Skip to content

What's new in Microsoft Security: October 2026

Every Microsoft Security update in October 2026: 54 documentation changes and 88 official posts across Sentinel, Defender, Entra, Intune, Purview and Security Copilot, with GA and preview releases, retirements and links to the sources.

← September 2026 November 2026 Patch Tuesday October 2026
54Documented changes
14Generally available
3In preview
88Official blog posts

Announcements

Official Microsoft blog and Tech Community posts, newest first

Retirements and deprecations

All retirements
EffectiveWhat's changingProductTypeSource
—not statedAzure Key Vault Secrets Provider Extension for Azure Arc enabled Kubernetes clusters

Retirement: Azure Key Vault Secrets Provider Extension for Azure Arc enabled Kubernetes clusters.

Action may be required		Azure securityRetirementAzure Updates
—not statedLegacy Apple MDM software update workloads removed from Intune

[Device configuration] Microsoft Intune is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27.

IntuneRetirementMicrosoft Learn
—not statedPreparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment

Preparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment.

IntuneRetirementIntune Customer Success
—not statedSetup Assistant legacy deprecation for Apple enrollment profiles

Setup Assistant legacy deprecation for Apple enrollment profiles.

IntuneDeprecationMicrosoft Learn

Microsoft Sentinel

1 changes · product page
  1. Preview

    Detect use of vulnerable SAP BTP custom apps (Preview)

    The SAP BTP solution adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect use of custom apps with open high or critical vulnerabilities. The rule identifies interactive XSUAA logins that match a…

    DocsMicrosoft Sentinel Solution for SAP BTP - security content referenceNew

    Microsoft Sentinel Solution for SAP BTP - security content reference Learn about the built-in security content provided by the Microsoft Sentinel Solution for SAP BTP.

    Listed under October 2026 on Microsoft Learn

Posts this month: What’s new in Microsoft Sentinel: October 2026 · Growing our connector ecosystem with 500+ Microsoft Sentinel connectors · Add HoneyForge Threat Detection solution v1.0.0 · Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview) · Expanded cross-tenant delegated access in Microsoft Defender is generally available · Introducing the Microsoft Sentinel ASIM EmailEvent schema

Microsoft Security Exposure Management

3 changes · product page
  1. GA

    Posture policies and recommendation exemptions available for Azure environments

    October 28, 2026 Posture policies and recommendation exemptions are now available in public preview as part of Microsoft Security Exposure Management for Azure environments. With these new capabilities, you can: Gain visibility into your security posture through evaluations of Azure…

    DocsManage posture policiesNewManage exemptionsNew

    Manage posture policies Learn how to manage posture policies in the Microsoft Defender portal, including policy types, permissions, policy effects, transition guidance, and limitations.

    Listed under October 2026 on Microsoft Learn
  2. GA

    Vulnerability assessment for Microsoft Store applications

    Vulnerability assessment for Microsoft Store applications. Vulnerability assessment for applications installed via the Microsoft Store is now generally available. Defender Vulnerability Management detects supported Microsoft Store applications, adds them to the software inventory, and assesses them for vulnerabilities. Coverage is…

    DocsSoftware inventoryNew

    Software inventory The software inventory page for Microsoft Defender Vulnerability Management shows how many weaknesses and vulnerabilities were detected in software.

    Listed under October 2026 on Microsoft Learn
  3. Preview

    Codename MDASH - MAI Cyber configuration now uses MAI-Cyber-1.1-Flash

    The MAI Cyber (Preview) scan configuration now uses MAI-Cyber-1.1-Flash instead of MAI-Cyber-1-Flash. If your Foundry already uses MAI-Cyber-1-Flash, it’s automatically upgraded in Foundry to MAI-Cyber-1.1-Flash. MAI Cyber (Preview) is now the recommended scan configuration for MDASH.

    Listed under October 2026 on Microsoft Learn

Microsoft Defender for Endpoint

7 changes · product page
  1. GA

    macOS release: Build 101.26092.0009

    macOS release: Build 101.26092.0009. Release version 20.126092.9.0 released: See enhancements and features for this release .

    DocsMicrosoft Defender for Endpoint release notesNew

    Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

    Listed under October 2026 on Microsoft Learn
  2. GA

    macOS release: Build 101.26082.0012

    macOS release: Build 101.26082.0012. Release version 20.126082.12.0 released: See enhancements and features for this release .

    DocsMicrosoft Defender for Endpoint release notesNew

    Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

    Listed under October 2026 on Microsoft Learn
  3. GA

    Local AI agent discovery on Windows and macOS

    Local AI agent discovery on Windows and macOS. Discover supported local AI agents and their configured MCP servers on onboarded Windows and macOS devices, and investigate them in the AI agent inventory and advanced hunting. Windows requires Microsoft Defender Antivirus…

    DocsLocal AI agent discovery with Microsoft Defender for EndpointNewDiscover local AI agents with Microsoft Defender for EndpointNewMicrosoft Defender for Endpoint AI agent support matrixNew

    Local AI agent discovery with Microsoft Defender for Endpoint Learn how Microsoft Defender discovers local AI agents and MCP servers configured on your devices through inventory and investigation capabilities.

    Listed under October 2026 on Microsoft Learn
  4. GA

    Antivirus audit mode for Linux

    Antivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…

    DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated

    Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.

    Listed under October 2026 on Microsoft Learn
  5. Release

    Windows Antivirus · October 2026 · Platform 4.18.26100.4 · Engine 1.1.26100.4

    Release details Component Version Date Platform 4.18.26100.4 October 27, 2026 Engine 1.1.26100.4 October 27, 2026 Security intelligence 1 1.463.1.0 October 27, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…

    DocsSecurity intelligence updates for Microsoft Defender Antivirus and …

    Listed under October 2026 on Microsoft Learn
  6. Release

    Linux · October 2026 · 101.26091.0004

    Release details Release version Engine version Signature version 30.126091.0004.0 1.1.26070.5001 1.457.364.0 Enhancements and features Feature area Update summary Platform Support Added support for Azure Linux 4. Visibility Added TCP socket bind telemetry, improving visibility into processes binding to local network…

    Listed under October 2026 on Microsoft Learn
  7. Release

    Linux · October 2026 · 101.26091.0003

    Release details Release version Engine version Signature version 30.126091.0003.0 1.1.26090.3000 1.461.35.0 Enhancements and features Feature area Update summary Security Upgraded libcurl to version 8.22.0 to address CVE-2026-9546. Security Hardened quarantine operations by enforcing authorization checks and protecting against file-path manipulation…

    Listed under October 2026 on Microsoft Learn

Posts this month: Secure Linux desktops with Microsoft Defender

Microsoft Defender for Identity

4 changes · product page
  1. GA

    General availability of sensor v3.x activation without Defender for Endpoint

    Defender for Identity sensor v3.x activation without Defender for Endpoint is now generally available. Supported servers include eligible domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. This activation method supports only…

    DocsActivate the Microsoft Defender for Identity sensor v3.xNew

    Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.

    Listed under October 2026 on Microsoft Learn
  2. New feature

    New Defender for Identity security alerts

    The October announcement includes the following new alerts: New alerts related to Entra ID : Malicious registration of a device with strong MFA Malicious registration of an attacker controlled MFA device Newly created user performed organization branding change Suspicious registration…

    DocsMicrosoft Defender for Identity XDR security alertsUpdated

    Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.

    Listed under October 2026 on Microsoft Learn
  3. New feature

    Known limitation: Sensor v3.x activation without Defender for Endpoint isn't supported in government clouds

    Activating the Defender for Identity v3.x sensor on servers without Microsoft Defender for Endpoint deployment is temporarily not supported in government cloud environments.

    Listed under October 2026 on Microsoft Learn
  4. New feature

    Automatic sensor v3.x activation and Windows auditing for existing customers

    This rollout applies only to organizations that are licensed for Defender for Identity and have an active workspace. Eligible organizations included in the rollout see a banner on the Sensor management tab of the On-premises settings page for 30 days…

    DocsActivate the Microsoft Defender for Identity sensor v3.xNewConfigure Windows event auditingNew

    Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.

    Listed under October 2026 on Microsoft Learn

Microsoft Entra

1 changes · product page
  1. New feature

    IDV partner gallery update

    IDV partner gallery update : Added HYPR as a new partner in the Verified ID API-based integration partners section.

    DocsMicrosoft Entra Verified ID - IDV partner galleryNew

    Microsoft Entra Verified ID - IDV partner gallery Explore Microsoft Entra Verified ID identity verification partners and integrations for remote onboarding, secure access, and account recovery.

    Listed under October 2026 on Microsoft Learn

Posts this month: AI agents are coming—are your identity controls prepared? · Why identity needs network insight to make Zero Trust work · Designing smarter access policies for hybrid enterprises · Announcing: Choose Your Own Telephony (CYOT) for Microsoft Entra · Master Microsoft Entra with live webinars, AMAs, and on-demand videos · What’s new in Microsoft Entra: October 2026

Microsoft Intune

17 changes · product page
  1. Deprecation

    Setup Assistant legacy deprecation for Apple enrollment profiles

    Intune has ended support for Setup Assistant (legacy) authentication for iOS/iPadOS and macOS automated device enrollment (ADE) with user affinity to align with modern authentication standards. Existing profiles are automatically updated to Setup Assistant with modern authentication, and…

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  2. GA

    Agent runtime protection settings are generally available

    Microsoft Intune's endpoint security template for Microsoft Defender for Endpoint agent runtime protection settings is now generally available. Administrators can use the template to manage supported runtime protection settings for Windows devices without the preview designation, aligning Intune…

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  3. GA

    New Remote Help for Windows version available

    [Advanced capabilities (formerly "Microsoft Intune Suite")] Remote Help for Windows version 5.2.1210.0 is now available. This release includes stability and observability improvements. Applies to: Windows

    Listed under 12–18 Oct 2026 on Microsoft Learn
  4. GA

    Intune security baseline for Windows 11, version 26H2

    The Windows security baseline for Windows 11, version 26H2 is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations and is the latest available Windows security baseline in Intune. The Windows 11, version 26H2 security…

    DocsPost Windows 11, version 26H2 security baselineUpdatedDefault configuration of Intune's Windows security baselinesNewConfigure security baseline policies in Microsoft Intune

    Windows 11, version 26H2 security baseline Update: The Windows 11, version 26H2 security baseline has been updated to reflect the general availability of Administrator protection. An updated v2...

    Listed under 5–11 Oct 2026 on Microsoft Learn
  5. New feature

    Updated Windows support for Administrator protection settings

    Microsoft Intune now supports two Administrator protection settings in the settings catalog on Windows 11 versions 24H2 and 25H2. Admins can configure the Administrator Approval Mode type and choose the elevation prompt behavior used with Administrator protection. For…

    DocsCreate a policy using settings catalog in Microsoft IntuneNew

    Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  6. New feature

    STIG audit baselines for Windows devices in commercial tenants

    Microsoft Intune commercial tenants can now audit Windows devices against Security Technical Implementation Guide (STIG) recommendations. Review per-setting and per-device audit results to identify configuration gaps and prioritize remediation. The baseline evaluates supported automated checks without changing device…

    DocsUse Security Technical Implementation Guide audit baselines to assess …New

    Use Security Technical Implementation Guide audit baselines to assess Windows device compliance in Microsoft Intune Learn how to use the Security Technical Implementation Guide security baseline in Microsoft Intune to assess Windows device compliance against Security Technical Implementation Guide recommendations for Department of Defense organizations.

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  7. New feature

    Push notification support update for Windows devices

    We've improved connectivity for scenarios that rely on push notifications including Device actions , Win32 apps , PowerShell scripts and Remediations . For the best experience, we recommend updating firewall rules to include this new endpoint: *.trouter.communications.svc.cloud.microsoft For…

    DocsDevice Actions - Wipe, Lock, Locate, and MoreNewAdd PowerShell Scripts to Windows Devices in Microsoft IntuneUpdatedNetwork endpoints for Microsoft IntuneUpdatedAdd and Assign Win32 Apps to Microsoft Intune

    Device Actions - Wipe, Lock, Locate, and More Discover how to use Microsoft Intune to remotely manage, wipe, lock, restart, and secure Android, iOS/iPadOS, tvOS, visionOS, macOS, Windows, and ChromeOS devices. Learn about available device actions, prerequisites, and bulk actions for IT admins.

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  8. New feature

    Manage referenced apps on AOSP devices

    Microsoft Intune now supports AOSP referenced app type that lets you identify an app by package name instead of uploading an APK on AOSP devices. You can assign Required or Uninstall intent to OEM, preloaded, or externally deployed…

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  9. New feature

    Faster delivery of Windows scripts

    Microsoft Intune now uses push notifications for admin-initiated and service-side changes to Windows scripts. Managed devices can check in sooner after script changes, reducing delivery and refresh delays compared with waiting for the normal polling interval. This update improves…

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  10. New feature

    Enforce Routes capability in Apple VPN profiles

    Microsoft Intune now supports Apple's Enforce Routes capability in iOS/iPadOS and macOS VPN profiles. Admins define routing behavior with Include all networks and Exclude local networks , and Intune automatically derives the appropriate Enforce Routes configuration. This helps…

    DocsConfigure VPN settings for Apple devices in Microsoft IntuneUpdated

    Configure VPN settings for Apple devices in Microsoft Intune Add or create a VPN configuration profile on iOS/iPadOS and macOS devices using virtual private network (VPN) configuration settings in Microsoft Intune. Configure the connection details, authentication methods, split tunneling, custom VPN settings with the identifier, key and value pairs…

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  11. New feature

    Certificate connector health monitoring in the Microsoft Intune admin center

    The Certificate Connector for Microsoft Intune now surfaces health and status signals in the Microsoft Intune admin center, so you can spot certificate-issuance problems early. Clear indicators call out common failure conditions — such as the connector…

    DocsOverview of Certificate Connector for Microsoft IntuneUpdated

    Overview of Certificate Connector for Microsoft Intune Learn about the unified Certificate Connector for Microsoft Intune, which supports SCEP, PKCS, imported PKCS, and certificate revocation.

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  12. New feature

    Bulk manage eSIMs on corporate-owned Android Enterprise devices

    Microsoft Intune now supports bulk eSIM actions for corporate-owned Android Enterprise devices. From Devices > All devices > Bulk device actions , you can activate eSIMs on up to 100 selected devices running Android 15 or later by…

    DocsManage eSIM plans in Microsoft IntuneNewWipe devices with Microsoft IntuneNew

    Manage eSIM plans in Microsoft Intune Activate and remove eSIM cellular plans on supported Apple and Android Enterprise devices with Microsoft Intune device actions.

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  13. New feature

    Apple OS 27 DDM status data added to device inventory

    Microsoft Intune now adds Apple OS 27 declarative device management status data to device inventory. Admins can review new inventory for: device health for hardware components, enhanced logging sessions, content cache status, and Apple MDM and security states…

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  14. New feature

    Administrator protection settings in Account protection policies

    Microsoft Intune now includes two Administrator protection settings in endpoint security Account protection policies. On supported Windows 11 versions, admins can configure the Administrator Approval Mode type and choose the elevation prompt behavior for Administrator protection. For more…

    DocsManage account protection settings with endpoint security policies in …

    Manage account protection settings with endpoint security policies in Microsoft Intune Use Microsoft Intune endpoint security account protection policies to protect the identity and accounts of users.

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  15. New feature

    Add support for the MEFERI OEMConfig app on Android Enterprise

    Microsoft Intune now supports the MEFERI OEMConfig app ( com.meferi.oemconfig ) for Android Enterprise devices. Admins can use the existing Intune OEMConfig workflow to deploy settings exposed by MEFERI's OEM-provided schema, expanding supported device management options without custom…

    DocsUse OEMConfig on Android Enterprise devices in Microsoft IntuneNew

    Use OEMConfig on Android Enterprise devices in Microsoft Intune Use Microsoft Intune to manage and use devices running Android Enterprise with OEMConfig. See all the steps, including an overview, see the prerequisites, create the configuration profile in Intune, and see a list of supported OEMConfig apps.

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn
  16. New feature

    Unlimited licenses for Apple volume purchase program (VPP) apps

    You can now assign VPP apps with unlimited licenses from Apple Business and Apple School Manager, making it easier to deploy apps across your organization without managing license quantities. Applies to: iOS/iPadOS macOS

    Listed under 19–25 Oct 2026 on Microsoft Learn
  17. Retirement

    Legacy Apple MDM software update workloads removed from Intune

    Microsoft Intune is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27. Admins should use Apple declarative device management update policies to continue managing software updates. This keeps Intune…

    DocsPost Support tip: Move to declarative device management for Apple software …

    Support tip: Move to declarative device management for Apple software updates By: Benjamin Flamm – Product Manager | Microsoft Intune Apple recently announced at the Worldwide Developer Conference (WWDC) in June 2025 that mobile...

    Listed under 26 Oct – 1 Nov 2026 on Microsoft Learn

Posts this month: New policy implementation and web enrollment for Android personally owned work profile is now GA · Your guide to Intune at Microsoft Ignite 2026 · What’s new in Microsoft Intune – October · Establish a macOS security baseline with mSCP and Microsoft Intune custom compliance · Require Google Workspace authentication on Android Enterprise devices with Microsoft Intune · Preparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment

Microsoft Edge

10 changes · product page
  1. Security update

    Edge security update: Stable 156.0.4314.58

    Microsoft released the latest Microsoft Edge for Stable (Version 156.0.4314.58) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 30, 2026 on Microsoft Learn
  2. Security update

    Edge security update: Stable 156.0.4314.56

    Microsoft released the latest Microsoft Edge for Stable (Version 156.0.4314.56) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 29, 2026 on Microsoft Learn
  3. Security update

    Edge security update: Stable 156.0.4314.42

    Microsoft released the latest Microsoft Edge for Stable (Version 156.0.4314.42) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 22, 2026 on Microsoft Learn
  4. Security update

    Edge security update: Android 155.0.4283.61

    Microsoft released the latest Microsoft Edge for Android (Version 155.0.4283.61) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 19, 2026 on Microsoft Learn
  5. Security update

    Edge security update: Stable 155.0.4283.62

    Microsoft released the latest Microsoft Edge for Stable (Version 155.0.4283.62) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 16, 2026 on Microsoft Learn
  6. Security update

    Edge security update: Stable 155.0.4283.60

    Microsoft released the latest Microsoft Edge for Stable (Version 155.0.4283.60) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 15, 2026 on Microsoft Learn
  7. Security update

    Edge security update: Android 155.0.4283.48

    Microsoft released the latest Microsoft Edge for Android (Version 155.0.4283.48) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 12, 2026 on Microsoft Learn
  8. Security update

    Edge security update: Stable 155.0.4283.45

    Microsoft released the latest Microsoft Edge for Stable (Version 155.0.4283.45) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 08, 2026 on Microsoft Learn
  9. Security update

    Edge security update: Stable 154.0.4258.62

    Microsoft released the latest Microsoft Edge for Stable (Version 154.0.4258.62) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 05, 2026 on Microsoft Learn
  10. Security update

    Edge security update: Stable 154.0.4258.53

    Microsoft released the latest Microsoft Edge for Stable (Version 154.0.4258.53) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

    DocsSecurity Update Guide

    Listed under October 01, 2026 on Microsoft Learn

Posts this month: Security Review for Microsoft Edge version 156

Microsoft Defender for Cloud

6 changes · product page
  1. GA

    Posture policies and recommendation exemptions available in Microsoft Defender

    October 28, 2026 Posture policies and recommendation exemptions are now available in public preview in the Microsoft Defender portal for Azure environments. With these new capabilities, you can: Gain visibility into your security posture through evaluations of Azure resources against…

    DocsExempt resources from recommendationsNewSecurity policies in Microsoft Defender for CloudNew

    Exempt resources from recommendations Create exemption rules to remove resources or recommendations from secure score impact in Microsoft Defender for Cloud.

    Listed under October 2026 on Microsoft Learn
  2. GA

    On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares (GA)

    October 5, 2026 On-demand malware scanning in Microsoft Defender for Storage now supports targeted scanning of specific items. Instead of scanning an entire storage account, you can scope scans to a single blob or file, a specific container or file…

    DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated

    Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.

    Listed under October 2026 on Microsoft Learn
  3. GA

    KSPM misconfiguration recommendations moving to controller-level scope (GA)

    October 5, 2026 Kubernetes security posture management (KSPM) misconfiguration recommendations are being updated to align their resource scope with Kubernetes workload controllers. Previously, recommendations appeared at the individual running container instance level. They will now appear at the container deployment…

    DocsReference table for all container security recommendations in …

    Reference table for all container security recommendations in Microsoft Defender for Cloud This article lists all Microsoft Defender for Cloud container security recommendations that help you harden and protect your resources.

    Listed under October 2026 on Microsoft Learn
  4. New feature

    New Defender server security experience

    October 6, 2026 The new Defender server security experience brings together cloud and endpoint data from Microsoft Defender for Endpoint and Defender for Servers. In the Microsoft Defender portal, you can: Review the new server asset page with combined cloud…

    DocsThe new Defender server security experienceNewOffboard devicesNew

    The new Defender server security experience Review cloud and endpoint information, investigate threats, and check access for servers in Microsoft Defender.

    Listed under October 2026 on Microsoft Learn
  5. New feature

    Expanded server onboarding experience

    October 20, 2026 The new Defender server security experience expands to include onboarding guidance for Azure and on-premises servers, building on the investigation and access management capabilities released on October 6. With this update, you can: Onboard supported Azure virtual…

    DocsUse Direct onboarding for on-premises serversNewOffboard devicesNewOnboard servers to Microsoft DefenderUpdatedConnect on-premises machinesUpdated

    Use Direct onboarding for on-premises servers Associate existing endpoint-protected servers with Defender for Servers and review the affected population.

    Listed under October 2026 on Microsoft Learn
  6. Preview

    Cloud security plan management in the Defender portal

    October 20, 2026 Cloud security plan management is scheduled to become available in public preview in the Microsoft Defender portal for Azure commercial environments on October 20, 2026. With this experience, you can: Connect Azure subscriptions and management groups to…

    DocsOverview of Defender for Cloud in Defender PortalUpdated

    Overview of Defender for Cloud in Defender Portal Comprehensive overview of Microsoft Defender for Cloud in the Defender portal, including navigation hub, dashboard features, and unified security management capabilities.

    Listed under October 2026 on Microsoft Learn

Posts this month: Cloud Security Billing, Simplified: Introducing the Defender Workload Unit

Microsoft Defender for Cloud Apps

1 changes · product page
  1. New feature

    Automatic enablement of SaaS accounts integration with Identity inventory

    Starting October 15, 2026 , the SaaS accounts integration between Microsoft Defender for Cloud Apps and Identity inventory will transition from opt-in to automatic enablement. The integration will be enabled automatically for eligible tenants that don't use the User group…

    DocsIdentity inventory integration

    Listed under October 2026 on Microsoft Learn

Microsoft Defender for Office 365

3 changes · product page
  1. New feature

    New ApproverUpn field in the EmailPostDeliveryEvents table

    New ApproverUpn field in the EmailPostDeliveryEvents table : The EmailPostDeliveryEvents table in Microsoft Defender XDR Advanced Hunting now includes the ApproverUpn field. This field identifies the user or administrator who approved a remediation action, helping security teams investigate and audit…

    DocsEmailPostDeliveryEvents table in the advanced hunting schema

    EmailPostDeliveryEvents table in the advanced hunting schema Learn about post-delivery actions taken on Microsoft 365 emails in the EmailPostDeliveryEvents table of the advanced hunting schema

    Listed under October 2026 on Microsoft Learn
  2. New feature

    Hunt across activities in Microsoft Teams calls and meetings

    Hunt across activities in Microsoft Teams calls and meetings : The CallActivityEvents table in Microsoft Defender XDR advanced hunting contains details about activities performed during Microsoft Teams calls and meetings in your organization, helping security teams investigate suspicious call activity.

    DocsCallActivityEvents table in the advanced hunting schemaNew

    CallActivityEvents table in the advanced hunting schema Learn about the CallActivityEvents table in the advanced hunting schema, which contains details about activities performed during Microsoft Teams calls.

    Listed under October 2026 on Microsoft Learn
  3. New feature

    Expanding user reporting in Teams to include meetings

    Expanding user reporting in Teams to include meetings : Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that…

    DocsUser reported settings in TeamsNew

    User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

    Listed under October 2026 on Microsoft Learn

Microsoft Purview

1 changes · product page
  1. GA

    Data Loss Prevention

    General availability : Endpoint data loss prevention (DLP) can now monitor sensitive data transferred over FTP and SFTP and apply restrictive actions based on your organization’s requirements. To get started, configure FTP and SFTP transfer activities in your Endpoint DLP…

    DocsProtect FTP/SFTP Transfers in Microsoft PurviewNew

    Protect FTP/SFTP Transfers in Microsoft Purview Endpoint data loss prevention (DLP) in Microsoft Purview can monitor and protect sensitive data that users transfer over FTP and SFTP from managed Windows devices.

    Listed under October 2026 on Microsoft Learn Roadmap 570845

Posts this month: Troubleshooting playbook for Auto labelling in SharePoint and OneDrive · Why DLP for External Web Search in Microsoft 365 Copilot Matters? · Meet the New Microsoft Purview Classifiers Experience: Your Admin Playbook for Public Preview

Built from the What's New and release-notes pages on Microsoft Learn. Entries are grouped by the month Microsoft lists them under (or, for changes detected later, the month we detected them). Every title links to the exact section on Microsoft Learn.

Type to search every update, post, CVE and roadmap item.

Try