Defender

October 2026

• Fri 9 Oct Install and upgrade New version · Microsoft Defender Antivirus · Security intelligence: 1.459.631.0
• Oct 2026 New and changed features Product news · KSPM misconfiguration recommendations moving to controller-level scope (GA)
• Oct 2026 New and changed features Product news · New Defender server security experience
• Oct 2026 New and changed features Product news · On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares (GA)
• Oct 2026 New and changed features Product news · Automatic enablement of SaaS accounts integration with Identity inventory
• Oct 2026 New and changed features Product news · General availability of sensor v3.x activation without Defender for Endpoint
• Oct 2026 New and changed features Product news · Expanding user reporting in Teams to include meetings

September 2026

• Wed 30 Sep New and changed features Product news · Defender for Endpoint Android 1.0.9330.0101
• Mon 28 Sep New and changed features Product news · Automatically launch Microsoft Defender for Endpoint during Android Enterprise device setup
• Thu 24 Sep New and changed features Product news · Defender for Endpoint iOS 1.1.81160103
• Wed 23 Sep Issues and security Security news · Integrated Security Operations Center in Microsoft Defender
• Wed 23 Sep Issues and security Security news · Reimagining Case Management in Microsoft Defender
• Wed 23 Sep Issues and security Security news · Reimagining the SOC for the agentic era in Microsoft Defender
• Thu 17 Sep Issues and security Security news · Improving email security outcomes with real-world Microsoft Defender insights
• Tue 15 Sep New and changed features Product news · Defender for Endpoint iOS 1.1.81140101
• Mon 14 Sep New and changed features Product news · Defender for Endpoint iOS 1.1.81120108
• Fri 11 Sep New and changed features Product news · Defender for Endpoint Android 1.0.9309.0102
• Thu 10 Sep Issues and security Security news · Detect and disrupt AI-themed attacks with Microsoft Defender
• Mon 7 Sep New and changed features Product news · Defender for Endpoint iOS 1.1.80270104 (release notes mention Global Secure Access)
• Sep 2026 New and changed features Product news · AWS GuardDuty coverage status is now shown on the S3 asset page
• Sep 2026 New and changed features Product news · Enhanced agent for Defender for SQL Servers on Machines is fully available in Azure Government cloud
• Sep 2026 New and changed features Product news · General availability of Defender for Cosmos DB in Azure Government cloud
• Sep 2026 New and changed features Product news · Upcoming billing updates for Defender for Servers
• Sep 2026 Retirements and dates Product news · Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation
• Sep 2026 New and changed features Product news · Defender for Endpoint Linux 101.26081.0010
• Sep 2026 New and changed features Product news · Defender for Endpoint Linux 101.26072.0005
• Sep 2026 New and changed features Product news · Defender for Endpoint macOS 101.26072.0017
• Sep 2026 New and changed features Product news · Automatic sensor v3.x activation and Windows auditing by default
• Sep 2026 New and changed features Product news · Combined Sensor management tab on the On-premises settings page
• Sep 2026 New and changed features Product news · Identity Security dashboard and Coverage & Maturity
• Sep 2026 New and changed features Product news · Sensor v3.x onboarding without Microsoft Defender for Endpoint deployment (Preview)
• Sep 2026 New and changed features Product news · Sensor v3.x support for additional identity server roles: AD CS, AD FS, and Entra Connect (Preview)
• Sep 2026 New and changed features Product news · Expanding user reporting in Teams to include group calls
• Sep 2026 New and changed features Product news · Separating Teams user reporting settings from email settings
• Sep 2026 New and changed features Product news · (Preview) Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Micro…
• Sep 2026 New and changed features Product news · (GA) Identity Security dashboard and Coverage & Maturity
• Tue 1 Sep Issues and security Security news · Stop identity attacks before they start with Microsoft ISPM recommendations
• Tue 1 Sep New and changed features Roadmap entry · Microsoft Defender for Identity: Unified identity timeline on the Identity page

August 2026

• Mon 31 Aug New and changed features Product news · Defender for Endpoint Android 1.0.9228.0101
• Wed 26 Aug New and changed features Roadmap entry · Microsoft Defender for Office 365: Full Submissions experience in GCC
• Tue 25 Aug New and changed features Product news · Audit mode for the Microsoft Defender Antivirus template for Linux
• Tue 25 Aug New and changed features Product news · Memory scan setting for Microsoft Defender Antivirus on Linux
• Thu 20 Aug New and changed features Product news · Defender for Endpoint Android 1.0.9212.0102
• Thu 20 Aug New and changed features Product news · Defender for Endpoint iOS 1.1.80120102
• Tue 11 Aug New and changed features Product news · Defender for Endpoint Android 1.0.9129.0101
• Wed 5 Aug Issues and security Security news · Monthly News-August 2026
• Tue 4 Aug New and changed features Product news · Defender for Endpoint iOS 1.1.79210103
• Tue 4 Aug New and changed features Roadmap entry · Microsoft Defender for Office 365: Localized Default Mark and Notify Email Template
• Mon 3 Aug Issues and security Security news · Microsoft Defender for Cloud Customer Newsletter
• Aug 2026 New and changed features Product news · Breaking change: Unused actions no longer included in AWS and GCP overprovisioned identity assessments
• Aug 2026 Retirements and dates Product news · Classic Defender for SQL APIs retirement
• Aug 2026 New and changed features Product news · On-demand malware scanning now supports scanning specific blobs, files, containers, and file shares
• Aug 2026 New and changed features Product news · Update to CVE details data consumption in Azure Resource Graph
• Aug 2026 New and changed features Product news · Unified RBAC is enabled by default for new Defender for Cloud Apps customers
• Aug 2026 New and changed features Product news · Defender for Endpoint Linux 101.26062.0007
• Aug 2026 New and changed features Product news · Defender for Endpoint macOS 101.26062.0012
• Aug 2026 New and changed features Product news · Defender for Endpoint macOS 101.26062.0011
• Aug 2026 New and changed features Product news · Defender for Identity sensor updates
• Aug 2026 New and changed features Product news · Expanded automatic auditing support for AD CS, AD FS, and Entra Connect servers
• Aug 2026 New and changed features Product news · New: Microsoft 365 audit log activities now include Microsoft Defender for Cloud activities, People Skills activities, Microsoft 365 Archive file-level policy activities…
• Sat 1 Aug Issues and security Product Terms · Microsoft Defender Experts — Product Terms

July 2026

• Fri 31 Jul Issues and security Security news · Detecting CVE-2026-54121 (Certighost) with Microsoft Defender
• Thu 30 Jul Issues and security Security news · Built to Protect: The Architecture Behind Codename MDASH
• Wed 29 Jul Issues and security Security news · MDTI convergence in Microsoft Sentinel and Defender XDR is complete
• Mon 27 Jul New and changed features Product news · Controlled Configuration for Microsoft Defender antivirus settings (preview)
• Mon 27 Jul Issues and security Security news · Level Up Your Security Skills This August with the Microsoft Defender Challenge and Learn Live
• Tue 21 Jul New and changed features Product news · Defender for Endpoint Android 1.0.9107.0101
• Mon 20 Jul New and changed features Product news · Defender for Endpoint iOS 1.1.79080103
• Wed 15 Jul Issues and security Security news · Introducing scheduled antivirus scans on Microsoft Defender Linux
• Wed 15 Jul Issues and security Security news · New Privileged Token Context Telemetry Boosts Advanced Hunting in Microsoft Defender
• Tue 14 Jul New and changed features Windows news · Hunting Local AI Tools on macOS with Microsoft Defender for Endpoint
• Tue 14 Jul Issues and security Security news · Microsoft Defender now integrates with Dragos, Forescout, & Armis for OT Security
• Fri 3 Jul New and changed features Product news · Defender for Endpoint iOS 1.1.78290102
• Thu 2 Jul Issues and security Security news · Microsoft Defender for Cloud Customer Newsletter
• Jul 2026 New and changed features Product news · Database-level recommendations for SQL Vulnerability Assessment (GA)
• Jul 2026 Retirements and dates Product news · Deprecation completed: Legacy grouped recommendations removed from Azure portal
• Jul 2026 New and changed features Product news · Discovery and posture for serverless container workloads is now generally available
• Wed 1 Jul New and changed features Product news · Foundational CSPM moves to opt-in model for new Azure subscriptions
• Jul 2026 New and changed features Product news · Kubernetes misconfiguration enforcement in Defender for Containers is now generally available
• Jul 2026 New and changed features Product news · New container security capabilities are now generally available
• Jul 2026 Retirements and dates Product news · Plan enablement API now blocks onboarding to five deprecated Defender plans
• Jul 2026 New and changed features Product news · Defender for Endpoint Linux 101.26052.0012
• Jul 2026 New and changed features Product news · Defender for Endpoint macOS 101.26062.0009
• Jul 2026 New and changed features Product news · Defender for Endpoint macOS 101.26052.0016
• Jul 2026 New and changed features Product news · Automatic RPC auditing on domain controllers
• Jul 2026 New and changed features Product news · Defender for Identity sensor updates
• Jul 2026 New and changed features Product news · Expanded SaaS app support in Password protection (Preview)
• Jul 2026 New and changed features Product news · Migrate Windows Server 2025 domain controllers to sensor v3.x
• Jul 2026 New and changed features Product news · Migration readiness reasons on the Sensors page
• Jul 2026 New and changed features Product news · Sensor v2.x to v3.x migration is now generally available
• Jul 2026 New and changed features Product news · The Domain investigation page is now generally available
• Jul 2026 New and changed features Product news · Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations
• Jul 2026 New and changed features Product news · Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3
• Jul 2026 New and changed features Product news · Localized default Mark as and notify email templates
• Jul 2026 New and changed features Product news · Prompt injection protection
• Jul 2026 New and changed features Product news · (Preview) AI agent posture risk in Microsoft Defender
• Jul 2026 New and changed features Product news · (GA) Real-time protection for Microsoft Agent 365 tooling servers
• Jul 2026 New and changed features Product news · (GA) The Domain investigation page allows you to investigate an Active Directory domain.
• Jul 2026 New and changed features Product news · (Preview) Threat detection for Microsoft Agent 365 agents
• Wed 1 Jul Issues and security Security news · Now generally available: Serverless posture coverage in Microsoft Defender CSPM
• Wed 1 Jul Issues and security Security news · Monthly news - July 2026

June 2026

• Tue 30 Jun New and changed features Product news · Defender for Endpoint Android 1.0.9029.0101
• Tue 30 Jun Issues and security Security news · Microsoft Defender for Cloud expands multicloud coverage across AWS and Google Cloud
• Tue 30 Jun Issues and security Security news · The next frontier in endpoint security: Securing local AI agents with Microsoft Defender
• Mon 29 Jun New and changed features Product news · New Microsoft Defender Antivirus settings for Linux Server devices
• Fri 19 Jun New and changed features Product news · Defender for Endpoint Android 1.0.9014.0101
• Wed 17 Jun Issues and security Security news · Securing the invisible workforce
• Tue 16 Jun Issues and security Publicly disclosed vulnerability · Microsoft Defender Elevation of Privilege Vulnerability
• Tue 16 Jun Issues and security Security news · Closing the loop on container security: From code to runtime in the AI era
• Fri 12 Jun New and changed features Roadmap entry · Microsoft Defender for Office 365: Introducing a new URL click alert in Teams via Microsoft Defender for Office 365
• Thu 11 Jun New and changed features Product news · Defender for Endpoint iOS 1.1.78020101
• Thu 11 Jun Issues and security Security news · Reduce unnecessary internet exposure with Microsoft Defender
• Tue 9 Jun Issues and security Security news · Elevate your telemetry using custom data collection in Microsoft Defender
• Tue 9 Jun Issues and security Security news · Microsoft Defender now monitors RPC activity
• Mon 8 Jun New and changed features Product news · Defender for Endpoint Android 1.0.9003.0101
• Thu 4 Jun Issues and security Security news · Microsoft Defender for Cloud Customer Newsletter
• Tue 2 Jun Issues and security Security news · Start Secure, Stay Secure: How Microsoft is Closing the Gap from Code to Runtime
• Tue 2 Jun Issues and security Security news · The end of patching era for containers: Microsoft Defender for Cloud expands hardened image support
• Jun 2026 Retirements and dates Product news · File policies retiring January 6, 2027
• Jun 2026 New and changed features Product news · API security posture management for Function Apps and Logic Apps is now generally available
• Jun 2026 New and changed features Product news · Cloud security reporting is now generally available
• Jun 2026 New and changed features Product news · Container-level misconfiguration recommendations for Kubernetes (Preview)
• Jun 2026 New and changed features Product news · Discovery and posture for serverless container workloads (Preview)
• Jun 2026 New and changed features Product news · Expanded container support for cloud scopes
• Jun 2026 New and changed features Product news · Expanded multicloud security coverage is now generally available
• Jun 2026 New and changed features Product news · General availability of Defender for Key Vault in Azure Government cloud
• Jun 2026 New and changed features Product news · General availability of Microsoft Defender for Open-Source Relational Databases on AWS RDS
• Jun 2026 New and changed features Product news · Kubernetes misconfiguration enforcement in Defender for Containers (Preview)
• Jun 2026 New and changed features Product news · Kubernetes node vulnerability assessment extended to EKS and GKE (Preview)
• Jun 2026 New and changed features Product news · New actionable recommendation to upgrade AKS for system pod vulnerabilities (Preview)
• Jun 2026 New and changed features Product news · New multicloud security recommendations now in public preview
• Jun 2026 New and changed features Product news · Serverless protection for Azure and AWS is now generally available
• Jun 2026 New and changed features Product news · SQL Vulnerability Assessment Express Configuration is now generally available for Azure SQL Managed Instance and Azure Synapse Analytics workspaces
• Jun 2026 New and changed features Product news · Support for additional Azure regions in the UAE geography for Defender for APIs and API security posture management with Defender CSPM
• Jun 2026 New and changed features Product news · Vulnerability assessment extended to runtime-discovered container images on EKS and GKE (Preview)
• Jun 2026 New and changed features Product news · Salesforce connector enhancements (Preview)
• Mon 1 Jun New and changed features Product news · Defender for Endpoint iOS 1.1.77280101
• Jun 2026 New and changed features Product news · Defender for Endpoint Linux 101.26042.0011
• Jun 2026 New and changed features Product news · Defender for Endpoint macOS 101.26042.0020
• Jun 2026 New and changed features Product news · Identity risk score is now generally available
• Jun 2026 New and changed features Product news · New Defender for Identity security alerts
• Jun 2026 New and changed features Product news · NHI inventory enhancements (Preview)
• Jun 2026 New and changed features Product news · Visibility into service principals used by AI agents (Preview)
• Jun 2026 New and changed features Product news · (Preview) The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving y…
• Jun 2026 New and changed features Product news · (Preview) Entity enrichments with threat intelligence
• Jun 2026 New and changed features Product news · (Preview) Local AI agent runtime protection on Windows endpoints: as part of the Defender AI agents experience, runtime protection for supported local AI agents on Windo…
• Jun 2026 New and changed features Product news · (GA) The following advanced hunting schema tables are now generally available: The DisruptionAndResponseEvents table contains information about automatic attack disrupti…
• Jun 2026 New and changed features Product news · (Preview) The AgentsInfo table in advanced hunting is now available in preview.
• Jun 2026 New and changed features Product news · (Preview) On the Coverage and maturity page, the Review and improve coverage side panel for SaaS Identities now includes an Observed column and a Show Only Observed Appl…
• Jun 2026 New and changed features Product news · The Phishing Triage Agent and Security Alert Triage Agent now use the more limited Email & collaboration content: Emails associated with alerts (read) permission instead…
• Jun 2026 New and changed features Product news · (Preview) Local AI agent discovery on Windows endpoints: as part of the Defender AI agents experience, Microsoft Defender now automatically discovers supported local AI…
• Mon 1 Jun Issues and security Security news · Now Generally Available: Microsoft Defender for open source relational databases on AWS RDS
• Mon 1 Jun Issues and security Security news · How Microsoft Defender used predictive shielding to proactively disrupt a ransomware attack

May 2026

• Wed 27 May Issues and security Security news · Organize your multitenant view with Tenant Groups in Microsoft Defender
• Wed 20 May Issues and security Added to CISA KEV · Microsoft Defender Link Following Vulnerability
• Wed 20 May Issues and security Added to CISA KEV · Microsoft Defender Denial of Service Vulnerability
• Tue 19 May Issues and security Security news · Public preview: Expanded coverage and unified management for SQL VA Express Configuration
• Mon 18 May New and changed features Product news · Defender for Endpoint Android 1.0.8913.0101
• Mon 18 May Issues and security Security news · Introducing selective response actions for high-value assets in Microsoft Defender
• Fri 15 May New and changed features Product news · Defender for Endpoint iOS 1.1.77130101
• Wed 6 May Issues and security Security news · Better together with Azure WAF + Microsoft Defender for Storage + Defender for Azure SQL Databases
• Tue 5 May New and changed features Roadmap entry · Microsoft Teams: Report a Suspicious Call in Microsoft Teams
• Mon 4 May Issues and security Security news · Microsoft Defender for Cloud Customer Newsletter
• Mon 4 May Issues and security Security news · Monthly news - May 2026
• May 2026 New and changed features Product news · Cloud security reporting in Microsoft Defender portal (Preview)
• May 2026 New and changed features Product news · Daily score calculation enhancement for risk-based Cloud secure score
• May 2026 New and changed features Product news · General availability of Defender for Cloud integration into the Defender portal
• May 2026 Retirements and dates Product news · General availability of individual recommendations for Defender for Cloud in Azure portal and deprecation of legacy grouped recommendations
• May 2026 New and changed features Product news · General availability of Microsoft Defender for Cloud and GitHub Advanced Security integration
• May 2026 New and changed features Product news · General availability of on-demand malware scanning of Azure Files in Microsoft Defender for Storage
• May 2026 New and changed features Product news · Malware detection for EKS and GKE nodes (Preview)
• May 2026 New and changed features Product news · Microsoft Defender Experts for Servers as a managed XDR option
• May 2026 New and changed features Product news · Microsoft Defender for Open-Source Relational Databases on AWS RDS will become Generally Available
• May 2026 New and changed features Product news · Private clusters protection for gated deployment, binary drift detection, and malware detection (Preview)
• May 2026 New and changed features Product news · Scanning support for Docker Hardened container images (preview)
• May 2026 New and changed features Product news · SQL Vulnerability Assessment Express Configuration now available for Azure SQL Managed Instance and Synapse (Preview)
• May 2026 New and changed features Product news · Updated Helm installation for Defender for Containers sensor
• May 2026 New and changed features Product news · Disable informational alerts for unsanctioned app access (Preview)
• May 2026 New and changed features Product news · Defender for Identity sensor updates
• May 2026 New and changed features Product news · Increased sensor capacity
• May 2026 New and changed features Product news · Known limitation: Migration of domain controllers with Windows Server 2025 from sensor v2.x to sensor v3.x is not supported
• May 2026 New and changed features Product news · New Defender for Identity security alerts
• May 2026 New and changed features Product news · Sensor v3.x supports all identity roles on domain controllers
• May 2026 New and changed features Product news · (Preview) Automatic attack disruption can now isolate compromised devices from the network when high-confidence incident analysis indicates the device is being used as a…
• May 2026 New and changed features Product news · In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results.
• May 2026 New and changed features Product news · The hunting graph in advanced hunting now includes new identity-focused predefined scenarios.
• May 2026 New and changed features Product news · Defender Chat experience (Preview) is an open prompt chat assistant built into Microsoft Defender.
• May 2026 New and changed features Product news · Microsoft Defender Experts for Servers and Microsoft Defender Experts Hunting - Servers are now offered as standalone offerings for customers who wish to avail managed e…
• Fri 1 May Issues and security Product Terms · Microsoft Defender Experts — Product Terms

April 2026

• Tue 28 Apr Issues and security Security news · Microsoft Defender: New Advanced hunting enhancements
• Mon 27 Apr New and changed features Windows news · Assess Secure Boot certificate status with Microsoft Defender
• Mon 27 Apr Issues and security Security news · Assess Secure Boot status with Microsoft Defender
• Wed 22 Apr Issues and security Added to CISA KEV · Microsoft Defender Insufficient Granularity of Access Control Vulnerability
• Fri 10 Apr Issues and security Security news · Securing multicloud (Azure, AWS & GCP) with Microsoft Defender for Cloud: Connector best practices
• Wed 8 Apr Issues and security Security news · Monthly news - April 2026
• Thu 2 Apr Issues and security Security news · Microsoft Defender for Cloud Customer Newsletter
• Apr 2026 New and changed features Product news · Anti-malware detection and blocking is now generally available
• Apr 2026 New and changed features Product news · Defender for Containers runtime protection on EKS Bottlerocket is now generally available
• Apr 2026 New and changed features Product news · DNS Detection for Kubernetes is now generally available
• Apr 2026 New and changed features Product news · General availability of container security capabilities in Azure Government cloud

Sorted from how each source classifies its records: what's-new pages, releases, documentation changes, notices, roadmap items, and network changes. A kind is a reading aid, not Microsoft's own category. Showing the newest 200 of 345.