What's New in Microsoft Security

Edge security update: Android 157.0.4341.53 (1 CVE)

Microsoft released the latest Microsoft Edge for Android (Version 157.0.4341.53) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-125350 has an exploit in the wild, and this update contains a fix for it…

DocsCVE-2026-125350·Security Update Guide

Codename MDASH - MAI Cyber configuration now uses MAI-Cyber-1.1-Flash

The MAI Cyber (Preview) scan configuration now uses MAI-Cyber-1.1-Flash instead of MAI-Cyber-1-Flash. If your Foundry already uses MAI-Cyber-1-Flash, it’s automatically upgraded in Foundry to MAI-Cyber-1.1-Flash.

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Caju AI by Caju AI eYACHO for Biz 7 Intune by MetaMoJi Corporation (iOS) eYACHO Viewer 7 Intune by MetaMoJi Corporation (iOS) Harvey AI by Harvey AI (Android)…

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Notion by Notion Labs Superhuman Mail by Superhuman Labs Calven by Calven Pty Limited Heijmans by Heijmans Notability by Ginger Labs, Inc. (iOS) Ben for Intune by Thanks…

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: eScription One by DeliverHealth Prisma Browser for Intune by Palo Alto Networks, Inc. Elevate UC for Intune by Serverdata.net, Inc. For more information about protected apps, see Microsoft…

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

Edge security update: Microsoft is aware of the recent exploits existing in the wild.

Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.

Edge security update: Android and iOS 157.0.4341.42

Microsoft released the latest Microsoft Edge for Android and iOS (Version 157.0.4341.42) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . Note: CVE's will be added as soon as available.

DocsSecurity Update Guide

Warning notifications for iOS apps running unsupported SDK versions

We're continuing improvements to the Microsoft Intune mobile application management (MAM) service to ensure applications remain secure, reliable, and aligned with the latest platform capabilities. Starting in late June 2026, users opening iOS apps built with an Intune MAM SDK…

DocsiOS/iPadOS App Protection Policy Settings

iOS/iPadOS App Protection Policy Settings This article describes the iOS/iPadOS app protection policy (APP) settings for iOS/iPadOS devices.

View eSIM profiles and deployment status for Windows devices

Microsoft Intune will add Windows eSIM profile information and deployment status to the Properties Catalog. This visibility will make it easier to identify devices that require follow-up and validate profile deployment across your managed Windows estate. Applies to: Windows

Updated minimum supported version for macOS

Microsoft Intune will update its minimum supported macOS version after Apple releases macOS 27. Intune, the Company Portal, and the Intune management agent will support macOS 15 and later. Devices running macOS 14 or earlier that are already enrolled will…

Update to the latest Intune Company Portal for Android, Intune App SDK for iOS, and Intune App Wrapper for iOS

Starting January 19, 2026 , or soon after, we're making updates to improve the Intune mobile application management (MAM) service. To stay secure and run smoothly, this update will require iOS wrapped apps, iOS SDK integrated apps, and the Intune…

DocsConditional Access - Require approved app or app protection policyUpdated·Action Required: Update the MAM SDK in your application to avoid end …·Action Required: Wrap your application with version 20.8.1+ to avoid …·v20.8.0 - Release 20.8.0 - microsoftconnect/ms-intune-app-sdk-ios | …

Conditional Access - Require approved app or app protection policy Create a custom Conditional Access policy require approved app or app protection policy

Update to the latest Intune App SDK and Intune App Wrapper for Android 15 support

We've recently released new versions of the Intune App SDK and Intune App Wrapping Tool for Android to support Android 15. We recommend upgrading your app to the latest SDK or wrapper versions to ensure applications stay secure and run…

DocsIntune App SDK for Android·Intune App Wrapping Tool for Android

Update to support statement for Windows 10 in Intune

Windows 10 has reached end of support on October 14, 2025 . Windows 10 no longer receives quality or feature updates. Security updates are only available to commercial customers who have enrolled devices into the Extended Security Updates (ESU) program…

DocsWindows 10 - release informationNew·Windows 11 - release informationNew·Stay secure with Windows 11, Copilot+ PCs, and Windows 365 before …·Windows 10 reaching end of support

Windows 10 - release information Learn release information for Windows 10 releases

Update firewall configurations to include new Intune network endpoints

As part of Microsoft's ongoing Secure Future Initiative (SFI) , starting on or shortly after December 2, 2025 , the network service endpoints for Microsoft Intune will also use the Azure Front Door IP addresses. This improvement supports better alignment…

DocsAzure service tags overviewNew·Network endpoints for Microsoft IntuneUpdated·Secure Future Initiative (SFI)·Public Cloud from Official Microsoft Download Center

Azure service tags overview Learn about Azure service tags and how they simplify security rule creation for Azure Virtual Networks. Discover benefits and best practices.

Support for the KEYENCE OEMConfig app on Android Enterprise

Microsoft Intune will add support for the KEYENCE OEMConfig app ( com.keyence.autoid.oemconfigs ) for Android Enterprise devices. You'll be able to use the app with Intune's OEMConfig workflow to configure the device settings that KEYENCE exposes through its app schema…

Support for Intune Device control policy for devices managed by Microsoft Defender for Endpoint

You'll be able to use the endpoint security policy for Device control (Attack surface reduction policy) from Microsoft Intune with the devices you manage through the Microsoft Defender for Endpoint security settings management capability. Device control policies are part of…

DocsLearn about using Intune to manage Microsoft Defender settings on …Updated·Manage attack surface reduction settings with Microsoft Intune

Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune Learn how to use Intune policy to manage Microsoft Defender security settings on devices that aren't enrolled with Microsoft Intune.

Share device diagnostics during Remote Help sessions on Windows

Helpdesk agents will be able to request device diagnostics during an attended Remote Help session on Windows. After the person receiving help consents, the agent will be able to review diagnostic information, such as system details and resource usage, to…

Scope tags support for Endpoint Privilege Management reports

We're fixing how scope tags work with Endpoint Privilege Management (EPM) reports. With this change, EPM reports will respect the report viewer's assigned scope and display the details for only the users and devices that the report user is scoped…

Remote Help support in GCCH

You'll be able to use Remote Help in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants. IT support staff will be able to establish…

Plan for change: User alerts on iOS for when screen capture actions are blocked

In an upcoming version (20.3.0) of the Intune App SDK and Intune App Wrapping Tool for iOS, support is added to alert users when a screen capture action (including recording and mirroring) is detected in a managed app. The alert…

DocsNew block screen capture for iOS/iPadOS MAM protected apps

Plan for change: Intune is moving to support macOS 15 and higher later this year

Later in calendar year 2026, we expect macOS Golden Gate 27 to be released by Apple. Microsoft Intune, the Company Portal app, and the Intune mobile device management agent support macOS 15 and later. Since the Company Portal app for…

Plan for Change: New settings for Apple AI features; Genmojis, Writing tools, Screen capture

Today, the Apple AI features for Genmojis, Writing tools, and screen capture are blocked when the app protection policy (APP) "Send Org data to other apps" setting is configured to a value other than "All apps". For more details on…

DocsPost Microsoft Intune support for Apple Intelligence·iOS/iPadOS App Protection Policy Settings

Microsoft Intune support for Apple Intelligence Learn more about Intune support for Apple Intelligence.

Plan for Change: New Intune connector for deploying Microsoft Entra hybrid joined devices using Windows Autopilot

As part of Microsoft's Secure Future Initiative, we recently released an update to the Intune Connector for Active Directory to use a Managed Service Account instead of a local SYSTEM account for deploying Microsoft Entra hybrid joined devices with Windows…

DocsEnrollment for Microsoft Entra hybrid joined devicesNew·Microsoft Intune Connector for Active Directory security update

Enrollment for Microsoft Entra hybrid joined devices Use Windows Autopilot to enroll Microsoft Entra hybrid joined devices in Microsoft Intune.

Plan for Change: Intune is moving to support iOS/iPadOS 18 and later

Later in calendar year 2026, we expect iOS 27 and iPadOS 27 to be released by Apple. Microsoft Intune, including the Intune Company Portal and Intune app protection policies (APP, also known as MAM), requires iOS 17/iPadOS 17 and higher…

DocsManage device operating system versions with IntuneUpdated·Operating systems and browsers supported by Microsoft Intune·this statement about ADE Userless support

Manage device operating system versions with Intune Learn about the methods for managing device operating system versions supported by Microsoft Intune.

Plan for Change: Implement strong mapping for SCEP and PKCS certificates

With the May 10, 2022, Windows update ( KB5014754 ), changes were made to the Active Directory Kerberos Key Distribution (KDC) behavior in Windows Server 2008 and later versions to mitigate elevation of privilege vulnerabilities associated with certificate spoofing. Windows…

DocsKB5014754·Post Support tip: Implementing strong mapping in Microsoft Intune …

Support tip: Implementing strong mapping in Microsoft Intune certificates Learn more about implementing strong mapping in Microsoft Intune certificates.

Plan for Change: Google Play strong integrity definition update for Android 13 or above

Google recently updated the definition of "Strong Integrity" for devices running Android 13 or above, requiring hardware-backed security signals and recent security updates. For more information, see the Android Developers Blog: Making the Play Integrity API faster, more resilient, and…

DocsHow to Monitor App Protection Policies·Android App Protection Policy Settings·Android Enterprise compliance settings in Microsoft Intune

How to Monitor App Protection Policies This article describes how to monitor app protection policies in Intune.

Plan for Change: Blocking screen capture in the latest Intune App SDK for iOS and Intune App Wrapping Tool for iOS

We recently released updated versions of the Intune App SDK and the Intune App Wrapping Tool. Included in these releases (v19.7.5+ for Xcode 15 and v20.2.0+ for Xcode 16) is the support for blocking screen capture, Genmojis, and writing tools…

DocsConfiguration Policies for Intune App SDK Managed Apps·iOS/iPadOS App Protection Policy Settings·App Configuration Policies for Microsoft Intune

Configuration Policies for Intune App SDK Managed Apps Learn how to configure policies for Intune App SDK managed apps.

Notices

These notices provide important information that can help you prepare for future Intune changes and features.

New endpoint security template for Microsoft Defender for Endpoint safe deployment settings

We're working on a new endpoint security template in Intune dedicated to Microsoft Defender for Endpoint (MDE) safe deployment settings. This will give you a focused, purpose-built policy for managing how MDE updates roll out across your Windows devices. Microsoft…

DocsLearn about using Intune to manage Microsoft Defender settings on …Updated·Use safe deployment practices to safeguard your environment

Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune Learn how to use Intune policy to manage Microsoft Defender security settings on devices that aren't enrolled with Microsoft Intune.

New Linux antivirus settings for Microsoft Defender for Endpoint

We're adding a new Microsoft Defender Updates template for Linux endpoint security antivirus policies. This template will include four new settings for managing Microsoft Defender for Endpoint agent auto-update behavior on Linux devices attached via MDE attach. You will be…

Mark Windows devices noncompliant when prohibited AI agents are discovered

Automatically mark Windows devices as noncompliant when prohibited local AI agents, such as OpenClaw, are discovered on the device. As an admin, you'll be able to configure a list of prohibited agents in a Windows compliance policy. When a prohibited…

Maintenance windows for updates on Windows devices

Microsoft Intune will introduce maintenance windows to help you schedule firmware, driver, and operating system updates on Windows devices. You'll be able to choose supported update operations and configure a start date, start time, duration, and repeat schedule. You'll create…

Just-in-time registration automatically enabled for eligible iOS/iPadOS tenants

Microsoft Intune will automatically enable just-in-time (JIT) registration for eligible iOS/iPadOS tenants with the 2611 release. This change will apply to tenants with Microsoft Authenticator deployed as a required app and an existing device single sign-on (SSO) extension policy that…

JIT registration reminder during Apple MDM push certificate renewal for iOS and iPadOS

Beginning with the November 2026 release, Intune will display a new acknowledgment when you renew an Apple MDM push certificate in the Microsoft Intune admin center. The acknowledgment will remind you to configure just-in-time (JIT) registration for iOS and iPadOS…

Intune moving to support Android 10 and later for user-based management methods in October 2024

In October 2024, Intune supports Android 10 and later for user-based management methods, which includes: Android Enterprise personally owned work profile Android Enterprise corporate owned work profile Android Enterprise fully managed Android Open Source Project (AOSP) user-based Android device administrator…

DocsIntune moving to support Android 10 and later for user-based …·Manage device operating system versions with IntuneUpdated·Android App Protection Policy Settings

Manage device operating system versions with Intune Learn about the methods for managing device operating system versions supported by Microsoft Intune.

Disable MAC address randomization on macOS Wi-Fi profiles

On macOS devices, the Disable MAC address randomization setting will be available for Wi-Fi profiles. Use this setting to disable MAC address randomization on managed macOS devices. When connecting to a network, devices can present a randomized MAC address instead…

DocsConfigure Wi-Fi Settings for Apple Devices in Intune·Create a Wi-Fi profile for devices in Microsoft Intune

Configure Wi-Fi Settings for Apple Devices in Intune Add or create a Wi-Fi configuration profile on iOS/iPadOS and macOS devices using Wi-Fi configuration settings in Microsoft Intune. Configure the connection details, authentication methods, SSIDs, security types, and proxy settings.

Device query for multiple devices for app inventory on Windows

Advanced Analytics will extend device query for multiple devices to cover app inventory data on Windows. Building on the existing multi-device query for hardware inventory, you'll be able to use Kusto Query Language (KQL) to investigate installed applications across your…

Declarative VPP app download in Company Portal

The iOS/iPadOS Company Portal will support Declarative Volume-Purchased Program (VPP) app downloads from the Apps tab. Declarative VPP apps provide an improved end-user experience by reducing app installation latency, allowing for automatic overnight app updates, and providing the end user…

Controlled Configuration for Microsoft Defender Antivirus on Windows

Intune will support Controlled Configuration for Microsoft Defender Antivirus settings on Windows. When you enable it, antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management will take precedence over conflicting settings from Group Policy, Configuration Manager…

Configure Quality Update approvals and policies for Quick Machine Recovery (QMR)

Windows Autopatch currently offers limited control over the deployment of quality updates. Today, the expedite mechanism focuses on deploying the latest security update and doesn't let admins select specific quality update releases or apply different deployment schedules, which can limit…

Automate tasks with local actions on Android Enterprise devices

Microsoft Intune will introduce local actions for Android Enterprise fully managed and dedicated devices. With local actions, you'll be able to automate tasks directly on a device by configuring actions that run in response to supported events. Events will include…

Agentic identity for the Policy Configuration Agent (public preview)

The Intune Policy Configuration Agent will update to use a Microsoft Entra agentic identity instead of a human user identity. This enables the agent to run policy configuration actions securely and independently. For existing agents, admins will be able to…

Edge security update: Stable 157.0.4341.42

Microsoft released the latest Microsoft Edge for Stable (Version 157.0.4341.42) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . Note: CVE's will be added as soon as available.

DocsSecurity Update Guide

Edge security update: Android and iOS 156.0.4314.56

Microsoft released the latest Microsoft Edge for Android and iOS (Version 156.0.4314.56) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

macOS release: Build 101.26092.0012

macOS release: Build 101.26092.0012. Release version 20.126092.12.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Linux · November 2026 · 101.26101.0000

Release details Release version Engine version Signature version 30.126101.0000.0 1.1.26090.3000 1.459.148.0 Enhancements and features Feature area Update summary Security Upgraded OpenSSL version to 3.6.4 Bug fix Fixed missing CentOS minor patch version in the Defender portal General Optimized memory usage…

Arc proxy support for Defender for SQL Servers on Machines

November 4, 2026 Defender for SQL Servers on Machines now supports Azure Arc SQL Server instances with Arc proxy enabled, starting with Defender for SQL extension version 2.0.3585.403 . Organizations that don't allow direct internet access from their machines can…

DocsEnable Microsoft Defender for SQL Servers on MachinesNew·Disable Defender for SQL Servers on MachinesNew·Update the Defender for SQL extension manuallyNew

Enable Microsoft Defender for SQL Servers on Machines Learn how to protect your Microsoft SQL Servers on Azure VMs, on-premises, and in hybrid and multicloud environments with Microsoft Defender for Cloud.

Edge security update: Stable 156.0.4314.58

Microsoft released the latest Microsoft Edge for Stable (Version 156.0.4314.58) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 156.0.4314.56

Microsoft released the latest Microsoft Edge for Stable (Version 156.0.4314.56) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Updated Windows support for Administrator protection settings

Microsoft Intune now supports two Administrator protection settings in the settings catalog on Windows 11 versions 24H2 and 25H2. Admins can configure the Administrator Approval Mode type and choose the elevation prompt behavior used with Administrator protection. For…

DocsCreate a policy using settings catalog in Microsoft IntuneNew

Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…

Setup Assistant legacy deprecation for Apple enrollment profiles

Intune has ended support for Setup Assistant (legacy) authentication for iOS/iPadOS and macOS automated device enrollment (ADE) with user affinity to align with modern authentication standards. Existing profiles are automatically updated to Setup Assistant with modern authentication, and…

STIG audit baselines for Windows devices in commercial tenants

Microsoft Intune commercial tenants can now audit Windows devices against Security Technical Implementation Guide (STIG) recommendations. Review per-setting and per-device audit results to identify configuration gaps and prioritize remediation. The baseline evaluates supported automated checks without changing device…

DocsUse Security Technical Implementation Guide audit baselines to assess …New

Use Security Technical Implementation Guide audit baselines to assess Windows device compliance in Microsoft Intune Learn how to use the Security Technical Implementation Guide security baseline in Microsoft Intune to assess Windows device compliance against Security Technical Implementation Guide recommendations for Department of Defense organizations.

Push notification support update for Windows devices

We've improved connectivity for scenarios that rely on push notifications including Device actions , Win32 apps , PowerShell scripts and Remediations . For the best experience, we recommend updating firewall rules to include this new endpoint: *.trouter.communications.svc.cloud.microsoft For…

DocsDevice Actions - Wipe, Lock, Locate, and MoreNew·Add PowerShell Scripts to Windows Devices in Microsoft IntuneUpdated·Network endpoints for Microsoft IntuneUpdated·Add and Assign Win32 Apps to Microsoft Intune

Device Actions - Wipe, Lock, Locate, and More Discover how to use Microsoft Intune to remotely manage, wipe, lock, restart, and secure Android, iOS/iPadOS, tvOS, visionOS, macOS, Windows, and ChromeOS devices. Learn about available device actions, prerequisites, and bulk actions for IT admins.

Manage referenced apps on AOSP devices

Microsoft Intune now supports AOSP referenced app type that lets you identify an app by package name instead of uploading an APK on AOSP devices. You can assign Required or Uninstall intent to OEM, preloaded, or externally deployed…

Legacy Apple MDM software update workloads removed from Intune

Microsoft Intune is removing legacy Apple MDM software update workloads after Apple retired the underlying commands and payloads in OS 27. Admins should use Apple declarative device management update policies to continue managing software updates. This keeps Intune…

DocsPost Support tip: Move to declarative device management for Apple software …

Support tip: Move to declarative device management for Apple software updates By: Benjamin Flamm – Product Manager | Microsoft Intune Apple recently announced at the Worldwide Developer Conference (WWDC) in June 2025 that mobile...

Faster delivery of Windows scripts

Microsoft Intune now uses push notifications for admin-initiated and service-side changes to Windows scripts. Managed devices can check in sooner after script changes, reducing delivery and refresh delays compared with waiting for the normal polling interval. This update improves…

Enforce Routes capability in Apple VPN profiles

Microsoft Intune now supports Apple's Enforce Routes capability in iOS/iPadOS and macOS VPN profiles. Admins define routing behavior with Include all networks and Exclude local networks , and Intune automatically derives the appropriate Enforce Routes configuration. This helps…

DocsConfigure VPN settings for Apple devices in Microsoft IntuneUpdated

Configure VPN settings for Apple devices in Microsoft Intune Add or create a VPN configuration profile on iOS/iPadOS and macOS devices using virtual private network (VPN) configuration settings in Microsoft Intune. Configure the connection details, authentication methods, split tunneling, custom VPN settings with the identifier, key and value pairs…

Certificate connector health monitoring in the Microsoft Intune admin center

The Certificate Connector for Microsoft Intune now surfaces health and status signals in the Microsoft Intune admin center, so you can spot certificate-issuance problems early. Clear indicators call out common failure conditions — such as the connector…

DocsOverview of Certificate Connector for Microsoft IntuneUpdated

Overview of Certificate Connector for Microsoft Intune Learn about the unified Certificate Connector for Microsoft Intune, which supports SCEP, PKCS, imported PKCS, and certificate revocation.

Bulk manage eSIMs on corporate-owned Android Enterprise devices

Microsoft Intune now supports bulk eSIM actions for corporate-owned Android Enterprise devices. From Devices > All devices > Bulk device actions , you can activate eSIMs on up to 100 selected devices running Android 15 or later by…

DocsManage eSIM plans in Microsoft IntuneNew·Wipe devices with Microsoft IntuneNew

Manage eSIM plans in Microsoft Intune Activate and remove eSIM cellular plans on supported Apple and Android Enterprise devices with Microsoft Intune device actions.

Apple OS 27 DDM status data added to device inventory

Microsoft Intune now adds Apple OS 27 declarative device management status data to device inventory. Admins can review new inventory for: device health for hardware components, enhanced logging sessions, content cache status, and Apple MDM and security states…

Agent runtime protection settings are generally available

Microsoft Intune's endpoint security template for Microsoft Defender for Endpoint agent runtime protection settings is now generally available. Administrators can use the template to manage supported runtime protection settings for Windows devices without the preview designation, aligning Intune…

Administrator protection settings in Account protection policies

Microsoft Intune now includes two Administrator protection settings in endpoint security Account protection policies. On supported Windows 11 versions, admins can configure the Administrator Approval Mode type and choose the elevation prompt behavior for Administrator protection. For more…

DocsManage account protection settings with endpoint security policies in …

Manage account protection settings with endpoint security policies in Microsoft Intune Use Microsoft Intune endpoint security account protection policies to protect the identity and accounts of users.

Add support for the MEFERI OEMConfig app on Android Enterprise

Microsoft Intune now supports the MEFERI OEMConfig app ( com.meferi.oemconfig ) for Android Enterprise devices. Admins can use the existing Intune OEMConfig workflow to deploy settings exposed by MEFERI's OEM-provided schema, expanding supported device management options without custom…

DocsUse OEMConfig on Android Enterprise devices in Microsoft IntuneNew

Use OEMConfig on Android Enterprise devices in Microsoft Intune Use Microsoft Intune to manage and use devices running Android Enterprise with OEMConfig. See all the steps, including an overview, see the prerequisites, create the configuration profile in Intune, and see a list of supported OEMConfig apps.

Edge security update: Stable 156.0.4314.42

Microsoft released the latest Microsoft Edge for Stable (Version 156.0.4314.42) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Unlimited licenses for Apple volume purchase program (VPP) apps

You can now assign VPP apps with unlimited licenses from Apple Business and Apple School Manager, making it easier to deploy apps across your organization without managing license quantities. Applies to: iOS/iPadOS macOS

Edge security update: Android 155.0.4283.61

Microsoft released the latest Microsoft Edge for Android (Version 155.0.4283.61) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 155.0.4283.62

Microsoft released the latest Microsoft Edge for Stable (Version 155.0.4283.62) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 155.0.4283.60

Microsoft released the latest Microsoft Edge for Stable (Version 155.0.4283.60) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

New Remote Help for Windows version available

[Advanced capabilities (formerly "Microsoft Intune Suite")] Remote Help for Windows version 5.2.1210.0 is now available. This release includes stability and observability improvements. Applies to: Windows

Edge security update: Android 155.0.4283.48

Microsoft released the latest Microsoft Edge for Android (Version 155.0.4283.48) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 155.0.4283.45

Microsoft released the latest Microsoft Edge for Stable (Version 155.0.4283.45) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Intune security baseline for Windows 11, version 26H2

The Windows security baseline for Windows 11, version 26H2 is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations and is the latest available Windows security baseline in Intune. The Windows 11, version 26H2 security…

DocsPost Windows 11, version 26H2 security baselineUpdated·Default configuration of Intune's Windows security baselinesNew·Configure security baseline policies in Microsoft Intune

Windows 11, version 26H2 security baseline Update: The Windows 11, version 26H2 security baseline has been updated to reflect the general availability of Administrator protection. An updated v2...

Edge security update: Stable 154.0.4258.62

Microsoft released the latest Microsoft Edge for Stable (Version 154.0.4258.62) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Detect use of vulnerable SAP BTP custom apps (Preview)

The SAP BTP solution adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect use of custom apps with open high or critical vulnerabilities. The rule identifies interactive XSUAA logins that match a…

DocsMicrosoft Sentinel Solution for SAP BTP - security content referenceNew

Microsoft Sentinel Solution for SAP BTP - security content reference Learn about the built-in security content provided by the Microsoft Sentinel Solution for SAP BTP.

Posture policies and recommendation exemptions available for Azure environments

October 28, 2026 Posture policies and recommendation exemptions are now available in public preview as part of Microsoft Security Exposure Management for Azure environments. With these new capabilities, you can: Gain visibility into your security posture through evaluations of Azure…

DocsManage posture policiesNew·Manage exemptionsNew

Manage posture policies Learn how to manage posture policies in the Microsoft Defender portal, including policy types, permissions, policy effects, transition guidance, and limitations.

Codename MDASH - MAI Cyber configuration now uses MAI-Cyber-1.1-Flash

The MAI Cyber (Preview) scan configuration now uses MAI-Cyber-1.1-Flash instead of MAI-Cyber-1-Flash. If your Foundry already uses MAI-Cyber-1-Flash, it’s automatically upgraded in Foundry to MAI-Cyber-1.1-Flash. MAI Cyber (Preview) is now the recommended scan configuration for MDASH.

Data Loss Prevention

General availability : Endpoint data loss prevention (DLP) can now monitor sensitive data transferred over FTP and SFTP and apply restrictive actions based on your organization’s requirements. To get started, configure FTP and SFTP transfer activities in your Endpoint DLP…

DocsProtect FTP/SFTP Transfers in Microsoft PurviewNew

Protect FTP/SFTP Transfers in Microsoft Purview Endpoint data loss prevention (DLP) in Microsoft Purview can monitor and protect sensitive data that users transfer over FTP and SFTP from managed Windows devices.

IDV partner gallery update

IDV partner gallery update : Added HYPR as a new partner in the Verified ID API-based integration partners section.

DocsMicrosoft Entra Verified ID - IDV partner galleryNew

Microsoft Entra Verified ID - IDV partner gallery Explore Microsoft Entra Verified ID identity verification partners and integrations for remote onboarding, secure access, and account recovery.

Edge security update: Stable 154.0.4258.53

Microsoft released the latest Microsoft Edge for Stable (Version 154.0.4258.53) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

New ApproverUpn field in the EmailPostDeliveryEvents table

New ApproverUpn field in the EmailPostDeliveryEvents table : The EmailPostDeliveryEvents table in Microsoft Defender XDR Advanced Hunting now includes the ApproverUpn field. This field identifies the user or administrator who approved a remediation action, helping security teams investigate and audit…

DocsEmailPostDeliveryEvents table in the advanced hunting schema

EmailPostDeliveryEvents table in the advanced hunting schema Learn about post-delivery actions taken on Microsoft 365 emails in the EmailPostDeliveryEvents table of the advanced hunting schema

Hunt across activities in Microsoft Teams calls and meetings

Hunt across activities in Microsoft Teams calls and meetings : The CallActivityEvents table in Microsoft Defender XDR advanced hunting contains details about activities performed during Microsoft Teams calls and meetings in your organization, helping security teams investigate suspicious call activity.

DocsCallActivityEvents table in the advanced hunting schemaNew

CallActivityEvents table in the advanced hunting schema Learn about the CallActivityEvents table in the advanced hunting schema, which contains details about activities performed during Microsoft Teams calls.

Expanding user reporting in Teams to include meetings

Expanding user reporting in Teams to include meetings : Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that…

DocsUser reported settings in TeamsNew

User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

New Defender for Identity security alerts

The October announcement includes the following new alerts: New alerts related to Entra ID : Malicious registration of a device with strong MFA Malicious registration of an attacker controlled MFA device Newly created user performed organization branding change Suspicious registration…

DocsMicrosoft Defender for Identity XDR security alertsUpdated

Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.

Known limitation: Sensor v3.x activation without Defender for Endpoint isn't supported in government clouds

Activating the Defender for Identity v3.x sensor on servers without Microsoft Defender for Endpoint deployment is temporarily not supported in government cloud environments.

General availability of sensor v3.x activation without Defender for Endpoint

Defender for Identity sensor v3.x activation without Defender for Endpoint is now generally available. Supported servers include eligible domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. This activation method supports only…

DocsActivate the Microsoft Defender for Identity sensor v3.xNew

Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.

Automatic sensor v3.x activation and Windows auditing for existing customers

This rollout applies only to organizations that are licensed for Defender for Identity and have an active workspace. Eligible organizations included in the rollout see a banner on the Sensor management tab of the On-premises settings page for 30 days…

DocsActivate the Microsoft Defender for Identity sensor v3.xNew·Configure Windows event auditingNew

Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.

macOS release: Build 101.26092.0009

macOS release: Build 101.26092.0009. Release version 20.126092.9.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.26082.0012

macOS release: Build 101.26082.0012. Release version 20.126082.12.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Windows Antivirus · October 2026 · Platform 4.18.26100.4 · Engine 1.1.26100.4

Release details Component Version Date Platform 4.18.26100.4 October 27, 2026 Engine 1.1.26100.4 October 27, 2026 Security intelligence 1 1.463.1.0 October 27, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…

DocsSecurity intelligence updates for Microsoft Defender Antivirus and …

Vulnerability assessment for Microsoft Store applications

Vulnerability assessment for Microsoft Store applications. Vulnerability assessment for applications installed via the Microsoft Store is now generally available. Defender Vulnerability Management detects supported Microsoft Store applications, adds them to the software inventory, and assesses them for vulnerabilities. Coverage is…

DocsSoftware inventoryNew

Software inventory The software inventory page for Microsoft Defender Vulnerability Management shows how many weaknesses and vulnerabilities were detected in software.

Local AI agent discovery on Windows and macOS

Local AI agent discovery on Windows and macOS. Discover supported local AI agents and their configured MCP servers on onboarded Windows and macOS devices, and investigate them in the AI agent inventory and advanced hunting. Windows requires Microsoft Defender Antivirus…

DocsLocal AI agent discovery with Microsoft Defender for EndpointNew·Discover local AI agents with Microsoft Defender for EndpointNew·Microsoft Defender for Endpoint AI agent support matrixNew

Local AI agent discovery with Microsoft Defender for Endpoint Learn how Microsoft Defender discovers local AI agents and MCP servers configured on your devices through inventory and investigation capabilities.

Linux · October 2026 · 101.26091.0004

Release details Release version Engine version Signature version 30.126091.0004.0 1.1.26070.5001 1.457.364.0 Enhancements and features Feature area Update summary Platform Support Added support for Azure Linux 4. Visibility Added TCP socket bind telemetry, improving visibility into processes binding to local network…

Linux · October 2026 · 101.26091.0003

Release details Release version Engine version Signature version 30.126091.0003.0 1.1.26090.3000 1.461.35.0 Enhancements and features Feature area Update summary Security Upgraded libcurl to version 8.22.0 to address CVE-2026-9546. Security Hardened quarantine operations by enforcing authorization checks and protecting against file-path manipulation…

Antivirus audit mode for Linux

Antivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…

DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated

Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.

Automatic enablement of SaaS accounts integration with Identity inventory

Starting October 15, 2026 , the SaaS accounts integration between Microsoft Defender for Cloud Apps and Identity inventory will transition from opt-in to automatic enablement. The integration will be enabled automatically for eligible tenants that don't use the User group…

DocsIdentity inventory integration

Posture policies and recommendation exemptions available in Microsoft Defender

October 28, 2026 Posture policies and recommendation exemptions are now available in public preview in the Microsoft Defender portal for Azure environments. With these new capabilities, you can: Gain visibility into your security posture through evaluations of Azure resources against…

DocsExempt resources from recommendationsNew·Security policies in Microsoft Defender for CloudNew

Exempt resources from recommendations Create exemption rules to remove resources or recommendations from secure score impact in Microsoft Defender for Cloud.

On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares (GA)

October 5, 2026 On-demand malware scanning in Microsoft Defender for Storage now supports targeted scanning of specific items. Instead of scanning an entire storage account, you can scope scans to a single blob or file, a specific container or file…

DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated

Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.

New Defender server security experience

October 6, 2026 The new Defender server security experience brings together cloud and endpoint data from Microsoft Defender for Endpoint and Defender for Servers. In the Microsoft Defender portal, you can: Review the new server asset page with combined cloud…

DocsThe new Defender server security experienceNew·Offboard devicesNew

The new Defender server security experience Review cloud and endpoint information, investigate threats, and check access for servers in Microsoft Defender.

KSPM misconfiguration recommendations moving to controller-level scope (GA)

October 5, 2026 Kubernetes security posture management (KSPM) misconfiguration recommendations are being updated to align their resource scope with Kubernetes workload controllers. Previously, recommendations appeared at the individual running container instance level. They will now appear at the container deployment…

DocsReference table for all container security recommendations in …

Reference table for all container security recommendations in Microsoft Defender for Cloud This article lists all Microsoft Defender for Cloud container security recommendations that help you harden and protect your resources.

Expanded server onboarding experience

October 20, 2026 The new Defender server security experience expands to include onboarding guidance for Azure and on-premises servers, building on the investigation and access management capabilities released on October 6. With this update, you can: Onboard supported Azure virtual…

DocsUse Direct onboarding for on-premises serversNew·Offboard devicesNew·Onboard servers to Microsoft DefenderUpdated·Connect on-premises machinesUpdated

Use Direct onboarding for on-premises servers Associate existing endpoint-protected servers with Defender for Servers and review the affected population.

Cloud security plan management in the Defender portal

October 20, 2026 Cloud security plan management is scheduled to become available in public preview in the Microsoft Defender portal for Azure commercial environments on October 20, 2026. With this experience, you can: Connect Azure subscriptions and management groups to…

DocsOverview of Defender for Cloud in Defender PortalUpdated

Overview of Defender for Cloud in Defender Portal Comprehensive overview of Microsoft Defender for Cloud in the Defender portal, including navigation hub, dashboard features, and unified security management capabilities.

Edge security update: Android 154.0.4258.38

Microsoft released the latest Microsoft Edge for Android (Version 154.0.4258.38) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Windows 11, version 26H2 Settings Catalog update

Microsoft Intune provides day-zero support for validated Windows policy settings introduced with Windows 11, version 26H2 in the Settings Catalog. Admins can use the new and updated settings to manage Windows endpoints with the latest 26H2 capabilities. For…

DocsPost Microsoft Intune Settings Catalog updated to support Windows 11, …Updated

Microsoft Intune Settings Catalog updated to support Windows 11, version 26H2 10.06.26 Update: The Windows security baseline for Windows 11, version 26H2 is now available for all customers in Microsoft Intune. This baseline reflects...

Upgrade an existing Android Enterprise connection to a managed Google domain

Microsoft Intune now supports an optional upgrade for tenants that connected Android Enterprise with a Gmail account. You can link the enterprise to a managed Google domain and manage the Google-Intune connection with your Microsoft Entra work account…

DocsConnect Intune account to managed Google Play account

Connect Intune account to managed Google Play account Learn how to connect your Intune account to your Managed Google Play account.

Updated minimum supported version for iOS and iPadOS

Microsoft Intune now requires iOS/iPadOS 18 or later for standard device-management, Company Portal, and app-protection scenarios. Administrators should identify and upgrade affected devices. Userless devices enrolled through Automated Device Enrollment have a separate support statement. Applies to: iOS/iPadOS

Skip the Device Features Tour during Apple enrollment

Microsoft Intune now includes the Device features tour Apple OS 27 Setup Assistant skip key in Automated Device Enrollment profiles. You can hide this pane to reduce setup interactions and provide a more streamlined enrollment experience on supported…

DocsSet up automated device enrollment (ADE) for iOS/iPadOSNew

Set up automated device enrollment (ADE) for iOS/iPadOS Learn how to enroll corporate-owned iOS/iPadOS devices into Microsoft Intune with Apple Automated Device Enrollment (ADE).

Require Managed Home Screen authentication for protected app activities

Microsoft Intune now helps prevent users from bypassing Managed Home Screen (MHS) authentication when they access protected activities in MAM-integrated apps. If MHS requires sign-in or a session PIN, the app redirects the user to MHS before allowing…

DocsConfigure the Microsoft Managed Home Screen AppNew

Configure the Microsoft Managed Home Screen App Learn how to configure the Microsoft Managed Home Screen app.

Remote Help support for GCCH environments

[Advanced capabilities (formerly "Microsoft Intune Suite")] Remote Help is now available in US Government Community Cloud High (GCCH) environments. This expansion extends the same secure, cloud-based remote assistance capabilities currently available in GCC to GCCH tenants. IT support staff can…

DocsPlan for Remote Help with Microsoft IntuneUpdated

Plan for Remote Help with Microsoft Intune Learn about the requirements and capabilities of Remote Help with Microsoft Intune on Windows, macOS, and Android Enterprise.

Onboard MDM compliance partners with new self-service functionality

Microsoft Intune now supports bring-your-own connector functionality for MDM compliance partners. Partners can build, test, and onboard compliance connectors using Intune documentation, contracts, and validation hooks. As an admin, you can opt in to a partner connector by…

DocsThird-party device compliance partners support in Microsoft IntuneUpdated

Third-party device compliance partners support in Microsoft Intune Use a third-party device compliance partner as a source of compliance data for devices you manage with Intune.

Newly available protected app for Intune

Microsoft Dragon Copilot by Microsoft Corporation is now available as a protected app for Microsoft Intune. You can apply Intune app protection policies to the app on supported Android and iOS/iPadOS devices, helping protect organizational data while clinicians…

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

New single device page becomes the default experience in the Intune admin center

Microsoft Intune now uses the new single device page as the default experience for all admins, and the previous device page is no longer available. In Devices > All devices , select a device to view details and…

DocsView device detailsUpdated

View device details Learn how to access device details in the Microsoft Intune admin center, including hardware information, installed apps, and device properties.

New Apple settings in the Settings Catalog for iOS/iPadOS and macOS

Microsoft Intune now includes new Apple Settings Catalog options for supported iOS/iPadOS and macOS devices. You can configure additional controls for areas such as app settings, Apple Intelligence, network and web-content filtering, and the macOS login window by…

DocsCreate a policy using settings catalog in Microsoft IntuneNew

Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…

Microsoft Cloud PKI support for US Government GCC High

[Advanced capabilities (formerly "Microsoft Intune Suite")] Microsoft Cloud PKI is now available for Microsoft Intune tenants in the Microsoft Government Community Cloud High (GCC High) environment. You can create and manage a cloud-based public key infrastructure that automates certificate issuance…

DocsMicrosoft Cloud PKI for Microsoft IntuneUpdated

Microsoft Cloud PKI for Microsoft Intune An overview of the Microsoft Cloud PKI service, available with Microsoft Intune Suite or as a standalone capability.

Faster delivery of Win32 apps

Microsoft Intune now uses push notifications for admin-initiated and service-side changes to Win32 apps. Managed devices can check in sooner after app changes, reducing delivery and refresh delays compared with waiting for normal polling intervals. This update improves…

Faster Win32 app delivery after Windows enrollment

Microsoft Intune Management Extension now checks for Windows app assignments immediately after the Enrollment Status Page (ESP) completes. This reduces the delay before required Win32 apps that weren't installed during ESP begin installing on newly enrolled devices. For…

DocsUnderstand Microsoft Intune Management ExtensionNew

Understand Microsoft Intune Management Extension Understand Microsoft Intune management extension for Windows.

Configure MDE AI agent runtime protection for Windows

Microsoft Intune now includes Microsoft Defender for Endpoint AI agent runtime protection settings in the new endpoint security template for Windows. You can use Audit mode to detect and alert on unsafe AI agent activity without blocking it…

DocsAI Agent Runtime Protection with Microsoft Defender for Endpoint …New

AI Agent Runtime Protection with Microsoft Defender for Endpoint (Preview) Learn how Microsoft Defender for Endpoint provides runtime protection for local AI agents by detecting and blocking prompt injection attacks.

Automatically launch Microsoft Defender for Endpoint during Android Enterprise device setup

Microsoft Intune now supports automatically opening Microsoft Defender for Endpoint during out-of-box setup for supported corporate-owned Android Enterprise devices. After you configure the Defender for Endpoint connector, turn on Grant MTD role permissions , and assign the Defender…

Assignment filters for Android Settings Catalog policies

Microsoft Intune now supports assignment filters for Android Enterprise and Android Open Source Project (AOSP) Settings Catalog policies. You can include or exclude specific devices based on device properties, giving you more granular control over policy deployments and…

DocsCreate assignment filters in Microsoft Intune

Create assignment filters in Microsoft Intune Create assignment filters in Microsoft Intune to target policies based on device properties like OS version or manufacturer. Learn to create, update, and delete filters for managed devices and apps.

Edge security update: Stable 154.0.4258.37

Microsoft released the latest Microsoft Edge for Stable (Version 154.0.4258.37) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Stage app and policy rollout with deployment plans

Microsoft Intune now supports deployment plans, a new way to roll out apps and configuration policies in stages instead of all at once. From the new Deployments experience in the Intune admin center, you can stage a rollout…

DocsDeployment plans and deployments overview in Microsoft IntuneUpdated

Deployment plans and deployments overview in Microsoft Intune Learn how deployment plans and deployments provide gradual, controlled, ring-based rollouts of apps and policies in Microsoft Intune.

Edge security update: Android 153.0.4234.49

Microsoft released the latest Microsoft Edge for Android (Version 153.0.4234.49) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 153.0.4234.48

Microsoft released the latest Microsoft Edge for Stable (Version 153.0.4234.48) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 153.0.4234.46

Microsoft released the latest Microsoft Edge for Stable (Version 153.0.4234.46) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Faster compliance updates for Windows devices

Microsoft Intune now supports client-driven compliance evaluation for Windows devices. Supported devices can detect changes to compliance signals, including firewall, antivirus, BitLocker, Microsoft Defender status, operating system build, real-time protection, and Secure Boot, and proactively request reevaluation rather…

DocsCreate device compliance policies in Microsoft IntuneUpdated

Create device compliance policies in Microsoft Intune Create device compliance policies for Microsoft Intune.

Edge security update: Android and iOS 153.0.4234.32

Microsoft released the latest Microsoft Edge for Android and iOS (Version 153.0.4234.32) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 153.0.4234.32

Microsoft released the latest Microsoft Edge for Stable (Version 153.0.4234.32) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Android 152.0.4191.65

Microsoft released the latest Microsoft Edge for Android (Version 152.0.4191.65) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

New Remote Help for Windows version available

[Advanced capabilities (formerly "Microsoft Intune Suite")] Remote Help for Windows version 5.2.1040.0 is now available. This release updates subscription metadata for E3, E5, and E7 licenses. Remote Help features are unchanged from version 5.2.1037.0. Applies to: Windows

Edge security update: Stable 152.0.4191.66 (2 CVEs)

Microsoft released the latest Microsoft Edge for Stable (Version 152.0.4191.66) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-87491 has an exploit in the wild, and this update contains a fix for it…

DocsCVE-2026-87491·Security Update Guide·CVE-2026-85892

Edge security update: Microsoft released the latest Microsoft Edge Stable Channel (Version 152.0.4191.62) which incorporates the latest Securi (1 CVE)

Microsoft released the latest Microsoft Edge Stable Channel (Version 152.0.4191.62) which incorporates the latest Security Updates of the Chromium project. The Chromium team reported that CVE-2026-85046 has an exploit in the wild, and this update contains a fix for it…

DocsCVE-2026-85046·Security Update Guide

Use Sentinel MCP triage collection to query data

Use the triage collection in the Microsoft Sentinel MCP server to discover and query data using MCP tools. Use the list advanced hunting tables tool to return a list of all available tables in the built-in data lake. Use the…

DocsTriage Tool Collection in Microsoft Sentinel MCP Server

Triage Tool Collection in Microsoft Sentinel MCP Server Explore the Microsoft Sentinel MCP triage tools for incident triage and hunting, including tools to fetch incidents, alerts, entities, and run hunting queries.

Use Microsoft Fabric for data federation

When cost, governance, or compliance requirements prevent data movement, customers can query the data where it resides using data federation. Using Data federation, you can enrich investigations with context from data stored outside the data lake. You can use Microsoft…

DocsUnify Data Sources With OneLake ShortcutsUpdated·Mirroring

Unify Data Sources With OneLake Shortcuts OneLake shortcuts provide a way to connect to existing data without having to directly copy it. Learn how to use them.

Use Microsoft Fabric for custom security analytics

Microsoft Fabric enables custom analytics across data lake tables and external data tables. You can use KQL , notebooks , scheduled jobs , and custom graphs within Microsoft Fabric to analyze and enrich data at scale and then store results…

DocsData Collection Rules in Azure MonitorNew·How graph in Microsoft Fabric worksUpdated·Query data in a KQL queryset·How to use notebooks

Data Collection Rules in Azure Monitor Learn when to work directly with data collection rules (DCRs) and how they provide centralized, reusable control for Azure Monitor data collection.

Run interactive KQL queries in advanced hunting

Interactive Kusto Query Language (KQL) queries on the data lake are now available using Advanced Hunting under Investigation & Response in the Defender portal. Use the Advanced Hunting page to investigate data from both Microsoft Sentinel and Microsoft Defender XDR…

DocsAdvanced hunting with Microsoft Sentinel data in Microsoft DefenderUpdated

Advanced hunting with Microsoft Sentinel data in Microsoft Defender Learn how to use advanced hunting in the portal unifying Defender XDR and Sentinel data

Mirror the data lake tier to Microsoft Fabric OneLake

Using the Azure Monitor mirroring feature, you can select the Microsoft Sentinel workspace tables you want to expose in Microsoft Fabric. The mirroring feature doesn't create a copy of the data and incurs no additional charge. The data remains in…

DocsTutorial: Configure the Mirror Azure Monitor Solution in Fabric …Updated

Tutorial: Configure the Mirror Azure Monitor Solution in Fabric (Preview) Learn how to create a mirrored Azure Monitor item in Microsoft Fabric and access Log Analytics tables through the Eventhouse endpoint or a Lakehouse shortcut.

Integrated Microsoft Sentinel SIEM and data lake onboarding

The data lake comes integrated with Microsoft Sentinel and continues as the low-cost ingestion and storage tier for long-term retention inside Sentinel. Going forward, you do not need to go through a separate data lake onboarding and billing setup. You…

DocsOnboard to Microsoft SentinelUpdated·Connect Microsoft Sentinel to the Microsoft Defender portalUpdated

Onboard to Microsoft Sentinel In this quickstart, you enable Microsoft Sentinel, and set up data connectors to monitor and protect your environment.

Enable the data lake tier using Table management

Once you've onboarded to Microsoft Sentinel in Defender portal, you can use the Table Management page to enable the data lake tier. Select a table, and then select Retention to view data-retention settings . From here, you can mirror data…

DocsManage data tiers and retention in Microsoft Sentinel

Manage data tiers and retention in Microsoft Sentinel Manage log data in Microsoft Sentinel and with Microsoft Defender XDR services in the Microsoft Defender portal to optimize security operations and cost efficiency.

Improved onboarding experience for MDASH

The MDASH onboarding experience has been improved to make setup clearer and more guided. Instead of a single panel that contains all setup steps, onboarding is now organized into clear tasks that users complete as part of the flow. This…

DocsSet up Microsoft Foundry for Codename MDASH - Agentic code scanner …Updated

Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration Connect Codename MDASH - Agentic code scanner to your Microsoft Foundry project by creating a resource, deploying the required models, and providing the project endpoint and API key.

Codename MDASH - Scan progress monitoring

Scan progress helps you understand whether a scan is waiting, processing code, validating findings, or publishing results. Check completed work, elapsed time, and output availability to understand what is happening during a long-running scan. For more information, see Monitor scan…

DocsCodename MDASH - Agentic code scanner initiativeUpdated

Codename MDASH - Agentic code scanner initiative Learn how to use the Codename MDASH - Agentic code scanner initiative page in Microsoft Defender to triage and remediate code-level weaknesses detected by agentic code scanning.

Information Barriers

New : Create an Information Barriers policy compliance report to identify SharePoint sites, OneDrive accounts, and user-owned SharePoint Embedded containers that no longer comply after Information Barriers policy changes.

DocsCreate an Information Barriers policy compliance reportNew

Create an Information Barriers policy compliance report Learn how to find noncompliant sites after Information Barriers policies change.

Data Loss Prevention

General availability : Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps…

DocsLearn about Microsoft Purview Network Data SecurityUpdated

Learn about Microsoft Purview Network Data Security Network data security extends Microsoft Purview classification to network traffic

Integrated Security Operations Center (ISOC) in Microsoft Defender

(Preview) Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal. Starting September 23, 2026, it's available to eligible Microsoft 365 E5 and E7 customers without an…

DocsIntegrated Security Operations Center (ISOC) in Microsoft DefenderNew

Integrated Security Operations Center (ISOC) in Microsoft Defender Learn how Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI together, including eligibility and workspace requirements.

Identity Security dashboard and Coverage & Maturity

(GA) Identity Security dashboard and Coverage & Maturity : The Identity Security dashboard provides a centralized view of identity-related security risks and posture across the organization. Coverage & Maturity helps security teams understand how well their identity environment is protected…

DocsView your identity coverage and maturityNew

View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.

Separating Teams user reporting settings from email settings

Separating Teams user reporting settings from email settings : Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting…

Docshttps://security.microsoft.com/securitysettings/teamsUserSubmission

Expanding user reporting in Teams to include group calls

Expanding user reporting in Teams to include group calls : Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings , reported calls are sent…

DocsUser reported settings in TeamsNew·Configure user reported message settings in Microsoft Defender for …New

User reported settings in Teams Admins can configure whether users can report malicious messages, calls, meetings, or meeting participants in Microsoft Teams.

Sensor v3.x support for additional identity server roles: AD CS, AD FS, and Entra Connect (Preview)

Defender for Identity sensor v3.x now supports eligible AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers and don't have an existing Defender for Identity sensor. For more information, see Defender for Identity sensor v3.x prerequisites…

DocsDeploy the Microsoft Defender for Identity sensor v3.xNew

Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.

Sensor v3.x onboarding without Microsoft Defender for Endpoint deployment (Preview)

You can now activate the Defender for Identity sensor v3.x on eligible domain controllers without first onboarding them to Defender for Endpoint. This preview supports only new sensor v3.x deployments on eligible domain controllers running Windows Server 2019 or later…

DocsActivate the Microsoft Defender for Identity sensor v3.xNew

Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.

Sensor v2.x installation restriction for new workspaces (Preview)

The sensor v2.x installation restriction for new workspaces is in preview. Starting in October 2026, Defender for Identity will restrict sensor v2.x installation in new workspaces. In these workspaces, sensor v3.x is the supported onboarding option for eligible servers running…

Identity Security dashboard and Coverage & Maturity

The Identity Security dashboard provides a centralized view of identity-related security risks and posture across your organization. Coverage & Maturity helps security teams understand identity protection across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage and deployment gaps…

DocsView your identity coverage and maturityNew

View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.

Combined Sensor management tab on the On-premises settings page

The Onboarding and Sensors tabs on the identity On-premises settings page are now combined into a single Sensor management tab that lists both installed sensors and servers eligible for activation. Automatic sensor v3.x activation is now configured on the Advanced…

DocsManage and update Microsoft Defender for Identity sensorsNew

Manage and update Microsoft Defender for Identity sensors Learn how to view, manage, and update Microsoft Defender for Identity sensors in the Microsoft Defender portal, including sensor health, migration state, and delayed updates.

Automatic sensor v3.x activation and Windows auditing by default

Automatic sensor v3.x activation and automatic Windows auditing apply only to organizations with an active license that includes Microsoft Defender for Identity. The rollout differs for new Microsoft Defender for Endpoint customers and existing Defender for Identity customers: New Microsoft…

DocsActivate the Microsoft Defender for Identity sensor v3.xNew·Configure Windows event auditingNew

Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.

macOS release: Build 101.26072.0017

macOS release: Build 101.26072.0017. Release version 20.126072.17.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Windows Antivirus · September 2026 · Platform 4.18.26090.9 · Engine 1.1.26090.9

Release details Component Version Date Platform 4.18.26090.9 October 12, 2026 Engine 1.1.26090.9 October 12, 2026 Security intelligence 1 1.461.1.0 October 12, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…

DocsSecurity intelligence updates for Microsoft Defender Antivirus and …

New Microsoft Secure Score recommendations for AI-Readiness

New Microsoft Secure Score recommendations for AI-Readiness. Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry…

Microsoft Defender support for Linux Desktops

Microsoft Defender support for Linux Desktops. Microsoft Defender for Endpoint now extends support to Linux desktops (Public Preview). All Linux distributions currently supported on servers are also supported on Linux desktops. Deployment methods and security capabilities remain consistent across both…

DocsPrerequisites for Microsoft Defender for Endpoint on LinuxNew

Prerequisites for Microsoft Defender for Endpoint on Linux Describes the requirements needed to install and use Microsoft Defender for Endpoint on Linux.

Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)

Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…

DocsMicrosoft Defender for Endpoint plug-in for Windows Subsystem for …New

Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) Learn how to set up and use the Defender for Endpoint plug-in for Windows Subsystem for Linux.

Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc)

Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc). Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping…

DocsMicrosoft Defender for Endpoint plug-in for Windows Subsystem for …New·registration form

Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux (WSL) Learn how to set up and use the Defender for Endpoint plug-in for Windows Subsystem for Linux.

Memory scan for Linux

Memory scan for Linux. Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks. Memory-resident threats are…

DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated

Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.

Linux · September 2026 · 101.26081.0010

Release details Release version Engine version Signature version 30.126081.0010.0 1.1.26090.3000 1.459.287.0 Enhancements and features Feature area Update summary Device identity Fixed an issue where cloned Linux virtual machines could retain the source image's machine identifier, causing multiple endpoints to appear…

Linux · September 2026 · 101.26072.0005

Release details Release version Engine version Signature version 30.126072.0005.0 1.1.26070.5001 1.459.239.0 Enhancements and features Feature area Update summary Security Memory scanning (preview) adds process memory scanning to detect known malicious behaviors and memory-resident threats, which strengthens protection against in-memory attacks…

DocsNew features in Microsoft Defender for EndpointNew

New features in Microsoft Defender for Endpoint This article describes new features available in Microsoft Defender for Endpoint, including both Windows and cross-platform updates.

Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation

September 23, 2026 As part of the transition to individual recommendations, the Machines should have a vulnerability assessment solution recommendation will be deprecated on December 14, 2026. Customers should use individual recommendations in Microsoft Defender for Cloud to review and…

DocsTransition from grouped to individual recommendations in Defender for …Updated

Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.

Upcoming billing updates for Defender for Servers

September 30, 2026 Effective November 1, 2026, Microsoft Defender for Servers introduces two related updates: Billing policy update: Productivity and desktop client devices, such as Windows 10 and Windows 11 PCs, are no longer billed as servers. For more information…

General availability of Defender for Cosmos DB in Azure Government cloud

September 3, 2026 With this general availability announcement, the Defender for Cosmos DB plan in Azure Government cloud now aligns with the commercial cloud offering in feature coverage and runtime protection capabilities. For more information about Microsoft Defender for Cosmos…

DocsOverview of Defender for Azure Cosmos DB·Interoperability with Azure services, Azure clouds, and client …

Overview of Defender for Azure Cosmos DB Learn about the benefits, features, and security capabilities of Microsoft Defender for Azure Cosmos DB to help protect your databases.

Enhanced agent for Defender for SQL Servers on Machines is fully available in Azure Government cloud

September 29, 2026 In Azure Government cloud, the Defender for SQL Servers on Machines plan in Microsoft Defender for Cloud protects SQL Server instances running on Azure virtual machines and on Azure Arc-enabled machines connected to that cloud. The enhanced…

DocsUpdate Defender for SQL Servers on Machines Configuration for …Updated·Verify Defender for SQL Servers on Machines Protection in Government …Updated·Troubleshoot Defender for SQL on Machines ConfigurationUpdated·Defender for Cloud pricing page

Update Defender for SQL Servers on Machines Configuration for Automatic Registration Learn how to update the Defender for SQL Servers on Machines configuration to enable automatic registration for Azure VMs, on-premises, and hybrid environments.

AWS GuardDuty coverage status is now shown on the S3 asset page

September 3, 2026 Microsoft Defender for Cloud now shows Amazon GuardDuty coverage status for AWS S3 buckets, in the Cloud security details section of the S3 asset page. Two statuses are shown for each bucket, each as Enabled or Disabled…

Edge security update: Android and iOS 152.0.4191.53

Microsoft released the latest Microsoft Edge for Android and iOS (Version 152.0.4191.53) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 152.0.4191.53 (7 CVEs)

Microsoft released the latest Microsoft Edge for Stable (Version 152.0.4191.53) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security fixes: CVE-2026-58616…

DocsSecurity Update Guide·CVE-2026-58616·CVE-2026-62904·CVE-2026-66324

Windows 365 for Agents security baseline

Microsoft Intune now includes a security baseline for Windows 365 for Agents Cloud PCs. Administrators can deploy and customize recommended, device-scoped settings for Windows 11, Microsoft Edge, and Microsoft Defender for Endpoint to establish a consistent security posture…

DocsWhat is Windows 365 for Agents?·Configure security baseline policies in Microsoft Intune

What is Windows 365 for Agents? Overview of Windows 365 for Agents, a platform where customers can deploy computer-using agents securely and at scale on Cloud PCs.

View expanded SIM inventory for corporate-owned Android devices

Microsoft Intune now surfaces expanded SIM inventory for corporate-owned Android Enterprise devices, including EIDs, multiple ICCIDs, and activation state. View these details under Devices > All devices > select a device > Hardware , and use the reported…

Unattended Remote Help sessions for Windows devices

[Advanced capabilities (formerly "Microsoft Intune Suite")] Microsoft Intune now supports unattended Remote Help sessions on physical Windows devices. Authorized helpdesk agents can sign in to a remote device with their own credentials without requiring the user to be present or…

DocsPlan for Remote Help with Microsoft IntuneUpdated

Plan for Remote Help with Microsoft Intune Learn about the requirements and capabilities of Remote Help with Microsoft Intune on Windows, macOS, and Android Enterprise.

Skip new Apple Setup Assistant panes during enrollment

Microsoft Intune now includes Apple OS 27 Setup Assistant skip keys for Liquid Glass and Accessibility Appearance in Automated Device Enrollment profiles. You can hide these panes to reduce setup interactions and provide a more consistent enrollment experience…

Separate device and work profile passwords on Android Enterprise devices

Microsoft Intune now supports the Block one lock for device and work profile setting in the Android Enterprise settings catalog, letting you require separate locks for the device and work profile instead of a shared one. Set it…

Remove eSIMs during a device wipe with a settings catalog policy

Microsoft Intune now supports the Remove all eSIMs during a device wipe setting in the Android Enterprise settings catalog. Set it to True to request removal of all eSIMs when a corporate-owned device is wiped while the policy…

Remove an individual eSIM from a corporate-owned Android device

Microsoft Intune now lets you remove a single eSIM from a corporate-owned Android Enterprise device without wiping it. Turn on Preview new device view , select the device, copy the eSIM's ICCID from device inventory, then select Remove…

Operating system version property in assignment filters is generally available

The operatingSystemVersion property in assignment filters is now generally available for managed devices and managed apps. Use this property to create filter rules that scope your app and policy assignments to devices running a specific OS version or…

DocsAssignment filter properties and operators referenceNew·Create assignment filters in Microsoft Intune

Assignment filter properties and operators reference Reference guide for device and app properties, operators, and rule syntax when creating assignment filters in Microsoft Intune. Includes examples and supported values.

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Notion by Notion Labs Superhuman Mail by Superhuman Labs Calven by Calven Pty Limited Heijmans by Heijmans Notability by Ginger Labs, Inc. (iOS) Ben for Intune by Thanks…

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

New updates to the Apple settings catalog

Microsoft Intune now supports new Settings Catalog options for testing on the OS 27 betas, covering Declarative Device Management areas such as App Settings , Web Content Filter , and Siri Settings for iOS/iPadOS and macOS. Configure them…

DocsCreate a policy using settings catalog in Microsoft IntuneNew

Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…

New single device page in the Intune admin center

The new single device page is turned on by default for all customers. You can use the Preview new device view toggle to turn it off and return to the original device page. In the Intune admin center…

New policy settings for Windows

Microsoft Intune now includes new Windows settings catalog options across several administrative template refreshes. Highlights include Turn on Protected Mode controls for Internet Explorer security zones, new Microsoft Edge policies from the Edge 150 template refresh, and a…

Memory scan setting for Microsoft Defender Antivirus on Linux

Microsoft Intune now supports a memory scan setting in the Microsoft Defender Antivirus template for Linux endpoint security antivirus policies. You can manage memory scan behavior on Linux devices managed through Microsoft Defender for Endpoint security settings management…

Limit how long an Android work profile can stay off

Microsoft Intune now supports the Number of days work profile is allowed to be switched off setting in the Android Enterprise settings catalog, so you can limit how long a work profile stays turned off. Enter the maximum…

Keep Android device screens on while charging

Microsoft Intune now includes a settings catalog option for keeping fully managed and dedicated Android device screens on while charging. Select one or more modes - AC , USB , or Wireless - to control when the screen…

Device inventory for personally owned devices on Android Enterprise

Microsoft Intune now supports device inventory for personally owned Android Enterprise devices with a work profile managed by Android Management API. View these devices from the device's Inventory page alongside corporate-owned devices in Resource Explorer, and query them…

Declarative Device Management for Apple volume purchase program apps

Microsoft Intune now supports Apple Declarative Device Management (DDM) for required volume purchase program (VPP) apps on devices running iOS/iPadOS 17.2 and later and macOS 26 and later. By changing the management type to DDM when you upload…

Configure screen timeout for corporate Android devices

Microsoft Intune now supports a Screen timeout setting in the Android Enterprise settings catalog, letting you specify how many seconds pass before the screen turns off. Configure it under Devices > Manage devices > Configuration > Create >…

Collect enhanced diagnostic logs from supervised Apple devices

Microsoft Intune now supports Apple's Enhanced Logging device action on supported supervised devices running a compatible OS release. Administrators can start an AppleCare diagnostic-log collection session using an AppleCare-provided token and monitor device-reported status through Declarative Device Management…

Choose whether to remove eSIMs when wiping one corporate-owned Android device

Microsoft Intune now lets you choose whether to preserve or remove eSIMs when wiping one corporate-owned Android Enterprise device. Turn on Preview new device view , select the device, then select Wipe . By default, the wipe preserves…

Audit mode for the Microsoft Defender Antivirus template for Linux

The Microsoft Defender Antivirus template for Linux, which is part of Intune's Endpoint Security Antivirus policy, now includes a new Audit value for the Enforcement level setting. When you set Enforcement level to Audit , the antivirus engine…

DocsLearn about using Intune to manage Microsoft Defender settings on …Updated·Manage antivirus settings with endpoint security policies in Microsoft …

Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune Learn how to use Intune policy to manage Microsoft Defender security settings on devices that aren't enrolled with Microsoft Intune.

Activate an eSIM on a corporate-owned Android device

Microsoft Intune now supports single-device eSIM activation for corporate-owned Android Enterprise devices running Android 15 and later. Turn on Preview new device view , select the device, then select Activate eSIM and enter the carrier activation code. Intune…

Edge security update: Android 151.0.4129.101

Microsoft released the latest Microsoft Edge for Android (Version 151.0.4129.101) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 151.0.4129.101

Microsoft released the latest Microsoft Edge for Stable (Version 151.0.4129.101) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Android and iOS 151.0.4129.86 (1 CVE)

Microsoft released the latest Microsoft Edge for Android and iOS (Version 151.0.4129.86) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide . This update contains the following Microsoft Edge specific security…

DocsSecurity Update Guide·CVE-2026-72970

Edge security update: Stable Channel 151.0.4129.86 (1 CVE)

Microsoft released the latest Microsoft Edge for Stable Channel (Version 151.0.4129.86) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide This update contains the following Microsoft Edge specific security fixes: CVE-2026-72970

DocsSecurity Update Guide·CVE-2026-72970

Edge security update: Stable 151.0.4129.78

Microsoft released the latest Microsoft Edge for Stable (Version 151.0.4129.78) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Android and iOS 151.0.4129.59

Microsoft released the latest Microsoft Edge for Android and iOS (Version 151.0.4129.59) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

UEBA anomalies on behaviors (Preview)

Microsoft Sentinel now adds contextual anomaly insights directly to UEBA behavior records. These insights help analysts identify first-seen activity, unusually high behavior volumes, uncommon values, and threat intelligence matches without manually correlating raw events. For more information, see Investigate anomalies…

DocsInvestigate anomalies on UEBA behaviors in Microsoft Sentinel

Investigate anomalies on UEBA behaviors in Microsoft Sentinel Learn how Microsoft Sentinel enriches UEBA behaviors with anomaly insights and how to query these insights in the Microsoft Defender portal.

SAP solution releases

The SAP agentless solution version 1.1.12 adds audit log performance enhancements and the force-sal-filesystem parameter. The SAP BTP solution version 3.1.1 adds an analytic rule for unaudited custom apps with login-only activity and renames analytic rules with the SAP BTP…

DocsSAP agentless solution·SAP BTP solution·SAP LogServ solution

New data sources for UEBA behaviors and anomaly detection (Preview)

Microsoft Sentinel UEBA expands coverage with new data sources for both the behaviors layer and anomaly detection. Fortinet FortiGate behaviors The UEBA behaviors layer now supports Fortinet FortiGate firewall events from the CommonSecurityLog table. More than 40 new behaviors identify…

Keyless authentication for the Microsoft Foundry connection preview

You can now connect your Microsoft Foundry resource to codename MDASH using Keyless authentication , the recommended method. Keyless relies on a managed identity instead of a stored secret - no API key is kept in Defender, and there's no…

DocsSet up Microsoft Foundry for Codename MDASH - Agentic code scanner …Updated

Set up Microsoft Foundry for Codename MDASH - Agentic code scanner integration Connect Codename MDASH - Agentic code scanner to your Microsoft Foundry project by creating a resource, deploying the required models, and providing the project endpoint and API key.

Codename MDASH - Cancel scan

Scan cancellation, previously available only in Defender CLI, is now also available in the Microsoft Defender portal. You can cancel queued or running scans from the scan details page in the Scans tab. For more information, see Cancel scan .

DocsCodename MDASH - Agentic code scanner initiativeUpdated

Codename MDASH - Agentic code scanner initiative Learn how to use the Codename MDASH - Agentic code scanner initiative page in Microsoft Defender to triage and remediate code-level weaknesses detected by agentic code scanning.

Codename MDASH - Azure DevOps connector preview

The Azure DevOps connector is now available in preview for Codename MDASH - Agentic code scanner. Security teams can connect Azure DevOps organizations from the Microsoft Defender portal, onboard repositories, and trigger remote on-demand agentic code scans for the onboarded…

DocsCreate an Azure DevOps connector for agentic code securityUpdated

Create an Azure DevOps connector for agentic code security Connect your Azure DevOps organization to Microsoft Defender to enable remote on-demand agentic code scans across your repositories.

eDiscovery

Updated : App-only authentication for eDiscovery cmdlets in Security & Compliance PowerShell is unsupported. Transition automations to Microsoft Graph APIs where available; the documented certificate-based authentication steps are best-effort guidance for existing automations and don't change the support status.

DocsAssign permissions in eDiscoveryNew

Assign permissions in eDiscovery Assign the permissions required to perform eDiscovery-related tasks in eDiscovery.

Shared capabilities

New : Run on-demand classification scans on Windows endpoints to discover sensitive information without waiting for files to be opened or modified. The new guidance covers billing and best practices , monitoring and troubleshooting , and frequently asked questions …

DocsAudit log activitiesNew·Get started with on-demand classification for endpoints·Best practices for on-demand classification on endpoints and billing·Monitor and troubleshoot endpoint scans

Audit log activities Discover how to monitor and investigate activities in Microsoft 365 with the unified audit log. Search for specific events and export results.

Sensitivity labels

New : Before enforcing an auto-labeling policy, run it in simulation mode to identify which items it would label without making any changes. Review the match results and source distribution to determine whether the policy is ready to enforce. New…

DocsReview simulation results for auto-labeling policies in Microsoft …New·Use the Insights tab to analyze auto-labeling policies in Microsoft …New·Enable sensitivity labels for files in SharePoint and OneDriveNew·Automatically apply a sensitivity label to Microsoft 365 dataNew

Review simulation results for auto-labeling policies in Microsoft Purview Learn how to review Microsoft Purview auto-labeling simulation results and decide whether a policy is ready for enforcement.

Data lifecycle management

Updated : When you remove the last hold from an inactive mailbox, Microsoft 365 automatically applies a 30-day delay hold. Learn how to identify and remove delay holds before recalculating mailbox hold status. New : Remove a retention hold from…

DocsDelete an inactive mailbox·Remove a retention hold from an unlicensed OneDrive site·Permanently delete files with Microsoft Purview Priority Cleanup

Delete an inactive mailbox When you no longer need to preserve the contents of a Microsoft 365 inactive mailbox, you can permanently delete the inactive mailbox.

Data Security Posture Management

Updated : Microsoft Purview support for Anthropic Claude Enterprise now includes data classification, Insider Risk Management, Communication Compliance, eDiscovery, Data Lifecycle Management, and Compliance Manager.

DocsUse Microsoft Purview to manage data security & compliance for …

Use Microsoft Purview to manage data security & compliance for Anthropic Claude (Enterprise) Use Microsoft Purview to help you protect and manage data security and compliance protections for Anthropic Claude (Enterprise).

Data Loss Prevention

In preview : Use data loss prevention policies for non-Microsoft connected apps . Create DLP policies that protect sensitive data at rest in non-Microsoft connected applications, such as Box and Google Workspace. These policies use the existing Microsoft Defender for…

DocsUse Microsoft Purview data loss prevention policies for non-Microsoft …Updated·Learn about Endpoint data loss preventionUpdated·Microsoft Purview Endpoint DLP on macOS 27Updated·Learn about Data Loss Prevention for Cloud Apps in Edge for BusinessUpdated

Use Microsoft Purview data loss prevention policies for non-Microsoft connected apps (preview) Learn how to use Microsoft Purview data loss prevention policies to protect sensitive data at rest in non-Microsoft connected apps like Box, Dropbox, Google Workspace, and Salesforce.

Data Governance

Updated : Data Quality capability requires the Microsoft Purview account and its data sources to be in the same Azure region.

DocsData Quality in Microsoft Purview Unified Catalog

Data Quality in Microsoft Purview Unified Catalog Get an overview of data quality in Microsoft Purview Unified Catalog.

Expanded automatic auditing support for AD CS, AD FS, and Entra Connect servers

Automatic Windows event auditing now configures auditing for AD FS, AD CS, and Microsoft Entra Connect. Auditing is configured automatically on any eligible server that runs Defender for Identity sensor v3.x, including servers that aren't domain controllers. For more information…

DocsConfigure Windows event auditingNew

Configure Windows event auditing Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.

Defender for Identity sensor updates

Version number Updates 2.255.19347.63719 This sensor update includes security improvements.

macOS release: Build 101.26062.0012

macOS release: Build 101.26062.0012. Release version 20.126062.12.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.26062.0011

macOS release: Build 101.26062.0011. Release version 20.126062.11.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Windows Antivirus · August 2026-2 · Platform 4.18.26080.4 · Engine 1.1.26080.3

Release details Component Version Date Platform 4.18.26080.4 September 17, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…

DocsSecurity intelligence updates for Microsoft Defender Antivirus and …

Windows Antivirus · August 2026 · Platform 4.18.26080.3 · Engine 1.1.26080.3

Release details Component Version Date Platform 4.18.26080.3 September 1, 2026 Engine 1.1.26080.3 September 1, 2026 Security intelligence 1 1.159.11.0 September 1, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…

DocsSecurity intelligence updates for Microsoft Defender Antivirus and …·ASR rules overview

ASR rules overview Learn about attack surface reduction (ASR) rules in Microsoft Defender Antivirus, including requirements, configuration methods, modes, exclusions, and policy conflict resolution.

Tamper protection in audit mode for Linux

Tamper protection in audit mode for Linux. Detects and alerts on unauthorized modifications to Defender configurations, files, directories, processes, and services, including attempts by root users. Tampering activity is surfaced through alerts, the device timeline, and Advanced Hunting without blocking…

DocsUse tamper protection in audit mode for Microsoft Defender for …

Use tamper protection in audit mode for Microsoft Defender for Endpoint on Linux Learn how to verify, test, and investigate tamper protection in audit mode for Microsoft Defender for Endpoint on supported Linux devices.

Offboarding API support for Linux

Offboarding API support for Linux. Enables organizations to automate the offboarding of Linux servers from Microsoft Defender for Endpoint through the Offboard machine API, simplifying device lifecycle management at scale. Available in Microsoft Defender for Endpoint on Linux version 101.26062.0007…

DocsOffboard machine API

Offboard machine API Learn how to use an API to offboard a device from Microsoft Defender for Endpoint.

Antivirus audit mode for Linux

Antivirus audit mode for Linux. Provides real-time malware detection and alerting without automatically quarantining files or terminating processes. This enables organizations to evaluate Defender detection efficacy and performance on sensitive workloads before enabling enforcement. Available in Microsoft Defender for Endpoint…

DocsConfigure security settings in Microsoft Defender for Endpoint on …Updated

Configure security settings in Microsoft Defender for Endpoint on Linux Describes how to configure Microsoft Defender for Endpoint on Linux in enterprises.

Unified RBAC is enabled by default for new Defender for Cloud Apps customers

Starting in August 2026, Microsoft Defender unified role-based access control (RBAC) is automatically enabled for new Defender for Cloud Apps customers. No manual workload activation is required. Unified RBAC provides a centralized experience for managing roles and permissions across Microsoft…

DocsConfigure admin accessNew·Microsoft Defender unified role-based access control (RBAC)Updated

Configure admin access Set up role-based administrator access in Defender for Cloud Apps and understand how Microsoft Entra ID and Microsoft 365 roles affect permissions.

Update to CVE details data consumption in Azure Resource Graph

August 21, 2026 Microsoft Defender for Cloud has updated how vulnerability assessment CVE details are consumed in Azure Resource Graph. CVE information remains available, but detailed CVE properties are now consumed through the microsoft.security/cvedetails resource type to improve query performance…

DocsRemediate Machine VulnerabilitiesUpdated

Remediate Machine Vulnerabilities Learn how machine vulnerability remediation in Microsoft Defender for Cloud helps you review scan findings, fix risks, and export results.

On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares

August 6, 2026 On-demand malware scanning in Microsoft Defender for Storage now supports targeted scanning of specific items. Instead of scanning an entire storage account, you can scope scans to a single blob or file, a specific container or file…

DocsMicrosoft Defender for Storage On-demand Malware ScanningUpdated

Microsoft Defender for Storage On-demand Malware Scanning Learn about the benefits and features of on-demand malware scanning in Microsoft Defender for Storage.

Classic Defender for SQL APIs retirement

August 17, 2026 The classic Defender for SQL APIs for Vulnerability Assessment and Advanced Threat Protection will be retired on August 16, 2027 . If you use these APIs, migrate to the supported configuration model and update any dependent scripts…

DocsMigrate from classic Defender for SQL APIs

Migrate from classic Defender for SQL APIs Migrate classic Defender for SQL Vulnerability Assessment and Advanced Threat Protection configurations before the APIs retire.

Breaking change: Unused actions no longer included in AWS and GCP overprovisioned identity assessments

August 6, 2026 To improve the performance and scalability of overprovisioned identity recommendation generation, Microsoft Defender for Cloud will no longer use the unused actions when computing overprovisioned identity assessments for AWS and GCP environments. As a result of this…

DocsEnable cloud infrastructure entitlement management (CIEM)

Enable cloud infrastructure entitlement management (CIEM) Enable CIEM to enforce least privilege access and manage user entitlements across Azure, AWS, and GCP as part of Defender for Cloud's CNAPP solution.

Edge security update: Stable 151.0.4129.59 (15 CVEs)

Microsoft released the latest Microsoft Edge for Stable (Version 151.0.4129.59) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide This update contains the following Microsoft Edge specific security fixes: CVE-2026-65802 CVE-2026-65804…

DocsSecurity Update Guide·CVE-2026-65802·CVE-2026-65804·CVE-2026-66310

Updated Visual Studio administrative templates in the Windows settings catalog

The Visual Studio administrative templates were refreshed to version 1.0.184.40051, which adds the latest Visual Studio policy settings to the Windows settings catalog. The new setting is: Disable Model Context Protocol (MCP) (DisableMCP) For more information, see the…

DocsAdmin controls for GitHub Copilot in Visual Studio - Visual Studio …Updated·Administrative Templates (ADMX) - Visual Studio (Windows)Updated

Admin controls for GitHub Copilot in Visual Studio - Visual Studio (Windows) Learn about the new features for administrators in GitHub Copilot for Visual Studio that enable admins to manage Copilot effectively.

Skip Setup Assistant screens for tvOS and visionOS enrollment

Microsoft Intune now supports hiding or showing new Setup Assistant screens during automated device enrollment (ADE) for tvOS and visionOS devices. When you configure an enrollment profile, you can choose which screens, such as Apple ID , Diagnostics…

DocsSet up automated device enrollment (ADE) for tvOS·Set up automated device enrollment (ADE) for visionOS

Set up automated device enrollment (ADE) for tvOS Learn how to enroll corporate-owned Apple TV devices into Microsoft Intune with Apple Automated Device Enrollment (ADE).

Samsung Knox E-FOTA firmware update management for Android Enterprise devices

Microsoft Intune now integrates with Samsung Knox E-FOTA (Firmware Over-The-Air), so you can manage firmware updates for corporate-owned Samsung devices directly in the Microsoft Intune admin center. Control which firmware version each device receives, deploy updates without user…

DocsIntegrate Samsung Knox E-FOTA with Microsoft IntuneNew

Integrate Samsung Knox E-FOTA with Microsoft Intune Learn how to integrate Samsung Knox E-FOTA with Microsoft Intune to register Samsung devices, configure firmware updates, and monitor campaigns.

Regional support for Microsoft Store apps

Microsoft Intune now supports regional selection for Microsoft Store apps. When you add a Microsoft Store app, you can choose the region (market) whose Store catalog to search and deploy from. Previously, Intune searched only the United States…

DocsAdd Microsoft Store Apps to Microsoft Intune

Add Microsoft Store Apps to Microsoft Intune Learn about adding Microsoft Store apps to Microsoft Intune.

New settings available in the Windows settings catalog

Microsoft Intune now includes new settings in the Windows settings catalog for Windows devices. You can configure options for camera behavior, Keyboard Filter controls (for Windows Insider devices), and Windows Subsystem for Linux (WSL). To find them, go…

New setting to disable the Get Started app

The new Disable Get Started setting prevents the Windows Get Started app from being available to users. For more information, see the Experience policy CSP . Applies to: Windows

DocsExperience Policy CSPNew

Experience Policy CSP Learn more about the Experience Area in Policy CSP.

New option for the Remove Default Microsoft Store packages setting

The existing Remove Default Microsoft Store packages setting in the ApplicationManagement area has a new subsetting, Specify additional package family names to remove . It lets you provide a custom list of package family names (PFNs) to remove…

DocsApplicationManagement Policy CSPNew

ApplicationManagement Policy CSP Learn more about the ApplicationManagement Area in Policy CSP.

New Windows App (Azure Virtual Desktop) settings in the Windows settings catalog

There are new Windows App settings in the Windows settings catalog. To see and configure them in Intune, create a Windows settings catalog profile ( Devices > Manage devices > Configuration > Create > New policy > Windows…

DocsConfigure Windows App Updates on WindowsUpdated

Configure Windows App Updates on Windows Learn how to configure Windows App update behavior on Windows, including automatic updates and registry settings.

New OneDrive settings in the Windows settings catalog

There are new OneDrive settings in the Windows settings catalog: Set a custom name for the OneDrive folder – sets a custom name for the synced OneDrive folder on the user's device. Enable OpenID Connect (OIDC) authentication for…

DocsIT Admins - Use OneDrive policies to control sync settings - …New

IT Admins - Use OneDrive policies to control sync settings - SharePoint in Microsoft 365 Learn how admins can use OneDrive policies to configure the OneDrive sync app settings by using Group Policy.

New Microsoft Edge settings in the Windows settings catalog

The Microsoft Edge administrative templates were refreshed to Microsoft Edge 149 (version 149.0.4022.21), which adds the latest Microsoft Edge 148 and 149 policy settings to the Windows settings catalog. The new settings are: Allow Local Fonts permission on…

DocsMicrosoft Edge Browser Policy Documentation LocalFontsAllowedForUrlsNew·Microsoft Edge Browser Policy Documentation LocalFontsBlockedForUrlsNew·Microsoft Edge Browser Policy Documentation …New·Microsoft Edge Browser Policy Documentation …New

Microsoft Edge Browser Policy Documentation LocalFontsAllowedForUrls Windows and Mac documentation for supported Microsoft Edge Browser policy: Allow Local Fonts permission on these sites

Improved on-demand device sync for Windows & iOS/iPadOS devices

Microsoft Intune now supports a more comprehensive on-demand sync for Windows and iOS/iPadOS devices. When you select the Sync device action in the Microsoft Intune admin center, Intune initiates a full synchronization across key workloads, including configuration policies…

DocsDevice Action: Sync

Device Action: Sync Learn how to use the device sync action in Intune to apply policy, app, and configuration updates to managed devices.

Dedicated RBAC permission for zero-touch enrollment

Microsoft Intune now provides a dedicated role-based access control (RBAC) permission for Google zero-touch enrollment portal access. Previously, the zero-touch enrollment iframe in the Microsoft Intune admin center required the Update app sync permission, which also grants rights…

DocsEnroll Android Enterprise dedicated, fully managed, or corporate-owned …New

Enroll Android Enterprise dedicated, fully managed, or corporate-owned work profile devices in Intune Learn how to enroll Android Enterprise dedicated, fully managed, or corporate-owned work profile devices in Intune.

Custom compliance settings for macOS

Microsoft Intune now supports custom compliance settings for macOS. As an admin, you can define compliance checks using scripts and JSON rules, similar to existing support for Windows and Linux. This capability lets you evaluate device configuration, security…

DocsUse custom compliance settings in Microsoft IntuneUpdated

Use custom compliance settings in Microsoft Intune Manage custom compliance settings on managed devices by using JSON files and discovery scripts in Microsoft Intune.

Controlled Configuration for Microsoft Defender antivirus settings (preview)

In preview, Microsoft Intune now supports Controlled Configuration for Microsoft Defender antivirus settings. When you enable it, the Defender antivirus settings delivered by Intune or Microsoft Defender for Endpoint security settings management become authoritative and override configurations from…

DocsManage antivirus settings with endpoint security policies in Microsoft …

Manage antivirus settings with endpoint security policies in Microsoft Intune Configure and deploy policies and use reports for devices you manage with endpoint security antivirus policy in Microsoft Intune.

Collect Windows registry data with the properties catalog

Microsoft Intune now lets you collect Windows registry data through the properties catalog. When you create a device inventory policy, you can define specific registry keys and values to collect from enrolled Windows devices, including a single value…

DocsCollect Device Properties With Intune Properties CatalogUpdated

Collect Device Properties With Intune Properties Catalog Use Microsoft Intune properties catalog to collect device properties—including hardware, registry values, and security signals—from Windows devices.

Edge security update: Android and iOS 150.0.4078.96

Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 150.0.4078.99

Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.99) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 150.0.4078.96

Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Android and iOS 150.0.4078.81

Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.81) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 150.0.4078.83

Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.83) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 150.0.4078.80

Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.80) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

APP Multiple Managed Accounts

Microsoft Intune mobile application management now extends support for Multiple Managed Accounts to Microsoft Outlook on iOS/iPadOS (v5.2626.0 or later), letting users add and manage more than one managed account within the same app. Note This feature is…

DocsMultiple Managed Accounts for App Protection Policies

Multiple Managed Accounts for App Protection Policies Learn how the Multiple Managed Accounts (MMA) feature in Microsoft Intune MAM enables users to manage more than one work or school account within a single app.

Edge security update: Android and iOS 150.0.4078.65

Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.65) which incorporates latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 150.0.4078.65

Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.65) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 150.0.4078.48

Microsoft released the latest Microsoft Edge for Stable (Version 150.0.4078.48) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Android and iOS 150.0.4078.50

Microsoft released the latest Microsoft Edge for Android and iOS (Version 150.0.4078.50) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Custom detection rules support in Microsoft Sentinel Repositories (Preview)

You can now manage custom detection rules as code in your GitHub or Azure DevOps repository using the Microsoft Security BICEP extension. Sync custom detection rules to Microsoft Sentinel using the Repositories feature, or deploy them directly using BICEP CLI…

DocsOverview of custom detections in Microsoft Defender XDR·Manage custom content with repository connections

Overview of custom detections in Microsoft Defender XDR Understand how you can use advanced hunting to create custom detections and generate alerts.

OT data connectors in Microsoft Security Exposure Management

Microsoft Security Exposure Management now supports operational technology (OT) data connectors for Armis, Dragos, and Forescout. OT data connectors bring OT asset and vulnerability data from supported third-party OT platforms into the Defender portal. This helps security teams view OT…

DocsOT data connectors in Microsoft Security Exposure ManagementUpdated

OT data connectors in Microsoft Security Exposure Management Learn how OT data connectors enrich Microsoft Security Exposure Management with third-party operational technology asset and vulnerability data.

Codename MDASH - MAI-Augmented scan profile preview

The MAI-Augmented scan profile is now available in preview as part of Codename MDASH. The MAI-Augmented profile can be used when triggering a scan through the Defender CLI. It includes MAI-Cyber-1-Flash, a new cyber-specialized model that extends the current agentic…

DocsInstall and run Defender CLIUpdated

Install and run Defender CLI Download and install Defender CLI, then run agentic code scans from the terminal.

Codename MDASH - MAI-Augmented scan profile now available for on-demand scans preview

Expanding on the previously released Defender CLI support, the MAI-Augmented scan profile is now also available in preview for on-demand scans triggered from the Microsoft Defender portal. Security teams can select this profile when starting an on-demand scan from the…

DocsCreate an Azure DevOps connector for agentic code securityUpdated

Create an Azure DevOps connector for agentic code security Connect your Azure DevOps organization to Microsoft Defender to enable remote on-demand agentic code scans across your repositories.

Codename MDASH - Agentic code scanner private preview

Codename MDASH - Agentic code scanner is now available in private preview in Microsoft Security Exposure Management. Codename MDASH uses a multi-model agentic AI system to detect code vulnerabilities with greater depth and accuracy than traditional static analysis. Security teams…

DocsCodename MDASH OverviewUpdated

Codename MDASH Overview Learn how Codename MDASH - Agentic code scanner uses a multi-model agentic AI system to detect code vulnerabilities with depth and accuracy beyond traditional static analysis.

Shared capabilities

Update : Microsoft Purview role-group assignments can be configured with an expiration date so that access is revoked automatically. Temporary assignments can last from one day to two years and are supported by most built-in and custom role groups, except…

DocsPermissions in the Microsoft Purview portal

Permissions in the Microsoft Purview portal Learn about managing role group and role permissions for users who perform tasks in the Microsoft Purview portal.

Insider Risk Management

In preview : Unified alert experience combines the Triage Agent and Standard alert dashboards into a single alerts list page. View and manage both classic and agent-triaged alerts from one location, with the ability to preview agent summaries, alert and…

DocsInvestigate Microsoft Purview Insider Risk Management activities·Manage the workflow with the Insider Risk Management users dashboard·Take action on Insider Risk Management cases

Investigate Microsoft Purview Insider Risk Management activities Learn how to investigate and triage Insider Risk Management alerts in Microsoft Purview. Review risk factors, explore activities, and create cases.

Information Protection

Updated : Added a checklist to help administrators understand auditing, regional availability, label scope, encryption settings, sensitive information types, file eligibility, and required roles before creating an auto-labeling policy. Updated : Troubleshoot why a specific SharePoint or OneDrive file was…

DocsAutomatically apply a sensitivity label to Microsoft 365 dataNew

Automatically apply a sensitivity label to Microsoft 365 data When you create a sensitivity label, you can automatically assign a label to data stored in Microsoft 365, or you can prompt users to select the label that you recommend.

Data lifecycle management

Updated : Priority cleanup policies now require three separate approvals before content can be permanently deleted: one Priority Cleanup administrator, one retention manager, and one eDiscovery administrator.

DocsUse priority cleanup to expedite the permanent deletion of sensitive …

Use priority cleanup to expedite the permanent deletion of sensitive information from mailboxes Use priority cleanup to expedite the permanent deletion of sensitive information from mailboxes, even if they have existing holds for retention or eDiscovery.

Data Loss Prevention

In preview : Protect sensitive data in text and prompts by integrating with Microsoft Entra Global Secure Access (GSA). This integration enables organizations to intercept and inspect text and AI interactions at the network layer, enforce restrictive actions based on…

DocsLearn about Microsoft Purview Network Data SecurityUpdated·Configure default protection for classification failures in DLP for …·Get started with DLP for Fabric and Power BI

Learn about Microsoft Purview Network Data Security Network data security extends Microsoft Purview classification to network traffic

Data Governance

Updated : Microsoft Purview protection policies no longer support Azure SQL Database . New : Configure a manual business continuity and disaster recovery environment for Microsoft Purview Data Map . The guidance covers creating a secondary account, mirroring scans, validating…

DocsData sources that connect to Microsoft Purview Data Map·Disaster Recovery for Microsoft Purview Data Map

Data sources that connect to Microsoft Purview Data Map Learn about the data sources and file types that can connect to Microsoft Purview Data Map.

Threat detection for Microsoft Agent 365 agents

(Preview) Threat detection for Microsoft Agent 365 agents : Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft…

DocsDetect and investigate threats to AI agents using Microsoft Defender …

Detect and investigate threats to AI agents using Microsoft Defender (Preview) Learn how to detect, investigate, and hunt for threats to AI agents using Microsoft Defender.

Real-time protection for Microsoft Agent 365 tooling servers

(GA) Real-time protection for Microsoft Agent 365 tooling servers : Microsoft Defender evaluates tool invocations and responses against security policies and can allow or block interactions with Work IQ MCP and customer MCP tools onboarded to Agent 365. For more…

DocsProtect AI agents in real time using Microsoft DefenderUpdated

Protect AI agents in real time using Microsoft Defender Learn how to block unsafe AI agent actions in real time and configure real-time protection rules in Microsoft Defender.

Domain investigation

(GA) The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more…

DocsInvestigate an Active Directory domainUpdated

Investigate an Active Directory domain Learn how to investigate an Active Directory domain in Microsoft Defender. Review domain health scores, security policies, trust relationships, and recommendations.

AI agent posture risk in Microsoft Defender

(Preview) AI agent posture risk in Microsoft Defender : Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access…

DocsAI agent posture risk in Microsoft DefenderNew

AI agent posture risk in Microsoft Defender Learn how Microsoft Defender assesses AI agent posture risk using risk indicators, risk levels, and security recommendations.

Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations

Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations : Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model…

DocsConfigure Unified RBAC for Microsoft Defender for Office 365·MC1246006

Configure Unified RBAC for Microsoft Defender for Office 365 Step-by-step guide to configure and activate Microsoft Defender unified role-based access control (Unified RBAC) for Microsoft Defender for Office 365, including role creation, persona templates, and migration from legacy roles.

Prompt injection protection

Prompt injection protection : Microsoft Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Microsoft Defender for Office 365 .

DocsPrompt injection protection in Microsoft Defender for Office 365

Prompt injection protection in Microsoft Defender for Office 365 Learn how Microsoft Defender for Office 365 detects prompt injection attacks hidden in email, how the detection technology works, and how it provides defense in depth for AI-based threats alongside built-in Microsoft Copilot protections.

Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3

Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3 : Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365…

DocsWhy do I need Microsoft Defender for Office 365?

Why do I need Microsoft Defender for Office 365? Learn how Microsoft Defender for Office 365 protects email and collaboration from phishing, malware, and business email compromise with Plan 1 and Plan 2 features.

Localized default Mark as and notify email templates

Localized default Mark as and notify email templates : When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more…

DocsAdmin review for user reported messagesNew

Admin review for user reported messages Admins can learn how to review messages that were reported by users and give them feedback.

Migration readiness reasons on the Sensors page

When a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see…

DocsMigrate from sensor v2.x to sensor v3.xNew

Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.

Migrate Windows Server 2025 domain controllers to sensor v3.x

You can now migrate domain controllers running Windows Server 2025 from sensor v2.x to sensor v3.x. For more information, see Migrate to Defender for Identity sensor v3.x .

DocsMigrate from sensor v2.x to sensor v3.xNew

Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.

General availability of the Domain investigation page

The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information…

DocsInvestigate an Active Directory domainUpdated

Investigate an Active Directory domain Learn how to investigate an Active Directory domain in Microsoft Defender. Review domain health scores, security policies, trust relationships, and recommendations.

General availability of sensor v2.x to v3.x migration

Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x .

DocsMigrate from sensor v2.x to sensor v3.xNew

Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.

Expanded SaaS app support in Password protection (Preview)

The Password protection page now includes password risks from SaaS apps connected through Microsoft Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce…

DocsPassword protection in Microsoft DefenderUpdated

Password protection in Microsoft Defender Learn how the Password protection page in Microsoft Defender helps you find leaked credentials, exposed passwords, and weak password policies across your identity sources.

Defender for Identity sensor updates

Version number Updates 2.255.19295.47272 This sensor update adds support for a new Event Tracing for Windows (ETW) provider and includes other improvements.

Automatic RPC auditing on domain controllers

Defender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later. You no longer need to apply a tag manually to enable RPC auditing. For more information, see Configure RPC auditing…

DocsDeploy the Microsoft Defender for Identity sensor v3.xNew

Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.

macOS release: Build 101.26062.0009

macOS release: Build 101.26062.0009. Release version 20.126062.9.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

macOS release: Build 101.26052.0016

macOS release: Build 101.26052.0016. Release version 20.126052.16.0 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

iOS · July 2026 · Platform Version: 1.1.79080103

Release details Platform version Release Date 1.1.79080103 July 20, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes.

iOS · July 2026 · Platform Version: 1.1.78290102

Release details Platform version Release Date 1.1.78290102 July 3, 2026 Enhancements and features Feature Area Update Summary Improvements Performance improvements and general bug fixes. Feature Improvement in compliance flow.

iOS release: Build 1.1.78290102

iOS release: Build 1.1.78290102. Release version 1.1.78290102 released: See enhancements and features for this release .

DocsMicrosoft Defender for Endpoint release notesNew

Microsoft Defender for Endpoint release notes Find release details for Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS from the past six months.

Windows Antivirus · July 2026 · Platform 4.18.26070.9 · Engine 1.1.26070.7

Release details Component Version Date Platform 4.18.26070.9 August 5, 2026 Engine 1.1.26070.7 August 5, 2026 Security intelligence 1 1.457.11.0 August 5, 2026 Support phase Security and Critical Updates - 1 The security intelligence version listed here is relevant to the…

DocsSecurity intelligence updates for Microsoft Defender Antivirus and …

Linux · July 2026 · 101.26052.0012

Release details Release version Engine version Signature version 30.126052.0012.0 1.1.26040.3001 1.449.136.0 Enhancements and features Feature area Update summary Visibility Improved antivirus enforcement visibility. The mdatp health command now includes a new antivirus_enforcement_level field that shows whether antivirus is running in…

Defender Deployment Tool for Linux

Defender Deployment Tool for Linux. Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation…

DocsDeploy Microsoft Defender endpoint security to Linux devices using the …Updated

Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool (preview) Learn how to use the Defender deployment tool to install and onboard Microsoft Defender for Endpoint on Linux devices and verify deployment.

Android · July 2026 · Platform: 1.0.9107.0101

Release details Platform version Release Date 1.0.9107.0101 July 21, 2026 Enhancements and features Feature Area Update Summary General Performance improvements and general bug fixes.

AI agent runtime protection updates

AI agent runtime protection updates. AI agent runtime protection includes these enhancements: - Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI…

DocsAI Agent Runtime Protection with Microsoft Defender for Endpoint …New

AI Agent Runtime Protection with Microsoft Defender for Endpoint (Preview) Learn how Microsoft Defender for Endpoint provides runtime protection for local AI agents by detecting and blocking prompt injection attacks.

Plan enablement API now blocks onboarding to five deprecated Defender plans

July 5, 2026 Effective immediately, onboarding is blocked through the plan-enablement API for five deprecated Microsoft Defender for Cloud pricing plans. This update aligns with Microsoft deprecation policy and matches existing portal behavior, where these plans are already blocked in…

New container security capabilities are now generally available

July 1, 2026 The following container security capabilities in Microsoft Defender for Cloud are now generally available: Container-level misconfiguration recommendations for Kubernetes : Agentless, container-level KSPM recommendations in Defender CSPM that assess individual containers rather than entire clusters. The following…

DocsReference table for all container security recommendations in …·Review and Remediate Kubernetes Node VulnerabilitiesUpdated·View and Remediate Vulnerabilities for Running ContainersUpdated·Containers support matrix in Defender for CloudUpdated

Reference table for all container security recommendations in Microsoft Defender for Cloud This article lists all Microsoft Defender for Cloud container security recommendations that help you harden and protect your resources.

Kubernetes misconfiguration enforcement in Defender for Containers is now generally available

July 1, 2026 Kubernetes misconfiguration enforcement in Microsoft Defender for Containers is now generally available. This feature evaluates Kubernetes resource configurations at admission time and can audit or block deployments that don't meet Microsoft security best-practice rules. With this release…

DocsKubernetes Misconfiguration EnforcementUpdated

Kubernetes Misconfiguration Enforcement Learn about Kubernetes misconfiguration enforcement in Microsoft Defender for Containers to audit or block misconfigured workloads at deployment time.

Discovery and posture for serverless container workloads is now generally available

July 1, 2026 Discovery and posture for serverless container workloads is now generally available in Microsoft Defender for Cloud. This capability provides inventory visibility, security recommendations for misconfigurations and vulnerability assessment findings, and attack path analysis for Azure Container Apps…

DocsDiscovery and posture for serverless container workloads

Discovery and posture for serverless container workloads Learn how Microsoft Defender for Cloud uses Defender cloud security posture management (Defender CSPM) to provide inventory, recommendations, and attack path visibility for serverless containers.

Deprecation completed: Legacy grouped recommendations removed from Azure portal

July 31, 2026 Retirement of legacy grouped recommendations (sub-assessments) has started. Customers can no longer access the deprecated data through the API. The Azure portal and Azure Resource Graph might take a few days to reflect the change. Individual recommendations…

DocsTransition from grouped to individual recommendations in Defender for …Updated

Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.

Database-level recommendations for SQL Vulnerability Assessment (GA)

July 26, 2026 The SQL vulnerability assessment recommendations created as part of the transition from grouped to individual recommendations are now generally available. Each SQL vulnerability assessment rule is surfaced as its own recommendation, reported directly on the affected SQL…

DocsTransition from grouped to individual recommendations in Defender for …Updated·SQL vulnerability assessment rules reference·Review and remediate SQL vulnerability assessment findings

Transition from grouped to individual recommendations in Defender for Cloud Learn about the transition from grouped to individual recommendations in Microsoft Defender for Cloud, including operational impacts and best practices.

Updated security baseline for Microsoft 365 Apps for Enterprise

An updated security baseline for Microsoft 365 Apps for Enterprise is now available in Microsoft Intune. This baseline aligns with the most recent Microsoft 365 Apps security guidance and includes updated policy recommendations to help protect against evolving…

DocsList of settings for the Microsoft 365 Apps for Enterprise security …·Configure security baseline policies in Microsoft Intune·Post Security Baseline for M365 Apps for enterprise v2512

List of settings for the Microsoft 365 Apps for Enterprise security baseline in Intune View a list of the settings in the Microsoft Intune security baseline for Microsoft Office apps. This list includes the default values for settings as found in the default configuration of the baseline.

Support for WPA3-Personal in iOS/iPadOS Wi-Fi profiles

Intune supports WPA3-Personal as a security-type option when configuring Wi-Fi device configuration profiles for iOS/iPadOS. Admins can now select WPA3-Personal alongside existing options such as WPA2-Personal. This feature: Allows managed iOS/iPadOS devices to connect to networks that require…

DocsConfigure Wi-Fi Settings for Apple Devices in Intune

Configure Wi-Fi Settings for Apple Devices in Intune Add or create a Wi-Fi configuration profile on iOS/iPadOS and macOS devices using Wi-Fi configuration settings in Microsoft Intune. Configure the connection details, authentication methods, SSIDs, security types, and proxy settings.

Remote Help support for RemoteApp in Azure Virtual Desktop

Remote Help supports RemoteApp in Azure Virtual Desktop (AVD), enabling help desk agents to securely view and control apps running within RemoteApp sessions. For more information, see Launch Remote Help .

DocsUsing Remote Help on Windows to Assist Authenticated Users

Using Remote Help on Windows to Assist Authenticated Users Use the Remote Help app to provide remote assistance to authenticated users who also run the Remote Help app, and to troubleshoot for frontline workers (FLW).

Newly available protected app for Intune

ChatGPT is now available as a protected app for Microsoft Intune. For more information about protected apps, see Microsoft Intune protected apps .

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

New supported OEMConfig apps for Android Enterprise

The following OEMConfig apps are available in Intune for Android Enterprise: FCNT | com.fcnt.arrowsconfig FCNT | com.fcnt.arrowsconfig_test For more information about OEMConfig, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune . Applies to: Android…

DocsUse OEMConfig on Android Enterprise devices in Microsoft IntuneNew

Use OEMConfig on Android Enterprise devices in Microsoft Intune Use Microsoft Intune to manage and use devices running Android Enterprise with OEMConfig. See all the steps, including an overview, see the prerequisites, create the configuration profile in Intune, and see a list of supported OEMConfig apps.

New setting added to the Windows security baseline version 25H2

The Intune security baseline for Windows, version 25H2, is updated to include one new setting, Disable Internet Explorer 11 Launch Via COM Automation , with a baseline default of Enabled . This setting was excluded from the version…

DocsDefault configuration of Intune's Windows security baselinesNew

Default configuration of Intune's Windows security baselines Review the default settings in each Microsoft Intune Windows security baseline version and compare recommended configurations for managed devices.

New Microsoft Defender Antivirus settings for Linux Server devices

The existing endpoint security Antivirus policy for the Microsoft Defender Antivirus profile on Linux Server now includes new settings you can configure and deploy to your managed Linux devices: Offline security intelligence update - Manage how Microsoft Defender…

DocsLearn about using Intune to manage Microsoft Defender settings on …Updated·Configure security settings in Microsoft Defender for Endpoint on …Updated·Manage antivirus settings with endpoint security policies in Microsoft …

Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune Learn how to use Intune policy to manage Microsoft Defender security settings on devices that aren't enrolled with Microsoft Intune.

New Android Enterprise settings in the Intune settings catalog

The settings catalog lists all the settings you can configure in a device policy, and all in one place. The following new Android Enterprise settings are available in the Microsoft Intune settings catalog ( Devices > Manage devices…

DocsAndroid settings catalog in Microsoft Intune

Android settings catalog in Microsoft Intune Review Android settings available in the Microsoft Intune settings catalog, including supported enrollment types, values, defaults, and requirements.

Microsoft Tunnel adds support for Red Hat Enterprise Linux 9.7

Microsoft Tunnel Gateway now supports Red Hat Enterprise Linux (RHEL) 9.7 as a Linux server distribution. This support requires the use of Podman 5.8.2 as its default container engine. Customers upgrading from environments using Podman v3 containers should…

DocsPrerequisites the Microsoft Tunnel VPN for Microsoft IntuneNew

Prerequisites the Microsoft Tunnel VPN for Microsoft Intune Review the prerequisites for installation and use of the Microsoft Tunnel Gateway. These include Linux servers, network, and firewall configurations.

Intune support for Trustd Mobile as a mobile threat defense partner

You can now use Trustd Mobile as a mobile threat defense partner (MTD) for enrolled devices that run the following platforms: Android 9.0 and later iOS/iPadOS 15.0 and later To learn more about this support, see Use Trustd…

DocsTrustd Mobile Threat Defense with Microsoft Intune

Trustd Mobile Threat Defense with Microsoft Intune Set up Trustd Mobile Threat Defense with Microsoft Intune to control mobile device access to your corporate resources.

Enterprise App Management support for GCC High and DoD

Microsoft Intune now extends Enterprise App Management (EAM) to the GCC High (GCCH) and DoD cloud environments. Government organizations can use the EAM enterprise catalog to discover, deploy, and keep prepackaged Microsoft and third-party apps up to date…

DocsMicrosoft Intune Enterprise Application ManagementNew

Microsoft Intune Enterprise Application Management Learn about Enterprise App Management and the Enterprise App Catalog in Microsoft Intune.

Available macOS PKG apps update automatically when you upload a new version

For available macOS PKG apps, updates now deploy to devices automatically when the same app policy was updated with a new app version, so users no longer need to select Install or Reinstall in Company Portal to get…

DocsAdd an Unmanaged macOS PKG App to Microsoft IntuneUpdated

Add an Unmanaged macOS PKG App to Microsoft Intune Learn about how to add an unmanaged macOS PKG app to Microsoft Intune.

Auto-update for Enterprise App Management applications

Microsoft Intune now supports automatic updates for Enterprise App Management (EAM) applications. When you enable auto-update for an EAM app with a required assignment, Intune detects when a newer version is available in the EAM catalog and automatically…

DocsMicrosoft Intune Enterprise Application ManagementNew

Microsoft Intune Enterprise Application Management Learn about Enterprise App Management and the Enterprise App Catalog in Microsoft Intune.

Advanced Intune capabilities are being added to Microsoft 365 E3 and E5

Microsoft is adding several Intune Suite capabilities to Microsoft 365 E3 and Microsoft 365 E5 to enable more organizations to use advanced endpoint management and security without a separate add-on. The following capabilities are added to Microsoft Enterprise…

DocsMicrosoft Intune Government Service overviewNew·Microsoft Intune advanced capabilities·Post Microsoft 365 adds advanced Microsoft Intune solutions at scale

Microsoft Intune Government Service overview Learn more about the Intune government service offerings and features. This article is designed to serve as an overview of the Microsoft Intune offering for government community cloud (GCC) High and United States Department of Defense (DoD) environments.

Edge security update: Android and iOS 149.0.4022.96

Microsoft released the latest Microsoft Edge for Android and iOS (Version 149.0.4022.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 149.0.4022.98

Microsoft released the latest Microsoft Edge for Stable (Version 149.0.4022.98) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 149.0.4022.96

Microsoft released the latest Microsoft Edge for Stable (Version 149.0.4022.96) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Multi Admin Approval now enforces on API calls made by automation

Multi Admin Approval (MAA) now applies to API calls made by automation through the Microsoft Graph API, not just interactive admin actions. If your tenant has MAA access policies configured and you use service principals, automation scripts, or…

DocsUse Multi Admin Approval with the Microsoft Graph API

Use Multi Admin Approval with the Microsoft Graph API Learn how to update your automation scripts and applications to work with Multi Admin Approval enforcement on app-authenticated API calls in Microsoft Intune.

Microsoft Intune app for Android requires version 2025.11.01 or later

The minimum supported version of the Microsoft Intune app for Android is now version 2025.11.01 . This change took effect on May 1, 2026. Users running an older version might experience sign-in failures. Most users have app updates…

Edge security update: Android and iOS 149.0.4022.80

Microsoft released the latest Microsoft Edge for Android and iOS (Version 149.0.4022.80) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 149.0.4022.80

Microsoft released the latest Microsoft Edge for Stable (Version 149.0.4022.80) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Microsoft Windows 11 STIG SCAP Benchmark audit baseline

Intune now includes a STIG audit baseline that assesses Windows devices against the recommended configurations defined in the Security Technical Implementation Guides (STIGs) published by the Defense Information Systems Agency (DISA). The initial baseline audits against the Microsoft…

DocsMicrosoft Intune Government Service overviewNew·Use Security Technical Implementation Guide audit baselines to assess …New·Advanced Analytics Overview

Microsoft Intune Government Service overview Learn more about the Intune government service offerings and features. This article is designed to serve as an overview of the Microsoft Intune offering for government community cloud (GCC) High and United States Department of Defense (DoD) environments.

Managed Win32 app content now requires HTTPS delivery

Intune now requires HTTPS delivery for managed Win32 app content. This change primarily affects organizations that use Microsoft Connected Cache and haven't configured their cache nodes for HTTPS delivery. Clients that previously pulled content from Connected Cache can…

DocsPost How to enable HTTPS support for Microsoft Connected Cache for …·HTTPS Support for Microsoft Connected Cache Overview·Configure HTTPS Support for Windows·Configure HTTPS Support for Linux

How to enable HTTPS support for Microsoft Connected Cache for Enterprise and Education By: Aditya Middha | Product Manager 2 - Microsoft Connected Cache Starting on June 16th, 2026, or soon after, Intune will enforce HTTPS content delivery...

Improvements to the new Intune single device page (preview)

In the Intune admin center, the Devices > All Devices > select a device page is redesigned and available for you to preview. This feature was available in the 2604 service release . After the initial 2604 release…

DocsWhat's new in previous months in the Microsoft IntuneNew·Use Multi Admin Approval in Intune

What's new in previous months in the Microsoft Intune Review older announcements from the Intune what's new page

Enrollment time grouping for new Apple ADE enrollment policies generally available

Enrollment time grouping is now generally available for Apple automated device enrollment (ADE) on iOS/iPadOS and macOS. With enrollment time grouping, you can identify a device's Microsoft Entra security group during enrollment, so policies, apps, and settings can…

DocsSet up enrollment time grouping·Post New iOS/iPadOS, visionOS, tvOS and macOS ADE enrollment policies …

Set up enrollment time grouping Overview and setup of the enrollment time grouping feature in Microsoft Intune.

Android Enterprise personally owned devices with a work profile uses Android Management API (AMAPI)

When users enroll their personally owned Android devices in Intune, a work profile is created with a separate partition on the device for the user's work account. These devices are referred to as personally owned devices with a…

DocsPost New policy implementation and web enrollment for Android personally …Updated·Android Management API for personally owned work profiles

New policy implementation and web enrollment for Android personally owned work profile is now GA We’re happy to announce two improvements for the management of Android personally owned work profile devices with Microsoft Intune, which is now generally...

Edge security update: Android 149.0.4022.67

Microsoft released the latest Microsoft Edge for Android (Version 149.0.4022.67) and iOS (Version 149.0.4022.68) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide

DocsSecurity Update Guide

Edge security update: Stable 149.0.4022.69

Microsoft released the latest Microsoft Edge for Stable (Version 149.0.4022.69) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Microsoft has released the latest Microsoft Edge Stable Channel (149.0.4022.62) , which incorporates the latest Security (1 CVE)

Microsoft has released the latest Microsoft Edge Stable Channel (149.0.4022.62) , which incorporates the latest Security Updates of the Chromium project. This update contains a fix for CVE-2026-11645, which has been reported by the Chromium team as having an exploit…

DocsSecurity Update Guide

Vulnerability Remediation Agent now uses Microsoft Entra agentic identity (preview)

This feature is rolling out to tenants gradually and may take several weeks to become available in your environment. The Vulnerability Remediation Agent is now available to all customers in preview. Previously, the agent was available only to…

DocsMicrosoft Entra Agent ID documentationUpdated·Vulnerability Remediation Agent Overview and Set Up

Microsoft Entra Agent ID documentation Build, secure, and manage agent identities with Microsoft Entra Agent ID. Integrate AI agents with enterprise workflows, apply Zero Trust principles, and govern agent access at scale.

Use DDM to manage Apple Intelligence settings on devices running 26.4 and later

[Custom top bar elements on Managed Home Screen] With the release of 26.4, Apple deprecated several intelligence-related settings in the MDM restrictions payload. To manage these settings, use the DDM configurations released in March 2026 instead. In the settings catalog…

DocsWhat's new in previous months in the Microsoft IntuneNew·Create a policy using settings catalog in Microsoft IntuneNew·Apple device restriction settings in Microsoft IntuneUpdated

What's new in previous months in the Microsoft Intune Review older announcements from the Intune what's new page

Strict Tunnel Mode for Microsoft Tunnel on Android

Microsoft Tunnel now supports Strict Tunnel Mode on Android Enterprise devices. When Strict Tunnel Mode is enabled, all network traffic is forced through the VPN tunnel. If the VPN connection is unavailable or drops, all network traffic on…

DocsLearn about the Microsoft Tunnel VPN solution for Microsoft Intune

Learn about the Microsoft Tunnel VPN solution for Microsoft Intune Learn about the Microsoft Tunnel Gateway, a VPN server for Intune that runs on Linux. With Microsoft Tunnel, cloud-based devices you manage with Intune can reach your on-premises infrastructure.

Silence apps on Managed Home Screen to prevent session PIN bypass

[Custom top bar elements on Managed Home Screen] For devices using Managed Home Screen (MHS), you can now silence apps whenever MHS prompts the user for authentication, such as during sign-in or at the session PIN screen. When silenced, apps…

DocsConfigure the Microsoft Managed Home Screen AppNew

Configure the Microsoft Managed Home Screen App Learn how to configure the Microsoft Managed Home Screen app.

Newly available protected apps for Intune

The following protected apps are now available for Microsoft Intune: Caju AI by Caju AI eYACHO for Biz 7 Intune by MetaMoJi Corporation (iOS) eYACHO Viewer 7 Intune by MetaMoJi Corporation (iOS) Harvey AI by Harvey AI (Android)…

DocsSupported Microsoft Intune AppsUpdated

Supported Microsoft Intune Apps This article provides lists of support partner and Microsoft apps that are commonly used with Microsoft Intune.

New Wired Networks device configuration profile for iOS/iPadOS

[Custom top bar elements on Managed Home Screen] There's a new 802.1x Wired Networks device configuration profile for iOS/iPadOS devices. The feature supports 802.1x Ethernet access controls, which is ideal for M-series iPads that support native resolution screen extension. It…

DocsConfigure 802.1x wired network settings for Apple and Windows devices …

Configure 802.1x wired network settings for Apple and Windows devices in Microsoft Intune Create or add a wired network device configuration profile or policy using the IEEE 802.1X standard for macOS, iOS/iPadOS, Windows 10, and Windows 11 devices and computers. See the different settings, add certificates, choose an EAP type, and select an…

New Microsoft Edge settings in the Windows settings catalog

[Custom top bar elements on Managed Home Screen] There are new Microsoft Edge 148 settings in the Windows settings catalog. To see and configure these settings in Intune, create a Windows settings catalog profile ( Devices > Manage devices >…

DocsMicrosoft Edge Browser Policy Documentation …New·Microsoft Edge Browser Policy Documentation DeveloperToolsAvailabilityNew·Microsoft Edge Browser Policy Documentation CopilotPageContextUpdated·Microsoft Edge Browser Policy Documentation SetNTPDefaultFeedTab

Microsoft Edge Browser Policy Documentation DeveloperToolsAvailabilityBlocklist Windows and Mac documentation for supported Microsoft Edge Browser policy: List of URL patterns for which developer tools are blocked

New Block Bluetooth sharing setting in the Android Enterprise settings catalog

[Custom top bar elements on Managed Home Screen] There's a new Block Bluetooth sharing setting in the settings catalog ( Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for…

DocsCreate a policy using settings catalog in Microsoft IntuneNew·Android settings catalog in Microsoft Intune

Create a policy using settings catalog in Microsoft Intune Use settings catalog in Microsoft Intune to configure thousands of settings for Windows 10/11, iOS/iPadOS, macOS, and Android client devices, including Microsoft Office apps, Microsoft Edge, administrative templates (ADMX), and more. Add these settings in a device configuration profile to…

Managed Home Screen exit lock task mode password now requires a device configuration profile

[Custom top bar elements on Managed Home Screen] You can no longer configure the Managed Home Screen exit lock task mode password by using an app configuration policy. To set or update the lock task mode password for Managed Home…

DocsConfigure the Microsoft Managed Home Screen AppNew

Configure the Microsoft Managed Home Screen App Learn how to configure the Microsoft Managed Home Screen app.

In-place renewal of Cloud PKI issuing certification authorities (CAs)

Microsoft Intune now supports in-place renewal of eligible Cloud PKI issuing certification authorities (CAs). Previously, renewing an issuing CA required creating a new CA and manually updating dependent SCEP certificate profiles, which increased operational overhead and configuration risk…

DocsRenew a Certificate Authority in Cloud PKI

Renew a Certificate Authority in Cloud PKI Learn how to renew a certificate authority (CA) in Microsoft Cloud PKI to maintain continuous certificate issuance.

Grant enhanced security permissions to a Mobile Threat Defense app on Android

A new Mobile Threat Defense role category is available on the Mobile Threat Defense connector configuration page in the Microsoft Intune admin center. The Grant MTD role permissions to <MTD partner name> on enrolled Android COBO and COPE…

DocsEnable Mobile Threat Defense connector in Microsoft IntuneUpdated

Enable Mobile Threat Defense connector in Microsoft Intune Enable the connector between your Mobile Threat Defense (MTD) partner and Microsoft Intune.

Detect and block Shadow AI using the properties catalog, device query, and a security baseline (preview)

Using Intune, you can detect and block a Local AI Agent, like OpenClaw, on Windows devices enrolled in Intune. Specifically, you can: Use a Properties catalog policy to collect the Local AI Agent entity. Admins can use this…

DocsCollect Device Properties With Intune Properties CatalogUpdated·Device Query for Multiple Devices·Settings list for the Local AI Agent Baseline - OpenClaw security …·Public preview overview in Microsoft Intune

Collect Device Properties With Intune Properties Catalog Use Microsoft Intune properties catalog to collect device properties—including hardware, registry values, and security signals—from Windows devices.

APP Multiple Managed Accounts

Microsoft Intune mobile application management now supports Multiple Managed Accounts, letting users add and manage more than one managed account within the same app. App protection policies apply separately to each account, so you can tailor protection based…

DocsMultiple Managed Accounts for App Protection Policies

Multiple Managed Accounts for App Protection Policies Learn how the Multiple Managed Accounts (MMA) feature in Microsoft Intune MAM enables users to manage more than one work or school account within a single app.

Edge security update: Android and iOS 149.0.4022.53

Microsoft released the latest Microsoft Edge for Android and iOS (Version 149.0.4022.53) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Edge security update: Stable 149.0.4022.52

Microsoft released the latest Microsoft Edge for Stable (Version 149.0.4022.52) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Reason over Microsoft Sentinel graphs with graph tool (Preview)

The graph tool collection in the Microsoft Sentinel Model Context Protocol (MCP) server provides visual graph-based exploration of relationships across identities, devices, threats, and signals to assess coverage, dependencies, and configuration gaps. For more information, see Explore Microsoft Sentinel graphs…

DocsData Exploration Tool Collection in Microsoft Sentinel MCP Server

Data Exploration Tool Collection in Microsoft Sentinel MCP Server Learn how to search tables, run KQL queries, analyze entities, and explore graphs by using the data exploration tools in the Microsoft Sentinel MCP server.

Link behavior results to incidents in advanced hunting (Preview)

You can now link behavior-based query results from the BehaviorInfo table to new or existing incidents in advanced hunting. This feature lets you enrich incident context with behavior records from Microsoft Sentinel UEBA. The wizard automatically populates alert metadata and…

DocsLink query results to an incident

Link query results to an incident Use the link to incident feature in Microsoft Defender XDR to attach advanced hunting query results to a new or existing incident for richer investigation context.

Overview dashboard (preview)

The updated Microsoft Security Exposure Management overview dashboard is now in preview. The dashboard consolidates signals from cloud resources and devices into a single, action-oriented view of exposure risk, organized around two core actions: Resolve Now and Monitor Exposure …

DocsStart using Microsoft Security Exposure ManagementUpdated

Start using Microsoft Security Exposure Management Learn how to start using the Microsoft Security Exposure Management dashboard to resolve prioritized exposure risks and monitor internet-facing assets.

New predefined classifications for AI agents

The following predefined AI agent classification rules were added to the critical assets list: Classification Description Executive-Sponsored AI Agent This rule applies to AI agents that are created or owned by senior executives in the organization. As such, these agents…

DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

New predefined classifications

The following predefined SaaS application classification rules were added to the critical assets list. These classifications require onboarding to Microsoft Defender for Cloud Apps. Classification Description Microsoft Entra ID Core identity and access control plane for the tenant. Compromise can…

DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

New predefined classifications

The following predefined Identity classification rules were added to the critical assets list: Classification Description Widespread Local Admin on Servers This rule applies to identities that are configured as local administrators on a high number of servers in the environment…

DocsPredefined classifications in Microsoft Security Exposure ManagementUpdated

Predefined classifications in Microsoft Security Exposure Management Lists of all the current predefined classifications in Microsoft Security Exposure Management.

eDiscovery

New : A new Convert supported file formats to HTML option is available when adding search results to a review set and when exporting items from a review set in eDiscovery. When enabled, cloud-native file formats such as .loop and…

DocsAdd search results to a review set in eDiscovery·Export items from a review set in eDiscovery

Add search results to a review set in eDiscovery Learn about adding search results to a review set, including sampling options, for a case in eDiscovery in the Microsoft Purview portal.

Sensitivity labels

Preview : Rolling out, the sensitivity label setting to prevent connected experiences that analyze content now prevents all connected experiences in Word, Excel, and PowerPoint for Windows, rather than a subset of these experiences. Preview : Rolling out, the sensitivity…

DocsManage Sensitivity Labels in Office Apps

Manage Sensitivity Labels in Office Apps Learn how to configure and manage sensitivity labels in Office apps for desktop, mobile, and the web to help classify and protect your organization's data.

Sensitive information types

New : Added definitions for the following sensitive information types: China physical addresses Colombia national ID Colombia tax identification number Greenland physical addresses Russia physical addresses Russia taxpayer identification number Singapore physical addresses South Africa physical addresses Ukraine physical addresses

DocsColombia national ID entity definitionUpdated·Colombia tax identification number entity definitionUpdated·Russia taxpayer identification number entity definitionUpdated·China physical addresses entity definition

Colombia national ID entity definition Colombia national ID sensitive information type entity definition.

Insider Risk Management

General availability (GA) : Select which generative AI apps to monitor in Insider Risk Management policy indicators. For Microsoft Copilot experiences and Enterprise AI apps, you can now select or deselect generative AI apps for monitoring, reducing alert noise, and…

DocsConfigure policy indicators in Insider Risk Management

Configure policy indicators in Insider Risk Management Configure policy indicators in Microsoft Purview Insider Risk Management to define the type of risk activities that you want to detect and investigate.

Information Protection client

In preview : View and label files with the Information Protection client using macOS.

DocsInformation Protection client: Version release history and support …New

Information Protection client: Version release history and support policy Version release history and support policy for the Microsoft Purview Information Protection client.

Device Onboarding

New : Monitor device health with the device health reports dashboard . Use the device health reports dashboard to monitor device onboarding status, policy update readiness, and feature readiness for Endpoint DLP.

DocsMonitor Endpoint DLP Device Health in Microsoft Purview

Monitor Endpoint DLP Device Health in Microsoft Purview Use the Microsoft Purview device health reports dashboard to monitor device onboarding status, policy update readiness, and feature readiness for Endpoint DLP.

Data Security Investigations

In preview : Endpoint DLP evidence collection is now available as a data source in Data Security Investigations. Investigators can query data captured by endpoint Data Loss Prevention (DLP) policies on onboarded devices and add the associated content to an…

DocsSearch, review, and refine results in Data Security InvestigationsUpdated·Learn about the Data Security Investigations workflowUpdated·Learn about AI analysis in Data Security Investigations

Search, review, and refine results in Data Security Investigations Discover how to search, review, and refine results in Data Security Investigations, including audit search for activity-based content identification.

Data Loss Prevention

New : Access Endpoint DLP device attribute data using Advanced Hunting . Query Endpoint DLP device configuration and policy sync attributes at scale through the DeviceInfo table's DlpInfo column in Advanced hunting in the Microsoft Defender portal, instead of relying…

DocsMicrosoft Purview DLP for Microsoft 365 Copilot and CoworkNew·Get started with Activity explorerUpdated·Troubleshooting endpoint data loss prevention configuration and policy …·Create a DLP Policy Using Device Scoping

Microsoft Purview DLP for Microsoft 365 Copilot and Cowork Learn how Microsoft Purview DLP protects Microsoft 365 Copilot, Copilot Chat, and Cowork by blocking sensitive prompts, web search, and labeled content.

Copilot Cowork

General availability (GA) : Data security and compliance protections for Microsoft 365 Copilot Cowork

DocsUse Microsoft Purview to manage data security & compliance for …New

Use Microsoft Purview to manage data security & compliance for Microsoft 365 Copilot Cowork Use Microsoft Purview to help you protect and manage data security and compliance protections for Microsoft 365 Copilot Cowork.

Remote Help for Windows updated with performance improvements

The latest version of Remote Help for Windows (version 5.2.1037.0) includes general bug fixes and performance improvements to enhance reliability.

Upcoming change - Improved restore experience for device-bound Authenticator app passkeys on iOS

Type: Plan for change Service category: Microsoft Authenticator App Product capability: Identity Security & Protection No action is required. What is changing? Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users…

Docsback-up-account-credentials-in-microsoft-authenticator-bb939936-7a8d-4 …

Public Preview - Prevent unauthorized changes to AD groups with AD group enforcement

Type: New feature Service category: Provisioning Product capability: Entra Cloud Sync For customers leveraging group provisioning to AD, this capability ensures that changes to AD groups remain consistent with those managed in Microsoft Entra. With this preview, you can designate…

DocsAD group enforcement documentation

Public Preview - New built-in Entra role for SOC identity response in Microsoft Defender

Type: New feature Service category: RBAC Product capability: Identity Security & Protection Starting June 8 we're introducing a new built-in role in Microsoft Entra— SOC Identity Responder —to further improve how security teams execute identity containment actions initiated from Microsoft…

Public Preview - Extended Conditional Access protections for Agent's user accounts

Type: New feature Service category: Conditional Access Product capability: Identity Security & Protection Conditional Access now provides broader controls to secure AI agents that have a user account. Administrators can: Target agent's user accounts with greater precision by including or…

DocsTarget agents in Microsoft Entra Conditional Access policiesUpdated

Target agents in Microsoft Entra Conditional Access policies Learn how to select and target agent identities in Microsoft Entra Conditional Access policies using the object picker, blueprints, and custom security attributes.

Generally available - Jailbreak/Root Detection in Authenticator App

Type: New feature Service category: Microsoft Authenticator App Product capability: Identity Security & Protection Microsoft Authenticator introduced jailbreak/root detection for Microsoft work or school accounts in the Authenticator app. Users with rooted/jailbroken devices will be blocked from adding/using work or…

General availability - Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows

Type: Changed feature Service category: Authentications (Logins) Product capability: User Authentication General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral…

DocsConfigure Microsoft Entra Kerberos trustNew

Configure Microsoft Entra Kerberos trust Learn how to configure and manage Microsoft Entra Kerberos trust between Microsoft Entra ID and Active Directory Domain Services.

General Availability - SCIM 2.0 APIs for Microsoft Entra ID in US Gov cloud

Type: New feature Service category: Provisioning Product capability: Identity Lifecycle Management SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using…

DocsEnable the SCIM Provisioning API in Microsoft Entra ID

Enable the SCIM Provisioning API in Microsoft Entra ID Learn how to enable the SCIM Provisioning API feature in the Microsoft Entra admin center and link an Azure subscription for billing.

General Availability - Microsoft Entra Backup and Recovery is now available

Type: New feature Service category: Entra Backup and Recovery Product capability: Entra Backup and Recovery Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it…

DocsMicrosoft Entra Backup and Recovery overviewUpdated

Microsoft Entra Backup and Recovery overview Learn how Microsoft Entra Backup and Recovery helps you recover from malicious attacks or accidental changes to tenant objects

General Availability - External users can be directly assigned to Access Packages

Type: New feature Service category: Entitlement Management Product capability: Identity Governance This feature allows Entitlement Management admins to directly assign external users who are not in the directory to an access package using the user's email. Users are invited into…

General Availability - Domainless SAML IdP federation for workforce tenants

Type: New feature Service category: B2B Product capability: B2B/B2C Domainless SAML federation with a SAML Identity Provider allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes…

DocsAdd a SAML/WS-Fed identity providerNew

Add a SAML/WS-Fed identity provider Set up direct federation with SAML 2.0 or WS-Fed identity providers so users can sign in with work accounts. Understand attributes and claims for federation.

General Availability - BYOD support for Windows client using Entra registration

Type: New feature Service category: BYOD Product capability: Network Access We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable users and partners to access…

DocsLearn about bring your own device (BYOD) with the Global Secure Access …

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access - Global Secure Access Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.

Edge security update: Android and iOS 148.0.3967.97

Microsoft released the latest Microsoft Edge for Android and iOS (Version 148.0.3967.97) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide .

DocsSecurity Update Guide

Identity Security dashboard

(Preview) The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live. For more information, see Identity…

DocsIdentity Security dashboard in Microsoft Defender for Identity …

Identity Security dashboard in Microsoft Defender for Identity (Preview) Learn how to work with the Identity Security dashboard in Microsoft Defender for Identity to monitor identity-related security risks.

Entity enrichments with threat intelligence

(Preview) Entity enrichments with threat intelligence : Entity pages for IP addresses, domains, URLs, and files now include a Threat Intelligence Insights tab that surfaces enrichment data from Microsoft Threat Intelligence directly in the investigation workflow. Enrichments include reputation scores…

DocsView threat intelligence in entity pages in Microsoft Defender

View threat intelligence in entity pages in Microsoft Defender Learn how to view threat intelligence from Microsoft Threat Intelligence on IP, domain, URL, and file entity pages in the Microsoft Defender portal.

Email & collaboration content: Emails associated with alerts (read)

The Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration content: Emails associated with alerts (read) permission instead of the broader Email & Collaboration content: All Emails (read) permission. This least-privilege permission restricts…

DocsMicrosoft Security Copilot Phishing Triage Agent in Microsoft Defender·Microsoft Security Copilot Security Alert Triage Agent in Microsoft …

Microsoft Security Copilot Phishing Triage Agent in Microsoft Defender Learn how the Security Copilot Phishing Triage Agent in Microsoft Defender uses AI to triage and classify user-reported phishing emails, set up the agent, provide feedback, and monitor its performance.

Coverage and maturity

(Preview) On the Coverage and maturity page, the Review and improve coverage side panel for SaaS Identities now includes an Observed column and a Show Only Observed Applications toggle. By default, the panel shows only SaaS applications detected in your…

DocsView your identity coverage and maturityNew

View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.

(Preview) The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is tran

(Preview) The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft…

DocsAgentsInfo table in the advanced hunting schemaUpdated·Naming changes in the Microsoft Defender XDR advanced hunting schemaUpdated

AgentsInfo table in the advanced hunting schema Learn about agent information in the AgentsInfo table of the advanced hunting schema

(Preview) Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience

(Preview) Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience , runtime protection for supported local AI agents on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop…

DocsSet up AI agent runtime protection with Microsoft Defender for …New·Protect AI assets from emerging threats and vulnerabilities using …

Set up AI agent runtime protection with Microsoft Defender for Endpoint (Preview) Learn how to configure Microsoft Defender for Endpoint AI agent runtime protection to detect, audit, and block prompt injection on Windows devices.

(Preview) Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience , Micros

(Preview) Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience , Microsoft Defender now automatically discovers supported local AI agents running on onboarded Windows devices - including coding agents and IDE extensions, desktop AI…

DocsDiscover local AI agents with Microsoft Defender for EndpointNew·Protect AI assets from emerging threats and vulnerabilities using …

Discover local AI agents with Microsoft Defender for Endpoint Learn how to discover, view, and investigate local AI agents on Windows and macOS devices by using Microsoft Defender.

(GA) The following advanced hunting schema tables are now generally available: The DisruptionAndResponseEvents

(GA) The following advanced hunting schema tables are now generally available: The DisruptionAndResponseEvents table contains information about automatic attack disruption events in Microsoft Defender XDR. The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by…

DocsCloudDnsEvents table in the advanced hunting schemaUpdated·DisruptionAndResponseEvents table in the advanced hunting schema·CloudAuditEvents table in the advanced hunting schema·CloudProcessEvents table in the advanced hunting schema

CloudDnsEvents table in the advanced hunting schema Learn about the CloudDnsEvents table in the advanced hunting schema, which contains information about DNS activity events from cloud infrastructure environments.

Visibility into service principals used by AI agents (Preview)

The non-human identity inventory now identifies which Entra ID service principals are used by AI agents. A new "Used by AI agents" column and insight card help you find and prioritize these identities. For more information, see View the Identity…

DocsView the Identity inventoryUpdated

View the Identity inventory View and manage all identities across your organization from the Identity inventory page in Microsoft Defender. Investigate identity types, domains, and attributes.