What's new in Microsoft Security: September 2026
Every Microsoft Security update in September 2026: 64 documentation changes and 58 official posts across Sentinel, Defender, Entra, Intune, Purview and Security Copilot, with GA and preview releases, retirements and links to the sources.
Announcements
Microsoft Security
Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026
This year at Microsoft Ignite, we spotlight our AI-first, end-to-end security platform designed to protect identities, devices, data, applications, clouds…
Microsoft Security BlogSentinel
What’s new in Microsoft Sentinel: September 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogThreat Intelligence
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Microsoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance.
Microsoft Threat IntelligencePurview
Microsoft Purview Referential Architecture Diagrams
The Microsoft Purview architecture diagrams provide a referential view of how data classification, sensitivity labeling, Data Loss Prevention (DLP) and Insider Risk…
Microsoft Purview BlogThreat Intelligence
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity…
Microsoft Threat IntelligenceAzureGA
Generally Available: Azure Arc-enabled SQL Server in Germany West Central
Azure Arc-enabled SQL Server is now available in Germany West Central, enabling you to connect SQL Server instances to Azure Arc and take advantage of Azure-based…
Azure UpdatesIntune
What’s new in Microsoft Intune – September
Planning before the first devices receive updates is an important part of managing a rollout.
Microsoft Intune BlogAzure securityGA
Generally Available: Azure Database for PostgreSQL Flexible Server supports cross-tenant customer-managed keys (CMK)
Azure Database for PostgreSQL Flexible Server now supports cross-tenant customer-managed keys (CMK).
Azure UpdatesAzureGA
Generally Available: SQL Server support on Azure Local connected mode
With SQL Server on Azure Local, you can run SQL Server workloads on Azure Local infrastructure while leveraging Azure services for centralized management, governance…
Azure UpdatesAzureRetirement
Retirement: Azure IoT Central will be retired on September 20, 2029
Azure IoT Central will be retired on September 20, 2029.
Azure UpdatesEntraPreview
Public Preview : Microsoft entra kerberos authentication for Azure NetApp Files
Azure NetApp Files now supports Microsoft Entra Kerberos authentication for SMB volumes.
Azure UpdatesMicrosoft Security
Beyond source code: A path to the keys to the kingdom
Explore how Storm-3068 turned a compromised identity into broader cloud access and the steps organizations can take to defend their identities, pipelines, and cloud…
Microsoft Security BlogEntra
Sign in to Microsoft apps with passkeys from external identity providers
Organizations that use an external identity provider to authenticate Microsoft 365 users can now extend browser-based passkeys, security keys, and eligible single…
Microsoft Entra BlogThreat Intelligence
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns…
Microsoft Threat IntelligenceThreat Intelligence
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted…
Microsoft Threat IntelligenceThreat Intelligence
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as…
Microsoft Security BlogIntune
Microsoft Intune and Apple OS 27: New settings, support, and platform changes
With Apple's release of OS 27, we’ve been working hard to ensure that Microsoft Intune provides support for Apple’s latest operating systems (OS) so that existing…
Intune Customer SuccessThreat Intelligence
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT…
Microsoft Threat IntelligenceMicrosoft Security
What’s new in Microsoft Security: September 2026
This month's updates help you discover and control local AI agents, extend Zero Trust to agent traffic, and strengthen SOC foundations.
Microsoft Security BlogMicrosoft Security
Reimagining the SOC for the agentic era in Microsoft Defender
We are announcing ISOC in Microsoft Defender: a foundation built for agentic security that brings leading solutions for SIEM and threat protection together.
Microsoft Security BlogDefender XDR
Integrated Security Operations Center in Microsoft Defender
AI is transforming the attacker’s operating model, accelerating threats to unprecedented speed and scale.
Microsoft Defender XDR BlogDefender XDR
Reimagining Case Management in Microsoft Defender
Security work extends beyond the signal Identifying a threat, exposure, or data risk is only the start.
Microsoft Defender XDR BlogThreat Intelligence
Unmasking EvilTokens: Getting to the root of device code phishing
EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft.
Microsoft Threat IntelligenceEntra
Prepare your tenant estate for AI: Join our upcoming webinars
Securing multiple tenants has never been more critical.
Microsoft Entra BlogMicrosoft Security
Bringing Defender Experts protection and proactive hunting into focus
As threats move faster and security environments grow more complex, security teams need to quickly understand what matters, where potential risks may exist…
Microsoft Tech CommunityEntraPreview
Public preview of self-service onboarding for new Microsoft Entra App Gallery applications
Previously, publishing a new application to Microsoft Entra App Gallery could require multiple review cycles.
Microsoft Entra BlogAzurePreview
Public Preview: Azure Payments HSM v2
Azure Payments HSM v2 is a highly available, single-tenant Payment HSM service for payment processing, credential issuance, PIN processing, key management, and…
Azure UpdatesMicrosoft Security
From guidance to action: Security fundamentals that materially reduce risk
AI has made fundamental changes to the operating environment for cybersecurity.
Microsoft Security BlogMicrosoft Security
Improving email security outcomes with real-world Microsoft Defender insights
The latest email security benchmarking reports show strong Microsoft Defender performance across pre-delivery and post-delivery scenarios and reveal where threats and…
Microsoft Security BlogIntune
Moving from Windows Autopilot to Windows Autopilot device preparation
By: Maggie Dakeva, Senior Product Manager - Microsoft Intune Organizations have spent years refining Windows Autopilot deployments.
Intune Customer SuccessEntra
Replace VPN access with identity-driven security
Traditional VPNs no longer fit the security or agility needs of modern enterprises.
Microsoft Entra BlogPurview
From DLP Alert Volume to Measurable Detection Assurance
Introducing Data Security Workbench Built on the newly released Microsoft Purview DLP API, Data Security Workbench is an open-source starting point for any customer who…
Microsoft Security Community BlogIntune
Unpacking Endpoint Management - Podcast series - Intune Tech Community
Find out what works, what doesn't, and what organizations like yours have learned along the way.
Intune Customer SuccessEntra
Simplify Employee Identity Lifecycle with HiBob and Microsoft Entra
Every workforce transition creates an identity moment that your IT team must get right.
Microsoft Entra BlogSentinelPreview
Public Preview: Multi-account support for Microsoft Sentinel codeless connectors
Security teams rarely have just one of anything. Most SOCs run separate production, staging, and development accounts.
Microsoft Sentinel BlogThreat Intelligence
Protecting organizations from AI-assisted executive impersonation and invoice fraud
Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.
Microsoft Threat IntelligenceAzureGA
Generally Available: TLS/SSL certificate and end-to-end TLS encryption support for Azure Functions Flex Consumption
Azure Functions Flex Consumption support for TLS/SSL certificates is now generally available through a new site-scoped certificate model.
Azure UpdatesMicrosoft Security
Detect and disrupt AI-themed attacks with Microsoft Defender
See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain.
Microsoft Security BlogAzureGA
Generally Available: User-bound user delegation SAS for Azure Storage
Announcing the addition of enhanced secure authentication in Azure Storage that combines the flexibility of user-delegation shared access signature (SAS) with the…
Azure UpdatesMicrosoft Security
Threat matrix: Mapping threats across cloud web applications
Microsoft introduces the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework that helps defenders understand, prioritize, and mitigate threats to…
Microsoft Security BlogThreat Intelligence
Passkey-themed social engineering leads to identity and cloud compromise
Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks.
Microsoft Threat IntelligenceAzureGA
Generally Available: Azure Developer CLI (azd) Extension Framework
The Azure Developer CLI (azd) Extension Framework is now generally available.
Azure UpdatesMicrosoft Security
How to secure edge AI in customer-owned environments
As AI moves into customer-owned environments, organizations need new ways to verify the systems, software, and AI assets they trust before releasing sensitive data…
Microsoft Security BlogMicrosoft Security
Help Shape the Microsoft Security Practitioner Community
We want to hear from the people who configure, operate, and defend with Microsoft Security every day.
Microsoft Security Community BlogThreat Intelligence
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them.
Microsoft Threat IntelligenceEntra
Device Code Flow: The Gift That Keeps on Giving — To Attackers
Tags: Microsoft Entra ID, Conditional Access, Device Code Flow, OAuth, Azure Arc, Azure Migrate, Identity Security, Zero Trust Introduction Device Code Flow…
Microsoft Tech CommunityThreat Intelligence
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote…
Microsoft Security BlogEntra
Instant revocation of service principal bearer tokens with CAE
Introduction Workload identities such as service principals are an important part of the attack surface in Entra: they are often used by critical automated processes…
Microsoft Entra BlogAzure securityPreview
Public Preview: Azure Front Door profile and route level WAF policies
Azure Front Door’s Web Application Firewall (WAF) now supports profile and route level WAF policy associations in public preview.
Azure UpdatesThreat Intelligence
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives.
Microsoft Threat IntelligenceDefender for CloudGA
Generally Available: Microsoft Defender for Cloud support for Azure Container Apps (Serverless Containers Posture)
Customers can now bring Azure Container Apps environments into Microsoft Defender for Cloud’s Serverless Containers Posture experience, helping security teams extend…
Azure UpdatesAzureGA
Generally Available: Confidential VMs for Azure Linux
Confidential Virtual Machines (CVM) offer strong security and confidentiality for tenants.
Azure UpdatesMicrosoft Security
Cybersecurity IR Workshop: The workshop you shouldn’t miss
Cyber resilience starts before a crisis. Gain practical insights from DART to strengthen readiness and response.
Microsoft Security BlogAzure securityGA
Generally Available: Azure Firewall auto-learn SNAT routes
Azure Firewall’s auto-learn SNAT routes is now generally available, automatically learning registered and private destination prefixes periodically and applying them as…
Azure UpdatesDefender XDR
Stop identity attacks before they start with Microsoft ISPM recommendations
Many major breaches involve compromised identities, excessive privileges, or misconfigured access.
Microsoft Defender XDR BlogMicrosoft Security
Expanding memory integrity protection across Windows devices
Security works best when protection is built in, not bolted on.
Windows IT Pro BlogEntra
What’s new in Microsoft Entra: September 2026
Welcome to the September edition of “What’s New in Microsoft Entra.”
Action may be required
Microsoft Entra BlogEdge
Security Review for Microsoft Edge version 152
We have reviewed the new settings in Microsoft Edge version 152 and determined that there are no additional security settings that require enforcement.
Microsoft Security Baselines Blog
Retirements and deprecations
All retirements| Effective | What's changing | Product | Type | Source |
|---|---|---|---|---|
| —not stated | Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation. | Defender for Cloud | Deprecation | Microsoft Learn |
Microsoft Sentinel
7 changes · product page- GA
Run interactive KQL queries in advanced hunting
Interactive Kusto Query Language (KQL) queries on the data lake are now available using Advanced Hunting under Investigation & Response in the Defender portal. Use the Advanced Hunting page to investigate data from both Microsoft Sentinel and Microsoft Defender XDR…
DocsAdvanced hunting with Microsoft Sentinel data in Microsoft DefenderUpdated
Advanced hunting with Microsoft Sentinel data in Microsoft Defender Learn how to use advanced hunting in the portal unifying Defender XDR and Sentinel data
- New feature
Use Sentinel MCP triage collection to query data
Use the triage collection in the Microsoft Sentinel MCP server to discover and query data using MCP tools. Use the list advanced hunting tables tool to return a list of all available tables in the built-in data lake. Use the…
DocsTriage Tool Collection in Microsoft Sentinel MCP Server
Triage Tool Collection in Microsoft Sentinel MCP Server Explore the Microsoft Sentinel MCP triage tools for incident triage and hunting, including tools to fetch incidents, alerts, entities, and run hunting queries.
- New feature
Use Microsoft Fabric for data federation
When cost, governance, or compliance requirements prevent data movement, customers can query the data where it resides using data federation. Using Data federation, you can enrich investigations with context from data stored outside the data lake. You can use Microsoft…
DocsUnify Data Sources With OneLake ShortcutsUpdatedMirroring
Unify Data Sources With OneLake Shortcuts OneLake shortcuts provide a way to connect to existing data without having to directly copy it. Learn how to use them.
- New feature
Use Microsoft Fabric for custom security analytics
Microsoft Fabric enables custom analytics across data lake tables and external data tables. You can use KQL , notebooks , scheduled jobs , and custom graphs within Microsoft Fabric to analyze and enrich data at scale and then store results…
DocsData Collection Rules in Azure MonitorNewHow graph in Microsoft Fabric worksUpdatedQuery data in a KQL querysetHow to use notebooks
Data Collection Rules in Azure Monitor Learn when to work directly with data collection rules (DCRs) and how they provide centralized, reusable control for Azure Monitor data collection.
- New feature
Mirror the data lake tier to Microsoft Fabric OneLake
Using the Azure Monitor mirroring feature, you can select the Microsoft Sentinel workspace tables you want to expose in Microsoft Fabric. The mirroring feature doesn't create a copy of the data and incurs no additional charge. The data remains in…
DocsTutorial: Configure the Mirror Azure Monitor Solution in Fabric …Updated
Tutorial: Configure the Mirror Azure Monitor Solution in Fabric (Preview) Learn how to create a mirrored Azure Monitor item in Microsoft Fabric and access Log Analytics tables through the Eventhouse endpoint or a Lakehouse shortcut.
- New feature
Integrated Microsoft Sentinel SIEM and data lake onboarding
The data lake comes integrated with Microsoft Sentinel and continues as the low-cost ingestion and storage tier for long-term retention inside Sentinel. Going forward, you do not need to go through a separate data lake onboarding and billing setup. You…
DocsOnboard to Microsoft SentinelUpdatedConnect Microsoft Sentinel to the Microsoft Defender portalUpdated
Onboard to Microsoft Sentinel In this quickstart, you enable Microsoft Sentinel, and set up data connectors to monitor and protect your environment.
- New feature
Enable the data lake tier using Table management
Once you've onboarded to Microsoft Sentinel in Defender portal, you can use the Table Management page to enable the data lake tier. Select a table, and then select Retention to view data-retention settings . From here, you can mirror data…
DocsManage data tiers and retention in Microsoft Sentinel
Manage data tiers and retention in Microsoft Sentinel Manage log data in Microsoft Sentinel and with Microsoft Defender XDR services in the Microsoft Defender portal to optimize security operations and cost efficiency.
Posts this month: What’s new in Microsoft Sentinel: September 2026 · Public Preview: Multi-account support for Microsoft Sentinel codeless connectors
Microsoft Defender XDR
2 changes · product page- GA
Identity Security dashboard and Coverage & Maturity
(GA) Identity Security dashboard and Coverage & Maturity : The Identity Security dashboard provides a centralized view of identity-related security risks and posture across the organization. Coverage & Maturity helps security teams understand how well their identity environment is protected…
DocsView your identity coverage and maturityNew
View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.
- Preview
Integrated Security Operations Center (ISOC) in Microsoft Defender
(Preview) Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal. Starting September 23, 2026, it's available to eligible Microsoft 365 E5 and E7 customers without an…
DocsIntegrated Security Operations Center (ISOC) in Microsoft DefenderNew
Integrated Security Operations Center (ISOC) in Microsoft Defender Learn how Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI together, including eligibility and workspace requirements.
Posts this month: Integrated Security Operations Center in Microsoft Defender · Reimagining Case Management in Microsoft Defender · Stop identity attacks before they start with Microsoft ISPM recommendations
Microsoft Security Exposure Management
3 changes · product page- GA
New Microsoft Secure Score recommendations for AI-Readiness
New Microsoft Secure Score recommendations for AI-Readiness. Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry…
- New feature
Improved onboarding experience for MDASH
The MDASH onboarding experience has been improved to make setup clearer and more guided. Instead of a single panel that contains all setup steps, onboarding is now organized into clear tasks that users complete as part of the flow. This…
DocsSet up Microsoft Foundry for Codename MDASH - Agentic code scanner …Updated
Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration Connect Codename MDASH - Agentic code scanner to your Microsoft Foundry project by creating a resource, deploying the required models, and providing the project endpoint and API key.
- New feature
Codename MDASH - Scan progress monitoring
Scan progress helps you understand whether a scan is waiting, processing code, validating findings, or publishing results. Check completed work, elapsed time, and output availability to understand what is happening during a long-running scan. For more information, see Monitor scan…
DocsCodename MDASH - Agentic code scanner initiativeUpdated
Codename MDASH - Agentic code scanner initiative Learn how to use the Codename MDASH - Agentic code scanner initiative page in Microsoft Defender to triage and remediate code-level weaknesses detected by agentic code scanning.
Microsoft Defender for Endpoint
8 changes · product page- GA
macOS release: Build 101.26072.0017
macOS release: Build 101.26072.0017. Release version 20.126072.17.0 released: See enhancements and features for this release .
DocsMicrosoft Defender for Endpoint release notesNew
Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.
- GA
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…
DocsMicrosoft Defender for Endpoint plug-in for Windows Subsystem for …New
Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) Learn how to set up and use the Defender for Endpoint plug-in for Windows Subsystem for Linux.
- Preview
Microsoft Defender support for Linux Desktops
Microsoft Defender support for Linux Desktops. Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Deployment methods and security capabilities remain consistent across both…
DocsPrerequisites for Microsoft Defender for Endpoint on LinuxNew
Prerequisites for Microsoft Defender for Endpoint on Linux Describes the requirements needed to install and use Microsoft Defender for Endpoint on Linux.
- Preview
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)
Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…
DocsMicrosoft Defender for Endpoint plug-in for Windows Subsystem for …Newregistration form
Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) Learn how to set up and use the Defender for Endpoint plug-in for Windows Subsystem for Linux.
- Preview
Memory scan for Linux
Memory scan for Linux. Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are…
DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated
Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.
- Release
Windows Antivirus · September 2026 · Platform 4.18.26090.9 · Engine 1.1.26090.9
Release details Component Version Date Platform 4.18.26090.9 October 12, 2026 Engine 1.1.26090.9 October 12, 2026 Security intelligence 1 1.461.1.0 October 12, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…
DocsSecurity intelligence updates for Microsoft Defender Antivirus and …
- Release
Linux · September 2026 · 101.26081.0010
Release details Release version Engine version Signature version 30.126081.0010.0 1.1.26090.3000 1.459.287.0 Enhancements and features Feature area Update summary Device identity Fixed an issue where cloned Linux virtual machines could retain the source image's machine identifier, causing multiple endpoints to appear…
- Release
Linux · September 2026 · 101.26072.0005
Release details Release version Engine version Signature version 30.126072.0005.0 1.1.26070.5001 1.459.239.0 Enhancements and features Feature area Update summary Security Memory scanning (preview) adds process memory scanning to detect known malicious behaviors and memory-resident threats, which strengthens protection against in-memory attacks…
DocsNew features in Microsoft Defender for EndpointNew
New features in Microsoft Defender for Endpoint This article describes new features available in Microsoft Defender for Endpoint, including both Windows and cross-platform updates.
Microsoft Defender for Identity
6 changes · product page- New feature
Identity Security dashboard and Coverage & Maturity
The Identity Security dashboard provides a centralized view of identity-related security risks and posture across your organization. Coverage & Maturity helps security teams understand identity protection across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage and deployment gaps…
DocsView your identity coverage and maturityNew
View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.
- New feature
Combined Sensor management tab on the On-premises settings page
The Onboarding and Sensors tabs on the identity On-premises settings page are now combined into a single Sensor management tab that lists both installed sensors and servers eligible for activation. Automatic sensor v3.x activation is now configured on the Advanced…
DocsManage and update Microsoft Defender for Identity sensorsNew
Manage and update Microsoft Defender for Identity sensors Learn how to view, manage, and update Microsoft Defender for Identity sensors in the Microsoft Defender portal, including sensor health, migration state, and delayed updates.
- New feature
Automatic sensor v3.x activation and Windows auditing by default
Automatic sensor v3.x activation and automatic Windows auditing apply only to organizations with an active license that includes Microsoft Defender for Identity. The rollout differs for new Microsoft Defender for Endpoint customers and existing Defender for Identity customers: New Microsoft…
DocsActivate the Microsoft Defender for Identity sensor v3.xNewConfigure Windows event auditingNew
Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.
- Preview
Sensor v3.x support for additional identity server roles: AD CS, AD FS, and Entra Connect (Preview)
Defender for Identity sensor v3.x now supports eligible AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers and don't have an existing Defender for Identity sensor. For more information, see Defender for Identity sensor v3.x prerequisites…
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
- Preview
Sensor v3.x onboarding without Microsoft Defender for Endpoint deployment (Preview)
You can now activate the Defender for Identity sensor v3.x on eligible domain controllers without first onboarding them to Defender for Endpoint. This preview supports only new sensor v3.x deployments on eligible domain controllers running Windows Server 2019 or later…
DocsActivate the Microsoft Defender for Identity sensor v3.xNew
Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.
- Preview
Sensor v2.x installation restriction for new workspaces (Preview)
The sensor v2.x installation restriction for new workspaces is in preview. Starting in October 2026, Defender for Identity will restrict sensor v2.x installation in new workspaces. In these workspaces, sensor v3.x is the supported onboarding option for eligible servers running…
Microsoft Intune
19 changes · product page- GA
Remote Help support for GCCH environments
[Advanced capabilities (formerly "Microsoft Intune Suite")] Remote Help is now available in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants. IT support staff can…
DocsPlan for Remote Help with Microsoft IntuneUpdated
Plan for Remote Help with Microsoft Intune Learn about the requirements and capabilities of Remote Help with Microsoft Intune on Windows, macOS, and Android Enterprise.
- GA
Newly available protected app for Intune
Microsoft Dragon Copilot by Microsoft Corporation is now available as a protected app for Microsoft Intune. You can apply Intune app protection policies to the app on supported Android and iOS/iPadOS devices, helping protect organizational data while clinicians…
DocsSupported Microsoft Intune AppsUpdated
Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.
- GA
Microsoft Cloud PKI support for US Government GCC High
[Advanced capabilities (formerly "Microsoft Intune Suite")] Microsoft Cloud PKI is now available for Microsoft Intune tenants in the Microsoft Government Community Cloud High (GCC High) environment. You can create and manage a cloud-based public key infrastructure that automates certificate issuance…
DocsMicrosoft Cloud PKI for Microsoft IntuneUpdated
Microsoft Cloud PKI for Microsoft Intune An overview of the Microsoft Cloud PKI service, available with Microsoft Intune Suite or as a standalone capability.
- GA
New Remote Help for Windows version available
[Advanced capabilities (formerly "Microsoft Intune Suite")] Remote Help for Windows version 5.2.1040.0 is now available. This release updates subscription metadata for E3, E5, and E7 licenses. Remote Help features are unchanged from version 5.2.1037.0. Applies to: Windows
- New feature
Windows 11, version 26H2 Settings Catalog update
Microsoft Intune provides day-zero support for validated Windows policy settings introduced with Windows 11, version 26H2 in the Settings Catalog. Admins can use the new and updated settings to manage Windows endpoints with the latest 26H2 capabilities. For…
DocsPost Microsoft Intune Settings Catalog updated to support Windows 11, …Updated
Microsoft Intune Settings Catalog updated to support Windows 11, version 26H2 10.06.26 Update: The Windows security baseline for Windows 11, version 26H2 is now available for all customers in Microsoft Intune. This baseline reflects...
- New feature
Upgrade an existing Android Enterprise connection to a managed Google domain
Microsoft Intune now supports an optional upgrade for tenants that connected Android Enterprise with a Gmail account. You can link the enterprise to a managed Google domain and manage the Google-Intune connection with your Microsoft Entra work account…
DocsConnect Intune account to managed Google Play account
Connect Intune account to managed Google Play account Learn how to connect your Intune account to your Managed Google Play account.
- New feature
Updated minimum supported version for iOS and iPadOS
Microsoft Intune now requires iOS/iPadOS 18 or later for standard device-management, Company Portal, and app-protection scenarios. Administrators should identify and upgrade affected devices. Userless devices enrolled through Automated Device Enrollment have a separate support statement. Applies to: iOS/iPadOS
- New feature
Skip the Device Features Tour during Apple enrollment
Microsoft Intune now includes the Device features tour Apple OS 27 Setup Assistant skip key in Automated Device Enrollment profiles. You can hide this pane to reduce setup interactions and provide a more streamlined enrollment experience on supported…
DocsSet up automated device enrollment (ADE) for iOS/iPadOSNew
Set up automated device enrollment (ADE) for iOS/iPadOS Learn how to enroll corporate-owned iOS/iPadOS devices into Microsoft Intune with Apple Automated Device Enrollment (ADE).
- New feature
Require Managed Home Screen authentication for protected app activities
Microsoft Intune now helps prevent users from bypassing Managed Home Screen (MHS) authentication when they access protected activities in MAM-integrated apps. If MHS requires sign-in or a session PIN, the app redirects the user to MHS before allowing…
DocsConfigure the Microsoft Managed Home Screen AppNew
Configure the Microsoft Managed Home Screen App Learn how to configure the Microsoft Managed Home Screen app.
- New feature
Onboard MDM compliance partners with new self-service functionality
Microsoft Intune now supports bring-your-own connector functionality for MDM compliance partners. Partners can build, test, and onboard compliance connectors using Intune documentation, contracts, and validation hooks. As an admin, you can opt in to a partner connector by…
DocsThird-party device compliance partners support in Microsoft IntuneUpdated
Third-party device compliance partners support in Microsoft Intune Use a third-party device compliance partner as a source of compliance data for devices you manage with Intune.
- New feature
New single device page becomes the default experience in the Intune admin center
Microsoft Intune now uses the new single device page as the default experience for all admins, and the previous device page is no longer available. In Devices > All devices , select a device to view details and…
DocsView device detailsUpdated
View device details Learn how to access device details in the Microsoft Intune admin center, including hardware information, installed apps, and device properties.
- New feature
New Apple settings in the Settings Catalog for iOS/iPadOS and macOS
Microsoft Intune now includes new Apple Settings Catalog options for supported iOS/iPadOS and macOS devices. You can configure additional controls for areas such as app settings, Apple Intelligence, network and web-content filtering, and the macOS login window by…
DocsCreate a policy using settings catalog in Microsoft IntuneNew
Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…
- New feature
Faster delivery of Win32 apps
Microsoft Intune now uses push notifications for admin-initiated and service-side changes to Win32 apps. Managed devices can check in sooner after app changes, reducing delivery and refresh delays compared with waiting for normal polling intervals. This update improves…
- New feature
Faster Win32 app delivery after Windows enrollment
Microsoft Intune Management Extension now checks for Windows app assignments immediately after the Enrollment Status Page (ESP) completes. This reduces the delay before required Win32 apps that weren't installed during ESP begin installing on newly enrolled devices. For…
DocsUnderstand Microsoft Intune Management ExtensionNew
Understand Microsoft Intune Management Extension Understand Microsoft Intune management extension for Windows.
- New feature
Configure MDE AI agent runtime protection for Windows
Microsoft Intune now includes Microsoft Defender for Endpoint AI agent runtime protection settings in the new endpoint security template for Windows. You can use Audit mode to detect and alert on unsafe AI agent activity without blocking it…
DocsAI Agent Runtime Protection with Microsoft Defender for Endpoint …New
AI Agent Runtime Protection with Microsoft Defender for Endpoint (Preview) Learn how Microsoft Defender for Endpoint provides runtime protection for local AI agents by detecting and blocking prompt injection attacks.
- New feature
Automatically launch Microsoft Defender for Endpoint during Android Enterprise device setup
Microsoft Intune now supports automatically opening Microsoft Defender for Endpoint during out-of-box setup for supported corporate-owned Android Enterprise devices. After you configure the Defender for Endpoint connector, turn on Grant MTD role permissions , and assign the Defender…
- New feature
Assignment filters for Android Settings Catalog policies
Microsoft Intune now supports assignment filters for Android Enterprise and Android Open Source Project (AOSP) Settings Catalog policies. You can include or exclude specific devices based on device properties, giving you more granular control over policy deployments and…
DocsCreate assignment filters in Microsoft Intune
Create assignment filters in Microsoft Intune Create assignment filters in Microsoft Intune to target policies based on device properties like OS version or manufacturer. Learn to create, update, and delete filters for managed devices and apps.
- New feature
Stage app and policy rollout with deployment plans
Microsoft Intune now supports deployment plans, a new way to roll out apps and configuration policies in stages instead of all at once. From the new Deployments experience in the Intune admin center, you can stage a rollout…
DocsDeployment plans and deployments overview in Microsoft IntuneUpdated
Deployment plans and deployments overview in Microsoft Intune Learn how deployment plans and deployments provide gradual, controlled, ring-based rollouts of apps and policies in Microsoft Intune.
- New feature
Faster compliance updates for Windows devices
Microsoft Intune now supports client-driven compliance evaluation for Windows devices. Supported devices can detect changes to compliance signals, including firewall, antivirus, BitLocker, Microsoft Defender status, operating system build, real-time protection, and Secure Boot, and proactively request reevaluation rather…
DocsCreate device compliance policies in Microsoft IntuneUpdated
Create device compliance policies in Microsoft Intune Create device compliance policies for Microsoft Intune.
Posts this month: What’s new in Microsoft Intune – September · Microsoft Intune and Apple OS 27: New settings, support, and platform changes · Moving from Windows Autopilot to Windows Autopilot device preparation · Unpacking Endpoint Management - Podcast series - Intune Tech Community
Microsoft Edge
10 changes · product page- Security update
Edge security update: Android 154.0.4258.38
Microsoft released the latest Microsoft Edge for Android (Version 154.0.4258.38) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Stable 154.0.4258.37
Microsoft released the latest Microsoft Edge for Stable (Version 154.0.4258.37) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Android 153.0.4234.49
Microsoft released the latest Microsoft Edge for Android (Version 153.0.4234.49) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Stable 153.0.4234.48
Microsoft released the latest Microsoft Edge for Stable (Version 153.0.4234.48) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Stable 153.0.4234.46
Microsoft released the latest Microsoft Edge for Stable (Version 153.0.4234.46) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Android and iOS 153.0.4234.32
Microsoft released the latest Microsoft Edge for Android and iOS (Version 153.0.4234.32) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Stable 153.0.4234.32
Microsoft released the latest Microsoft Edge for Stable (Version 153.0.4234.32) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Android 152.0.4191.65
Microsoft released the latest Microsoft Edge for Android (Version 152.0.4191.65) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .
- Security update
Edge security update: Stable 152.0.4191.66 (2 CVEs)
Microsoft released the latest Microsoft Edge for Stable (Version 152.0.4191.66) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-87491 has an exploit in the wild, and this update contains a fix for it…
- Security update
Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 152.0.4191.62) which incorporates the latest Securi (1 CVE)
Microsoft released the latest Microsoft Edge Stable Channel (Version 152.0.4191.62) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-85046 has an exploit in the wild, and this update contains a fix for it…
Posts this month: Security Review for Microsoft Edge version 152
Microsoft Defender for Cloud
5 changes · product page- Deprecation
Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation
September 23, 2026 As part of the transition to individual recommendations, the Machines should have a vulnerability assessment solution recommendation will be deprecated on December 14, 2026. Customers should use individual recommendations in Microsoft Defender for Cloud to review and…
DocsTransition from grouped to individual recommendations in Defender for …Updated
Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.
- GA
General availability of Defender for Cosmos DB in Azure Government cloud
September 3, 2026 With this general availability announcement, the Defender for Cosmos DB plan in Azure Government cloud now aligns with the commercial cloud offering in feature coverage and runtime protection capabilities. For more information about Microsoft Defender for Cosmos…
DocsOverview of Defender for Azure Cosmos DBInteroperability with Azure services, Azure clouds, and client …
Overview of Defender for Azure Cosmos DB Learn about the benefits, features, and security capabilities of Microsoft Defender for Azure Cosmos DB to help protect your databases.
- New feature
Upcoming billing updates for Defender for Servers
September 30, 2026 Effective November 1, 2026, Microsoft Defender for Servers introduces two related updates: Billing policy update: Productivity and desktop client devices, such as Windows 10 and Windows 11 PCs, are no longer billed as servers. For more information…
- New feature
Enhanced agent for Defender for SQL Servers on Machines is fully available in Azure Government cloud
September 29, 2026 In Azure Government cloud, the Defender for SQL Servers on Machines plan in Microsoft Defender for Cloud protects SQL Server instances running on Azure virtual machines and on Azure Arc-enabled machines connected to that cloud. The enhanced…
DocsUpdate Defender for SQL Servers on Machines Configuration for …UpdatedVerify Defender for SQL Servers on Machines Protection in Government …UpdatedTroubleshoot Defender for SQL on Machines ConfigurationUpdatedDefender for Cloud pricing page
Update Defender for SQL Servers on Machines Configuration for Automatic Registration Learn how to update the Defender for SQL Servers on Machines configuration to enable automatic registration for Azure VMs, on-premises, and hybrid environments.
- New feature
AWS GuardDuty coverage status is now shown on the S3 asset page
September 3, 2026 Microsoft Defender for Cloud now shows Amazon GuardDuty coverage status for AWS S3 buckets, in the Cloud security details section of the S3 asset page. Two statuses are shown for each bucket, each as Enabled or Disabled…
Posts this month: Generally Available: Microsoft Defender for Cloud support for Azure Container Apps (Serverless Containers Posture)
Microsoft Defender for Office 365
2 changes · product page- New feature
Separating Teams user reporting settings from email settings
Separating Teams user reporting settings from email settings : Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting…
Docshttps://security.microsoft.com/securitysettings/teamsUserSubmission
- New feature
Expanding user reporting in Teams to include group calls
Expanding user reporting in Teams to include group calls : Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings , reported calls are sent…
DocsUser reported settings in TeamsNewConfigure user reported message settings in Microsoft Defender for …New
User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.
Microsoft Purview
2 changes · product page- GA
Data Loss Prevention
General availability : Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps…
DocsLearn about Microsoft Purview Network Data SecurityUpdated
Learn about Microsoft Purview Network Data Security Network data security extends Microsoft Purview classification to network traffic
- New feature
Information Barriers
New : Create an Information Barriers policy compliance report to identify SharePoint sites, OneDrive accounts, and user-owned SharePoint Embedded containers that no longer comply after Information Barriers policy changes.
DocsCreate an Information Barriers policy compliance reportNew
Create an Information Barriers policy compliance report Learn how to find noncompliant sites after Information Barriers policies change.
Posts this month: Microsoft Purview Referential Architecture Diagrams · From DLP Alert Volume to Measurable Detection Assurance
Built from the What's New and release-notes pages on Microsoft Learn. Entries are grouped by the month Microsoft lists them under (or, for changes detected later, the month we detected them). Every title links to the exact section on Microsoft Learn.