure Front Door mutual TLS
Mutual TLS, also known as client certificate authentication, enables Azure Front Door to authenticate clients using X.509 certificates before requests reach an…
Azure UpdatesEntra
How to enforce Zero Trust across every resource
This post builds on the strategic foundations introduced in End VPN gaps with identity-first access .
Microsoft Entra BlogAzure securityGA
Generally Available: 2.2X IDPS performance optimization in Azure Firewall
Azure Firewall Premium now delivers up to 22 Gbps throughput with TLS inspection and IDPS in Deny mode, a 120% increase from 10 Gbps, and up to 600 Mbps per TCP…
Azure UpdatesSentinel
Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent
Overview We previously announced the public preview of the Microsoft Sentinel connector builder agent via VS code extension, that helps developers build Microsoft…
Microsoft Sentinel BlogDefender XDR
MDTI is Converging into Microsoft Sentinel and Defender XDR
In today’s rapidly evolving threat landscape, organizations need threat intelligence (TI) that is woven seamlessly into every step of their security…
Microsoft Defender XDR BlogThreat Intelligence
What’s New at Ignite: Powerful Enhancements in Unified Threat Intelligence
At Microsoft Ignite 2025, we’re unveiling transformative upgrades in threat intelligence designed to empower security teams.
Microsoft Defender XDR BlogThreat Intelligence
Introducing the Threat Intelligence Briefing Agent
As cyber threats rapidly evolve, security teams are overwhelmed by the sheer volume of threat intelligence, making it challenging to deliver timely, targeted…
Microsoft Defender XDR BlogSecurity Copilot
New at Ignite: TI Guided Experience in Security Copilot
The Security Copilot team is consistently improving the threat intelligence (TI) experience for customers.
Microsoft Defender XDR BlogSecurity Copilot
New Security Copilot Plugin Name Reflects Broader Capabilities
The Copilot for Security team is continuously enhancing threat intelligence (TI) capabilities in Copilot for Security to provide a more comprehensive and…
Microsoft Defender XDR BlogThreat Intelligence
Introducing the MDTI Home Page Widget and Article Digest
The MDTI team is excited to introduce the MDTI Article Digest, a new way for customers to stay up to speed with the latest analysis of threat activity…
Microsoft Defender XDR BlogThreat Intelligence
Introducing the MDTI Premium Data Connector for Sentinel
The MDTI and Unified Security Operations Platform teams are excited to introduce an MDTI Premium data connector available in the Unified Security Operations…
Microsoft Defender XDR BlogThreat Intelligence
More Threat Intelligence Content In MDTI, TA Enables Better Security Outcomes
Microsoft threat intelligence empowers our customers to keep up with the global threat landscape and understand the threats and vulnerabilities most…
Microsoft Defender XDR BlogThreat Intelligence
MDTI Earns Impactful Trio of ISO Certificates
We are excited to announce that Microsoft Defender Threat Intelligence (MDTI) has achieved ISO 27001, ISO 27017 and ISO 27018 certifications.
Microsoft Defender XDR BlogDefender XDR
Introducing Automatic File and URL (Detonation) Analysis
We are excited to announce the new file and URL intelligence (detonation) enhancement made in our Threat Intelligence blade within the Defender XDR user…
Microsoft Defender XDR BlogThreat Intelligence
Unified MDTI APIs in Microsoft Graph Now GA
We’re thrilled to share that the unified APIs that are part of the Microsoft Graph are now generally available!
Microsoft Defender XDR BlogThreat Intelligence
MDTI Adds Microsoft Threat Intelligence to Silobreaker
Microsoft Defender Threat Intelligence (MDTI) adds Microsoft Threat Intelligence reputation enrichment to Silobreaker!
Microsoft Defender XDR BlogThreat Intelligence
How MDTI Helps Power Copilot for Security
This blog post will delve into Copilot for Security, focusing on the strategic utilization of Microsoft Defender Threat Intelligence (MDTI), a comprehensive…
Microsoft Defender XDR BlogThreat Intelligence
Using MDTI with the Diamond Model for Threat Intelligence
Microsoft Defender Threat Intelligence (MDTI) provides robust tools and features that enable security analysts to quickly investigate incidents and respond…
Microsoft Defender XDR BlogDefender XDR
What's New at Microsoft Ignite 2023
The Microsoft Defender Threat Intelligence team (MDTI) continuously introduces innovations that make its strategic, tactical, and operational threat…
Microsoft Defender XDR BlogThreat Intelligence
Unleash the Power of Threat Intel: Introducing the MDTI GitHub
Are you looking to enhance your organization's security processes?
Microsoft Defender XDR BlogThreat Intelligence
What's New: MDTI Intel Reporting Dashboard and Workbook
We are excited to announce the launch of a new dashboard that we have created to enhance our threat intelligence reporting capabilities.
Microsoft Defender XDR BlogThreat Intelligence
New Threat Actor Intel Profiles Added to MDTI
The Microsoft Defender Threat Intelligence (Defender TI) team has recently launched twenty-six new threat actor Intel Profiles, and more than 50 additional…
Microsoft Defender XDR BlogDefender XDR
What’s New: MDTI Interoperability with Microsoft 365 Defender
Microsoft Defender Threat Intelligence (MDTI) helps streamline security analyst triage, incident response, threat hunting, and vulnerability management…
Microsoft Defender XDR BlogDefender XDR
What's New: APIs in Microsoft Graph
Unified APIs part of the Microsoft Graph with a single endpoint, permissions, auth model, and access token are now available.
Microsoft Defender XDR BlogThreat Intelligence
What's New: MDTI Microsoft Sentinel Playbooks
During Microsoft Secure, we announced new capabilities that help enterprise users power up automation with Defender Threat intelligence, including an…
Microsoft Defender XDR BlogDefender XDR
What's New: Intel Profiles Deliver Crucial Information, Context About Threats
Microsoft is thrilled to introduce Intel Profiles within Microsoft Defender Threat Intelligence.
Microsoft Defender XDR BlogDefender XDR
What's New at Microsoft Secure
Today, we are excited to announce several new features and capabilities that put more threat actor insights at our customers' fingertips and enhance SIEM…
Microsoft Defender XDR BlogThreat Intelligence
Performing a Successful MDTI Proof of Concept (PoC)
To effectively determine the benefits of adopting Defender Threat Intelligence, you should perform a Proof of Concept (PoC).
Microsoft Defender XDR BlogDefender for Cloud
Microsoft Defender for Cloud and Defender for Threat Intelligence are Better Together
When used together, Microsoft Defender for Cloud (MDC) and Microsoft Defender Threat Intelligence (MDTI) enable analysts to quickly understand exposures and…
Microsoft Defender XDR BlogThreat Intelligence
Infrastructure Chaining with Microsoft Defender Threat Intelligence
Infrastructure Chaining is used to investigate the relationships between connected datasets which allows an analyst to develop an investigation into events…
Microsoft Defender XDR BlogThreat Intelligence
Become a Microsoft Defender Threat Intelligence Ninja: The complete level 400 training
Learn how to become a Microsoft Defender Threat Intelligence (MDTI) Ninja!
Microsoft Defender XDR BlogThreat Intelligence
What's in an MDTI Web Crawl?
Want to learn how data found from the DOM of web pages is so powerful when it comes to investigating threats?
Microsoft Defender XDR BlogThreat Intelligence
Introducing Microsoft Defender Threat Intelligence Community
Come learn about the differences between Microsoft Defender Threat Intelligence's Community vs. Premium level of access.
Microsoft Defender XDR BlogThreat Intelligence
Understanding and Using Finished Threat Intelligence
Raw versus finished cyber threat intelligence? What's the difference and why should I care about both? Check out this blog to learn why!
Microsoft Defender XDR BlogThreat Intelligence
Getting the Most Out of Projects in Defender TI
Want to learn about an easier way to collaborate with peers during investigations? Look no further!
Microsoft Defender XDR BlogDefender XDR
Using Reputation and Analyst Insights Features For Quick Indicator Assessments
Understanding if a host, domain, or IP address is good, bad, or otherwise, can be difficult during your security incident triage process.
Microsoft Defender XDR BlogThreat Intelligence
Getting Started with Microsoft Defender Threat Intelligence
So you're interested in Microsoft Defender Threat Intelligence, but don't know where to start?
Microsoft Defender XDR BlogDefender XDR
Get to Know the Datasets and How to Use Them During Investigations
The internet can be confusing sometimes. Understanding its datasets doesn't have to be.
Microsoft Defender XDR BlogThreat Intelligence
Defender TI Detections in Microsoft Sentinel
Did you know that you can benefit from Microsoft Defender Threat Intelligence if you're a Microsoft Sentinel customer?
Microsoft Defender XDR BlogDefender XDR
Exploring Target User Functions and Use Cases
Microsoft Defender Threat Intelligence seems like an awesome product, but what are its use cases and who should use it? Check out this blog to learn more.
Microsoft Defender XDR BlogThreat Intelligence
How Microsoft Defender Threat Intelligence Enables Threat Hunting Success
Microsoft Defender Threat Intelligence (MDTI) is powerful in the hands of a threat hunter. In this blog, we’ll show you why.
Microsoft Defender XDR BlogThreat Intelligence
How Internet Telemetry Data Becomes Threat Intelligence
So how does Microsoft Defender Threat Intelligence collect, analyze, and index its raw public internet telemetry data? Check out this blog to learn more.
Microsoft Defender XDR BlogThreat Intelligence
Welcome to the Microsoft Defender Threat Intelligence Tech Community
The Microsoft Defender Threat Intelligence (DTI) Tech Community will offer the latest content on how you and your team can get the most out of DTI's…
Microsoft Defender XDR BlogThreat Intelligence
We Are Pleased To Introduce the Microsoft Defender Threat Intelligence Ninja Training Series!
Microsoft has introduced Microsoft Defender Threat Intelligence (MDTI) Level 400 Ninja Training.
Microsoft Defender XDR BlogThreat Intelligence
New at Ignite: Unified Threat Intelligence Experience in Security Copilot
The Security Copilot team is continuously enhancing threat intelligence (TI) capabilities in Copilot.
Microsoft Defender XDR BlogThreat IntelligenceGA
MDTI for Government Now Available
We are thrilled to introduce Microsoft Defender Threat Intelligence (MDTI) with FedRAMP High (DOD IL2) attestation are now available for government sectors…
Microsoft Defender XDR BlogThreat Intelligence
MDTI Achieves PCI DSS Certification: Elevating Security Standards
We are excited to announce that MDTI has successfully obtained the Payment Card Industry Data Security Standard (PCI DSS) certification, representing a…
Microsoft Defender XDR BlogDefender XDRRetirement
MDTI Standalone Portal Retirement and Transition to Defender XDR
On June 30th, 2024, the Microsoft Defender Threat Intelligence (MDTI) standalone portal will reach end-of-life and the Microsoft Defender XDR portal will…
Microsoft Defender XDR BlogThreat Intelligence
Managing “Defender Threat Intelligence” MDTI Premium licenses in Microsoft Entra Admin Center
Learn how to manage MDTI Premium seat assignments in your Microsoft Entra Admin Center.
Microsoft Defender XDR BlogDefender XDR
Introducing MDTI Free Experience for Microsoft Defender XDR
Now available in all Microsoft Defender XDR tenants.
Microsoft Defender XDR BlogDefender XDR
What's New: Hash and URL Search Intelligence
Microsoft Defender Threat Intelligence (Defender TI) now includes File Hash and URL Search capabilities, enabling researchers, analysts, hunters, and…
Microsoft Defender XDR BlogThreat Intelligence
MDTI empowers defenders to get more done with less
A recent peer-reviewed commentary published by the Sans Institute explores the critical role of cyber threat intelligence in attack surface management…
Microsoft Defender XDR BlogThreat Intelligence
Microsoft Defender Threat Intelligence Overview, Concepts, and Vocabulary
Never heard of Microsoft Defender Threat Intelligence? No matter! This blog walks you through an overview of our product.
Microsoft Defender XDR BlogEntraGA
Microsoft Entra Tenant Governance is now generally available
Today, we’re excited to announce the general availability of Microsoft Entra Tenant Governance, a built-in capability that helps organizations centrally govern and…
Microsoft Entra BlogMicrosoft Security
MCP safety & evaluation with the Agent 365 CLI & Agent Governance Toolkit
Co Author: JiteshThakur AI agents are useful because they can act. They call tools, query databases, send messages, and hand work to other agents.
Microsoft Security Community BlogMicrosoft Security
Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
Microsoft is named a Leader in the 2026 IDC MarketScape for MDR services.
Microsoft Security BlogThreat Intelligence
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to…
Microsoft Threat IntelligenceSentinelGA
AI-powered playbook generator, now available to more customers
We’re excited to announce we’re making it easier than ever to go from intent to action with the AI-powered playbook generator now available to more customers.
Microsoft Sentinel BlogSentinelPreview
Public Preview: Nested API Support Comes to Microsoft Sentinel CCF
Microsoft Sentinel continues to evolve its capabilities to support an expanding ecosystem of partners and data integrations.
Microsoft Sentinel BlogDefender XDR
Monthly News-August 2026
Microsoft Defender Monthly news - August 2026 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the…
Microsoft Defender XDR BlogMicrosoft Security
Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP)
Learn why KuppingerCole named Microsoft a Leader in its Leadership Compass: Cloud Native Application Protection Platforms report.
Microsoft Security BlogSentinel
Building a CCF Nested API Pull Connector: A Technical Lab Walkthrough
This post walks through building a Microsoft Sentinel Codeless Connector Framework (CCF) RestApiPoller connector that uses the nested API polling pattern.
Microsoft Sentinel BlogThreat Intelligence
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate.
Microsoft Threat IntelligenceExposure ManagementGA
Containment Strategies for AI now available in Secure Now
Recent public disclosures have reinforced why building foundational security matters.
Microsoft Security Exposure Management BlogEntra
End VPN gaps with identity-first access
Traditional VPNs extend network access—but they were not built continuously evaluate identity, device posture, location, user risk, or session context.
Microsoft Entra BlogAzure securityGA
Generally Available: Explicit proxy in Azure Firewall
Azure Firewall explicit proxy is now generally available.
Azure UpdatesDefender for Endpoint
Become a Microsoft Defender for Endpoint Ninja
Do you want to become a ninja for Microsoft Defender for Endpoint? We can help you get there!
Microsoft Defender for Endpoint BlogDefender XDR
Become a Microsoft Defender XDR Ninja
Become a Microsoft Defender XDR Ninja…
Microsoft Defender XDR BlogThreat Intelligence
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates.
Microsoft Threat IntelligenceMicrosoft Security
Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps
Microsoft expands its Zero Trust for AI strategy to enhance security for AI and DevSecOps environments with new tools and guidance.
Microsoft Security BlogMicrosoft Security
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET
Microsoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread.
Microsoft Security BlogEntra
Microsoft Entra ID security updates: What organizations need to do now
Prepare now for three Microsoft Entra ID changes affecting Custom controls, credential registration, and SSPR enforcement.
Microsoft Entra BlogDefender for Cloud
Microsoft Defender for Cloud Customer Newsletter
*This will be the last monthly MDC newsletter. To keep up with the latest, please visit: What's new in MDC What's new in Defender for Cloud?
Microsoft Defender for Cloud BlogMicrosoft SecurityGA
Secure by default: Trusted Launch as Default is now Generally Available
We are excited to announce that Trusted Launch as Default (TLaD) is now Generally Available for new Azure Generation 2 (Gen2) virtual machines (VMs) and virtual machine…
Microsoft Security Community BlogMicrosoft Security
Why AI Agents May Require a New Security Operations Model
Organizations are rapidly adopting AI agents to retrieve data, invoke tools, automate workflows, interact with applications, and increasingly make decisions on behalf of…
Microsoft Security Community BlogMicrosoft Security
From AI Experiments to Digital Workforce: Do Enterprises Need a Chief Agent Officer?
As organizations move from deploying a handful of AI copilots to managing fleets of task-specific agents, a new challenge is emerging - Ownership.
Microsoft Security Community BlogMicrosoft SecurityGA
Writeback for Cloud-Managed Remote Mailboxes: Now Generally Available
Writeback for cloud-managed remote mailboxes is now Generally Available!
Microsoft Tech Community
Retirements and deprecations
All retirements| Effective | What's changing | Product | Type | Source |
|---|---|---|---|---|
| —not stated | Breaking change: Unused actions no longer included in AWS and GCP overprovisioned identity assessments Any workflows or processes that rely on the Unused actions list within Defender for Cloud CIEM will no longer be available for AWS and GCP recommendations. Action may be required | Defender for Cloud | Retirement | Microsoft Learn |
| —not stated | Classic Defender for SQL APIs retirement Classic Defender for SQL APIs retirement. | Defender for Cloud | Retirement | Microsoft Learn |
| —not stated | Containerized data connector agent for the Microsoft Sentinel solution for SAP applications Retirement: Containerized data connector agent for the Microsoft Sentinel solution for SAP applications. | Sentinel | Retirement | Azure Updates |
| —not stated | MDTI Standalone Portal Retirement and Transition to Defender XDR MDTI Standalone Portal Retirement and Transition to Defender XDR. | Defender XDR | Retirement | Microsoft Defender XDR Blog |
Microsoft Sentinel
3 changes · product page- New feature
SAP solution releases
The SAP agentless solution version 1.1.12 adds audit log performance enhancements and the force-sal-filesystem parameter. The SAP BTP solution version 3.1.1 adds an analytic rule for unaudited custom apps with login-only activity and renames analytic rules with the SAP BTP…
DocsSAP agentless solutionSAP BTP solutionSAP LogServ solution
- Preview
UEBA anomalies on behaviors (Preview)
Microsoft Sentinel now adds contextual anomaly insights directly to UEBA behavior records. These insights help analysts identify first-seen activity, unusually high behavior volumes, uncommon values, and threat intelligence matches without manually correlating raw events. For more information, see Investigate anomalies…
DocsInvestigate anomalies on UEBA behaviors in Microsoft Sentinel
Investigate anomalies on UEBA behaviors in Microsoft Sentinel Learn how Microsoft Sentinel enriches UEBA behaviors with anomaly insights and how to query these insights in the Microsoft Defender portal.
- Preview
New data sources for UEBA behaviors and anomaly detection (Preview)
Microsoft Sentinel UEBA expands coverage with new data sources for both the behaviors layer and anomaly detection. Fortinet FortiGate behaviors The UEBA behaviors layer now supports Fortinet FortiGate firewall events from the CommonSecurityLog table. More than 40 new behaviors identify…
Posts this month: Introducing Multi-Account Support for Connectors in Microsoft Sentinel · What’s new in Microsoft Sentinel: August 2026 · One SOC, Many Tenants: Centralizing Microsoft Sentinel with Azure Lighthouse · [Salesforce] - Corrected the parser metadata version · Smarter signals, broader coverage: UEBA anomalies on top of Behaviors layer and new data sources · Retirement: Containerized data connector agent for the Microsoft Sentinel solution for SAP applications
Microsoft Security Exposure Management
3 changes · product page- GA
Codename MDASH - Azure DevOps connector preview
The Azure DevOps connector is now available in preview for Codename MDASH - Agentic code scanner. Security teams can connect Azure DevOps organizations from the Microsoft Defender portal, onboard repositories, and trigger remote on-demand agentic code scans for the onboarded…
DocsCreate an Azure DevOps connector for agentic code securityUpdated
Create an Azure DevOps connector for agentic code security Connect your Azure DevOps organization to Microsoft Defender to enable remote on-demand agentic code scans across your repositories.
- New feature
Keyless authentication for the Microsoft Foundry connection preview
You can now connect your Microsoft Foundry resource to codename MDASH using Keyless authentication , the recommended method. Keyless relies on a managed identity instead of a stored secret - no API key is kept in Defender, and there's no…
DocsSet up Microsoft Foundry for Codename MDASH - Agentic code scanner …Updated
Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration Connect Codename MDASH - Agentic code scanner to your Microsoft Foundry project by creating a resource, deploying the required models, and providing the project endpoint and API key.
- New feature
Codename MDASH - Cancel scan
Scan cancellation, previously available only in Defender CLI, is now also available in the Microsoft Defender portal. You can cancel queued or running scans from the scan details page in the Scans tab. For more information, see Cancel scan .
DocsCodename MDASH - Agentic code scanner initiativeUpdated
Codename MDASH - Agentic code scanner initiative Learn how to use the Codename MDASH - Agentic code scanner initiative page in Microsoft Defender to triage and remediate code-level weaknesses detected by agentic code scanning.
Posts this month: Containment Strategies for AI now available in Secure Now
Microsoft Defender for Endpoint
7 changes · product page- GA
macOS release: Build 101.26062.0012
macOS release: Build 101.26062.0012. Release version 20.126062.12.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
macOS release: Build 101.26062.0011
macOS release: Build 101.26062.0011. Release version 20.126062.11.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Offboarding API support for Linux
Offboarding API support for Linux. Enables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale. Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007…
Offboard machine API Learn how to use an API to offboard a device from Microsoft Defender for Endpoint.
- Preview
Tamper protection in audit mode for Linux
Tamper protection in audit mode for Linux. Detects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking…
DocsUse tamper protection in audit mode for Microsoft Defender for …
Use tamper protection in audit mode for Microsoft Defender for Endpoint on Linux Learn how to verify, test, and investigate tamper protection in audit mode for Microsoft Defender for Endpoint on supported Linux devices.
- Preview
Antivirus audit mode for Linux
Antivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…
DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated
Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.
- Release
Windows Antivirus · August 2026-2 · Platform 4.18.26080.4 · Engine 1.1.26080.3
Release details Component Version Date Platform 4.18.26080.4 September 17, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Release
Windows Antivirus · August 2026 · Platform 4.18.26080.3 · Engine 1.1.26080.3
Release details Component Version Date Platform 4.18.26080.3 September 1, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …ASR rules overview
ASR rules overview Learn about attack surface reduction (ASR) rules in Microsoft Defender Antivirus, including requirements, configuration methods, modes, exclusions, and policy conflict resolution.
Posts this month: Become a Microsoft Defender for Endpoint Ninja
Microsoft Defender for Identity
2 changes · product page- New feature
Expanded automatic auditing support for AD CS, AD FS, and Entra Connect servers
Automatic Windows event auditing now configures auditing for AD FS, AD CS, and Microsoft Entra Connect. Auditing is configured automatically on any eligible server that runs Defender for Identity sensor v3.x, including servers that aren't domain controllers. For more information…
DocsConfigure Windows event auditingNew
Configure Windows event auditing Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.
- New feature
Defender for Identity sensor updates
Version number Updates 2.255.19347.63719 This sensor update includes security improvements.
Microsoft Intune
22 changes · product page- GA
Operating system version property in assignment filters is generally available
The operatingSystemVersion property in assignment filters is now generally available for managed devices and managed apps. Use this property to create filter rules that scope your app and policy assignments to devices running a specific OS version or…
DocsAssignment filter properties and operators referenceNewCreate assignment filters in Microsoft Intune
Assignment filter properties and operators reference Reference guide for device and app properties, operators, and rule syntax when creating assignment filters in Microsoft Intune. Includes examples and supported values.
- GA
Newly available protected apps for Intune
The following protected apps are now available for Microsoft Intune: Notion by Notion Labs Superhuman Mail by Superhuman Labs Calven by Calven Pty Limited Heijmans by Heijmans Notability by Ginger Labs, Inc. (iOS) Ben for Intune by Thanks…
DocsSupported Microsoft Intune AppsUpdated
Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.
- New feature
Windows 365 for Agents security baseline
Microsoft Intune now includes a security baseline for Windows 365 for Agents Cloud PCs. Administrators can deploy and customize recommended, device-scoped settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint to establish a consistent security posture…
DocsWhat is Windows 365 for Agents?Configure security baseline policies in Microsoft Intune
What is Windows 365 for Agents? Overview of Windows 365 for Agents, a platform where customers can deploy computer-using agents securely and at scale on Cloud PCs.
- New feature
View expanded SIM inventory for corporate-owned Android devices
Microsoft Intune now surfaces expanded SIM inventory for corporate-owned Android Enterprise devices, including EIDs, multiple ICCIDs, and activation state. View these details under Devices > All devices > select a device > Hardware , and use the reported…
- New feature
Unattended Remote Help sessions for Windows devices
[Advanced capabilities (formerly "Microsoft Intune Suite")] Microsoft Intune now supports unattended Remote Help sessions on physical Windows devices. Authorized helpdesk agents can sign in to a remote device with their own credentials without requiring the user to be present or…
DocsPlan for Remote Help with Microsoft IntuneUpdated
Plan for Remote Help with Microsoft Intune Learn about the requirements and capabilities of Remote Help with Microsoft Intune on Windows, macOS, and Android Enterprise.
- New feature
Skip new Apple Setup Assistant panes during enrollment
Microsoft Intune now includes Apple OS 27 Setup Assistant skip keys for Liquid Glass and Accessibility Appearance in Automated Device Enrollment profiles. You can hide these panes to reduce setup interactions and provide a more consistent enrollment experience…
- New feature
Separate device and work profile passwords on Android Enterprise devices
Microsoft Intune now supports the Block one lock for device and work profile setting in the Android Enterprise settings catalog, letting you require separate locks for the device and work profile instead of a shared one. Set it…
- New feature
Remove eSIMs during a device wipe with a settings catalog policy
Microsoft Intune now supports the Remove all eSIMs during a device wipe setting in the Android Enterprise settings catalog. Set it to True to request removal of all eSIMs when a corporate-owned device is wiped while the policy…
- New feature
Remove an individual eSIM from a corporate-owned Android device
Microsoft Intune now lets you remove a single eSIM from a corporate-owned Android Enterprise device without wiping it. Turn on Preview new device view , select the device, copy the eSIM's ICCID from device inventory, then select Remove…
- New feature
New updates to the Apple settings catalog
Microsoft Intune now supports new Settings Catalog options for testing on the OS 27 betas, covering Declarative Device Management areas such as App Settings , Web Content Filter , and Siri Settings for iOS/iPadOS and macOS. Configure them…
DocsCreate a policy using settings catalog in Microsoft IntuneNew
Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…
- New feature
New single device page in the Intune admin center
The new single device page is turned on by default for all customers. You can use the Preview new device view toggle to turn it off and return to the original device page. In the Intune admin center…
- New feature
New policy settings for Windows
Microsoft Intune now includes new Windows settings catalog options across several administrative template refreshes. Highlights include Turn on Protected Mode controls for Internet Explorer security zones, new Microsoft Edge policies from the Edge 150 template refresh, and a…
- New feature
Memory scan setting for Microsoft Defender Antivirus on Linux
Microsoft Intune now supports a memory scan setting in the Microsoft Defender Antivirus template for Linux endpoint security antivirus policies. You can manage memory scan behavior on Linux devices managed through Microsoft Defender for Endpoint security settings management…
- New feature
Limit how long an Android work profile can stay off
Microsoft Intune now supports the Number of days work profile is allowed to be switched off setting in the Android Enterprise settings catalog, so you can limit how long a work profile stays turned off. Enter the maximum…
- New feature
Keep Android device screens on while charging
Microsoft Intune now includes a settings catalog option for keeping fully managed and dedicated Android device screens on while charging. Select one or more modes - AC , USB , or Wireless - to control when the screen…
- New feature
Device inventory for personally owned devices on Android Enterprise
Microsoft Intune now supports device inventory for personally owned Android Enterprise devices with a work profile managed by Android Management API. View these devices from the device's Inventory page alongside corporate-owned devices in Resource Explorer, and query them…
- New feature
Declarative Device Management for Apple volume purchase program apps
Microsoft Intune now supports Apple Declarative Device Management (DDM) for required volume purchase program (VPP) apps on devices running iOS/iPadOS 17.2 and later and macOS 26 and later. By changing the management type to DDM when you upload…
- New feature
Configure screen timeout for corporate Android devices
Microsoft Intune now supports a Screen timeout setting in the Android Enterprise settings catalog, letting you specify how many seconds pass before the screen turns off. Configure it under Devices > Manage devices > Configuration > Create >…
- New feature
Collect enhanced diagnostic logs from supervised Apple devices
Microsoft Intune now supports Apple's Enhanced Logging device action on supported supervised devices running a compatible OS release. Administrators can start an AppleCare diagnostic-log collection session using an AppleCare-provided token and monitor device-reported status through Declarative Device Management…
- New feature
Choose whether to remove eSIMs when wiping one corporate-owned Android device
Microsoft Intune now lets you choose whether to preserve or remove eSIMs when wiping one corporate-owned Android Enterprise device. Turn on Preview new device view , select the device, then select Wipe . By default, the wipe preserves…
- New feature
Audit mode for the Microsoft Defender Antivirus template for Linux
The Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy, now includes a new Audit value for the Enforcement level setting. When you set Enforcement level to Audit , the antivirus engine…
DocsLearn about using Intune to manage Microsoft Defender settings on …UpdatedManage antivirus settings with endpoint security policies in Microsoft …
Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune Learn how to use Intune policy to manage Microsoft Defender security settings on devices that aren't enrolled with Microsoft Intune.
- New feature
Activate an eSIM on a corporate-owned Android device
Microsoft Intune now supports single-device eSIM activation for corporate-owned Android Enterprise devices running Android 15 and later. Turn on Preview new device view , select the device, then select Activate eSIM and enter the carrier activation code. Intune…
Posts this month: From GPO to Microsoft Intune: A practical guide to cloud-first policy management · What’s new in Microsoft Intune – August · Introducing device association for Windows Autopilot device preparation · Remote Help on Windows: Unattended Support with Remote Sign-In Is Here · Support tip: Restore the Managed Home Screen Exit PIN · Configure Delivery Optimization for Windows to save bandwidth and speed up deployments
Microsoft Edge
8 changes · product page- Security update
Edge security update: Android and iOS 152.0.4191.53
Microsoft released the latest Microsoft Edge for Android and iOS (Version 152.0.4191.53) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Stable 152.0.4191.53 (7 CVEs)
Microsoft released the latest Microsoft Edge for Stable (Version 152.0.4191.53) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security fixes: CVE-2026-58616…
DocsSecurity Update GuideCVE-2026-58616CVE-2026-62904CVE-2026-66324
- Security update
Edge security update: Android 151.0.4129.101
Microsoft released the latest Microsoft Edge for Android (Version 151.0.4129.101) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Stable 151.0.4129.101
Microsoft released the latest Microsoft Edge for Stable (Version 151.0.4129.101) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Android and iOS 151.0.4129.86 (1 CVE)
Microsoft released the latest Microsoft Edge for Android and iOS (Version 151.0.4129.86) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security…
- Security update
Edge security update: Stable Channel 151.0.4129.86 (1 CVE)
Microsoft released the latest Microsoft Edge for Stable Channel (Version 151.0.4129.86) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide This update contains the following Microsoft Edge specific security fixes: CVE-2026-72970
- Security update
Edge security update: Stable 151.0.4129.78
Microsoft released the latest Microsoft Edge for Stable (Version 151.0.4129.78) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide
- Security update
Edge security update: Android and iOS 151.0.4129.59
Microsoft released the latest Microsoft Edge for Android and iOS (Version 151.0.4129.59) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
Posts this month: Security baseline for Microsoft Edge version 151 · Security Review for Microsoft Edge version 150
Microsoft Defender for Cloud
4 changes · product page- New feature
Update to CVE details data consumption in Azure Resource Graph
August 21, 2026 Microsoft Defender for Cloud has updated how vulnerability assessment CVE details are consumed in Azure Resource Graph. CVE information remains available, but detailed CVE properties are now consumed through the microsoft.security/cvedetails resource type to improve query performance…
DocsRemediate Machine VulnerabilitiesUpdated
Remediate Machine Vulnerabilities Learn how machine vulnerability remediation in Microsoft Defender for Cloud helps you review scan findings, fix risks, and export results.
- New feature
On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares
August 6, 2026 On-demand malware scanning in Microsoft Defender for Storage now supports targeted scanning of specific items. Instead of scanning an entire storage account, you can scope scans to a single blob or file, a specific container or file…
DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated
Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.
- New feature
Breaking change: Unused actions no longer included in AWS and GCP overprovisioned identity assessments
August 6, 2026 To improve the performance and scalability of overprovisioned identity recommendation generation, Microsoft Defender for Cloud will no longer use the unused actions when computing overprovisioned identity assessments for AWS and GCP environments. As a result of this…
DocsEnable cloud infrastructure entitlement management (CIEM)
Enable cloud infrastructure entitlement management (CIEM) Enable CIEM to enforce least privilege access and manage user entitlements across Azure, AWS, and GCP as part of Defender for Cloud's CNAPP solution.
- Retirement
Classic Defender for SQL APIs retirement
August 17, 2026 The classic Defender for SQL APIs for Vulnerability Assessment and Advanced Threat Protection will be retired on August 16, 2027 . If you use these APIs, migrate to the supported configuration model and update any dependent scripts…
DocsMigrate from classic Defender for SQL APIs
Migrate from classic Defender for SQL APIs Migrate classic Defender for SQL Vulnerability Assessment and Advanced Threat Protection configurations before the APIs retire.
Posts this month: Microsoft Defender for Cloud and Defender for Threat Intelligence are Better Together · Microsoft Defender for Cloud Customer Newsletter
Microsoft Defender for Cloud Apps
1 changes · product page- New feature
Unified RBAC is enabled by default for new Defender for Cloud Apps customers
Starting in August 2026, Microsoft Defender unified role-based access control (RBAC) is automatically enabled for new Defender for Cloud Apps customers. No manual workload activation is required. Unified RBAC provides a centralized experience for managing roles and permissions across Microsoft…
DocsConfigure admin accessNewMicrosoft Defender unified role-based access control (RBAC)Updated
Configure admin access Set up role-based administrator access in Defender for Cloud Apps and understand how Microsoft Entra ID and Microsoft 365 roles affect permissions.
Microsoft Purview
7 changes · product page- New feature
eDiscovery
Updated : App-only authentication for eDiscovery cmdlets in Security & Compliance PowerShell is unsupported. Transition automations to Microsoft Graph APIs where available; the documented certificate-based authentication steps are best-effort guidance for existing automations and don't change the support status.
DocsAssign permissions in eDiscoveryNew
Assign permissions in eDiscovery Assign the permissions required to perform eDiscovery-related tasks in eDiscovery.
- New feature
Shared capabilities
New : Run on-demand classification scans on Windows endpoints to discover sensitive information without waiting for files to be opened or modified. The new guidance covers billing and best practices , monitoring and troubleshooting , and frequently asked questions …
DocsAudit log activitiesNewGet started with on-demand classification for endpointsBest practices for on-demand classification on endpoints and billingMonitor and troubleshoot endpoint scans
Audit log activities Discover how to monitor and investigate activities in Microsoft 365 with the unified audit log. Search for specific events and export results.
- New feature
Sensitivity labels
New : Before enforcing an auto-labeling policy, run it in simulation mode to identify which items it would label without making any changes. Review the match results and source distribution to determine whether the policy is ready to enforce. New…
DocsReview simulation results for auto-labeling policies in Microsoft …NewUse the Insights tab to analyze auto-labeling policies in Microsoft …NewEnable sensitivity labels for files in SharePoint and OneDriveNewAutomatically apply a sensitivity label to Microsoft 365 dataNew
Review simulation results for auto-labeling policies in Microsoft Purview Learn how to review Microsoft Purview auto-labeling simulation results and decide whether a policy is ready for enforcement.
- New feature
Data lifecycle management
Updated : When you remove the last hold from an inactive mailbox, Microsoft 365 automatically applies a 30-day delay hold. Learn how to identify and remove delay holds before recalculating mailbox hold status. New : Remove a retention hold from…
DocsDelete an inactive mailboxRemove a retention hold from an unlicensed OneDrive sitePermanently delete files with Microsoft Purview Priority Cleanup
Delete an inactive mailbox When you no longer need to preserve the contents of a Microsoft 365 inactive mailbox, you can permanently delete the inactive mailbox.
- New feature
Data Security Posture Management
Updated : Microsoft Purview support for Anthropic Claude Enterprise now includes data classification, Insider Risk Management, Communication Compliance, eDiscovery, Data Lifecycle Management, and Compliance Manager.
DocsUse Microsoft Purview to manage data security & compliance for …
Use Microsoft Purview to manage data security & compliance for Anthropic Claude (Enterprise) Use Microsoft Purview to help you protect and manage data security and compliance protections for Anthropic Claude (Enterprise).
- New feature
Data Governance
Updated : Data Quality capability requires the Microsoft Purview account and its data sources to be in the same Azure region.
DocsData Quality in Microsoft Purview Unified Catalog
Data Quality in Microsoft Purview Unified Catalog Get an overview of data quality in Microsoft Purview Unified Catalog.
- Preview
Data Loss Prevention
In preview : Use data loss prevention policies for non-Microsoft connected apps . Create DLP policies that protect sensitive data at rest in non-Microsoft connected applications, such as Box and Google Workspace. These policies use the existing Microsoft Defender for…
DocsUse Microsoft Purview data loss prevention policies for non-Microsoft …UpdatedLearn about Endpoint data loss preventionUpdatedMicrosoft Purview Endpoint DLP on macOS 27UpdatedLearn about Data Loss Prevention for Cloud Apps in Edge for BusinessUpdated
Use Microsoft Purview data loss prevention policies for non-Microsoft connected apps (preview) Learn how to use Microsoft Purview data loss prevention policies to protect sensitive data at rest in non-Microsoft connected apps like Box, Dropbox, Google Workspace, and Salesforce.
Posts this month: Close the gaps: layered data protection with Microsoft Purview across endpoint, browser, and network
Built from the What's New and release-notes pages on Microsoft Learn. Entries are grouped by the month Microsoft lists them under (or, for changes detected later, the month we detected them). Every title links to the exact section on Microsoft Learn.