Instead of building a full Logic App or playbook, you can select a trigger and attach a predefined action directly in Defender.
Some of the available capabilities include:
◈ Trigger automation when a case is created or updated
◈ Send case creation / update email notifications
◈ Automatically update case properties
◈ Create investigation tasks
◈ Update alerts directly from the automation workflow
This removes an important deployment dependency and can significantly simplify Defender for Identity adoption in environments where MDE isn't deployed on Domain Controllers.
For these new server roles, manual activation and automatic Windows event auditing are supported, while automatic activation and migration are not yet supported during Preview.
This capability allows MDE to inspect process memory for known malicious behaviors and memory-resident threats — particularly useful against attacks that leave little or no footprint on disk.
Memory Scan adds another layer of detection and protection against techniques such as:
• In-memory malware
• Malicious code injection
• Memory-resident threats
• Advanced attacks designed to minimize disk artifacts
Baseline security settings are providing centralized view of Microsoft-recommended security settings across:
- Microsoft Entra ID
- Exchange Online
- SharePoint & OneDrive
- Microsoft Teams / Room devices
The goal is straightforward: reduce the attack surface by identifying configurations that don’t meet minimum security.
Before enabling a setting that could potentially break a legacy application or business workflow, administrators can generate an impact report and identify affected users or dependencies.
Generate impact report → Review dependencies → Enable the security control.
You can find it under:
Microsoft 365 Admin Center → Settings → Org settings → Security & privacy → Baseline security mode
As of August 1, 2026, Microsoft Threat Intelligence APIs in Microsoft Graph are available to customers with Microsoft Defender XDR and/or Microsoft Sentinel licensing. No separate Microsoft Defender Threat Intelligence API license is required.
This means we can bring Microsoft Threat Intelligence directly into SOC investigation and response workflows instead of keeping threat intelligence as something analysts only consume manually in the portal.
The available playbooks cover enrichment scenarios such as:
🔹 Automated triage
🔹 IP/domain reputation enrichment
🔹 Passive DNS
🔹 Reverse DNS
🔹 Web components
🔹 Trackers
🔹 Cookies
The playbooks use Microsoft Graph to query threat intelligence data and can authenticate using Managed Identity with the ThreatIntelligence.Read.All application permission.
Microsoft has introduced a new Audit Mode for Microsoft Defender Antivirus on Linux.
Until now, the main operating modes were Passive and Real-Time Protection. The new Audit Mode provides an additional option between the two.
What does Audit Mode do?
In Audit Mode, Microsoft Defender Antivirus:
- Performs real-time malware detection
- Generates security alerts
- Does not automatically quarantine malicious files
- Does not automatically terminate malicious processes
This can be useful when you want to evaluate Defender’s detection capabilities and understand the potential impact before enabling full Real-Time Protection.
Fortinet FortiGate — 40+ new behaviors
Sentinel can now analyze FortiGate events from CommonSecurityLog and identify behaviors such as:
• Rapid system reconfiguration
• Configuration backups
• Certificate changes
• Security service disruptions
Expanded anomaly detection
New UEBA anomaly detection capabilities extend coverage to:
• Check Point
• Fortinet FortiGate
• Zscaler
• AWS GuardDuty
For Check Point, Fortinet, and Zscaler, Sentinel introduces new anomaly rules that analyze firewall, VPN, and web proxy activity.
Instead of relying only on static detection logic, UEBA can compare activity against historical user/device behavior and organizational patterns to identify potentially suspicious deviations.
⚠️ Important: To use extended UEBA capabilities, Microsoft Sentinel workspace must be onboarded to the Microsoft Defender portal as part of the Unified Security Operations experience.
Microsoft has officially announced a major authentication change that every Microsoft Entra administrator should be preparing for.
Key milestones:
September 1, 2026 – Passkeys become the default authentication experience. Users relying on SMS or voice authentication will begin receiving prompts to register a passkey during MFA.
February 1, 2027 – Microsoft-provided SMS and Voice authentication will be fully retired. Organizations that continue to rely on Microsoft’s SMS or voice delivery without a customer-managed telecom provider risk authentication disruptions.
What should IT teams do now?
- Identify users still using SMS or Voice authentication
- Roll out Microsoft Authenticator, Windows Hello for Business, FIDO2 security keys, or Passkeys
- Educate users and start a phased migration well before the deadline
- If your organization has regulatory or operational requirements to keep SMS/Voice, evaluate customer-managed telecom providers available through the Microsoft Security Store before February 2027 (info will be on 18.09.26)
The earlier you start your migration, the smoother the transition will be for both administrators and end users.
Docs: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement
Also, there is option to opt-out for 1st of September. Microsoft added additional filter for identifying who is using SMS or voice call as primary 2FA method.
Microsoft has introduced Controlled Configuration for MDE. The main idea is to establish a cloud-managed source of truth for supported Microsoft Defender Antivirus settings. When enabled, policies delivered through Intune or Defender security settings management take precedence over settings configured via:
The goal is to eliminate configuration drift in environments where Defender has historically been managed through multiple channels.
Currently covered:
Not covered (yet):
Microsoft is rolling out Threat Intelligence Insights directly within the Microsoft Defender portal, bringing premium external threat intelligence closer to the analyst workflow.
This includes such insights like:
▪Reputation assessment
▪WHOIS information
▪DNS resolutions
▪Threat reports and attribution
▪Infrastructure details (trackers, cookies, certificates, and more)
Simply search for a URL, domain, IP address, or file hash in Microsoft Defender XDR, open the entity page, and review the new Threat Intelligence Insights.
Starting September 1, 2026, passkeys will become the default authentication experience in Microsoft Entra.
At the same time, Microsoft will begin phasing out its Microsoft-managed SMS and voice authentication services in favor of more secure, phishing-resistant authentication methods.
By January 28, 2027, Microsoft-provided SMS and voice authentication will be fully retired. Organizations that still require these methods will need to configure a supported telecom provider through the Microsoft Security Store.
Key milestones:
📅 September 1, 2026 – Passkey rollout begins, users will be prompted to register passkeys during MFA sign-in, and registration campaigns will be enabled for eligible tenants.
📅 October 30, 2026 – Organizations can select supported telecom providers if they want to continue using SMS or voice authentication.
📅 January 28, 2027 – Microsoft-managed SMS and voice authentication is retired, and passkeys become the recommended default authentication method.
What should IT admins do now?
✅ Review your Authentication Methods policy in Microsoft Entra.
✅ Start educating users and rolling out passkeys.
✅ Identify applications or processes that still rely on SMS or voice MFA.
✅ Plan your migration well before the retirement deadline to avoid disruption.
This is another major step in Microsoft’s passwordless journey, helping organizations reduce phishing risks while improving the user sign-in experience.
📖 Docs: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement
Microsoft has introduced the Agent 365 connector in public preview, bringing AI agent activity telemetry directly into Microsoft Sentinel.
Also, there is Microsoft Agent Identities (preview) Data Connector
With the new connector, security teams can monitor, hunt, and investigate AI agent activity using familiar Sentinel workflows. The telemetry is streamed into the Sentinel data lake, helping analysts correlate AI agent behavior with identity, endpoint, cloud, and other security signals.
Key capabilities include:
Try it out! 😄 Solution could be installed from Microsoft Sentinel Content Hub.
Did you know that Microsoft Authenticator authentication method policy has additional security-related settings?
✅ Show application name in push and passwordless notifications
✅ Show geographic location in push and passwordless notifications
However, by default their status are set to Microsoft managed, which means settings are in disabled state. 😄
From a security perspective, enabling these settings is a simple but valuable improvement. It gives users more context before approving a sign-in request and can help reduce the risk of MFA fatigue or accidental approval.
Recommendation: Change both settings from Microsoft managed to Enabled.
When Defender identifies a high-confidence active attack, it can automatically isolate the affected device from the network while still maintaining communication with Microsoft Defender for Endpoint.
This helps reduce:
Instead of only generating alerts and incidents, Defender XDR can take automated containment actions during an active attack chain. That gives analysts more time to investigate, validate scope, and perform remediation while the affected endpoint is already contained.
Recommended SOC actions:

Microsoft has introduced Custom Data Collection in Defender for Endpoint, allowing security teams to collect additional, targeted endpoint telemetry beyond the default configuration.
Why this matters?:
The collected data can then be analyzed in Microsoft Sentinel using dedicated custom event tables like:
One important note: this requires dynamic device targeting and a connected Microsoft Sentinel workspace. Added some example as well
Am I'm the only one or SigninLogs table ConditionalAccessPolicies is currently showing [] for all entries, also Conditional Access Insights and reporting for "report-only" are empty..
I don't see any official health issue from Microsoft.
A simple KQL query against Sign-in logs gives you visibility into the MFA methods users are actually using:
SigninLogs
| where TimeGenerated > ago(90d)
| where ResultType == 0
| mv-expand AuthDetails = todynamic(AuthenticationDetails)
| extend AuthMethod = tostring(AuthDetails.authenticationMethod)
| where isnotempty(AuthMethod)
| where AuthMethod !in ("Previously satisfied")
| summarize AuthEvents = count(), Users = dcount(UserPrincipalName) by AuthMethod
| order by AuthEvents desc
Microsoft Defender XDR now provides visibility into devices that still need this update, making it easier to track readiness and reduce exposure across the environment.
Exposure Management → Recommendations → Devices → Misconfigurations (good adjustment if you have also Windows Servers onboarded to Defender for Endpoint P2)
