As local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough. Unlike static software, local agents such as coding assistants, command-line agents, desktop applications, and agentic development environments can operate on endpoints with access to a user's data, credentials, tools, and services. They can also connect to Model Context Protocol (MCP) servers that extend their access to additional tools and data. This change requires security teams to look beyond. They need to understand which local agents are running and where, which users and devices these agents are associated with, and which MCP servers these agents are configured to use.

To address this challenge, at Microsoft Build 2026, we introduced new Microsoft Defender capabilities to help security teams discover and protect more than 20 types of local AI agents. Today, discovery of AI agents and their configured MCP servers on Windows and macOS is generally available, with discovery coverage expanded to more than 50 supported agents and MCP servers. On eligible, onboarded devices, Defender discovers supported agents by observing their activity and brings the agent, device, account, and configured MCP context together to give security teams visibility for their local agent environment.

Beyond discovery, runtime protection for local agents for Windows continues to be available in preview, helping protect discovered agents as they operate. Teams can deploy runtime protection at scale from either the Microsoft Defender portal or the Microsoft Intune portal, with Intune-based deployment available in preview. Both discovery and runtime protection for local agents will be available for Microsoft Defender for Endpoint P2 and higher customers.

See the local agents and associated MCPs operating in your environment

In the Defender portal, security teams can see the discovered agents under Assets. The inventory associates each agent with the device and user account where it runs and includes details such as agent name, version, vendor, related process, and discovery history. Examples of supported local AI agents include:

• CLI agents: Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI
• Desktop applications: ChatGPT Desktop, Claude Desktop, Codex Desktop, GitHub Copilot app, Microsoft Copilot app, Ollama Desktop, Perplexity Desktop
• Agentic IDEs: Cursor, Devin Desktop, Kiro IDE, Antigravity IDE
• VS Code extensions: Claude Code, Cline, Codex, Gemini Code Assist, GitHub Copilot, Roo Code
• Claw-based agents: OpenClaw, Clawpilot, QClaw

We will continue expanding support for agents across both discovery and runtime protection. The supported agent list continues to evolve; see AI agent support matrix for the current list.

In addition, security teams can see supported local and remote MCP server configurations associated with discovered agents. Depending on the configuration, details such as the MCP server name, type, endpoint, or the command used to start a local server are visible, helping teams understand not only which agents are present, but also the tools and services those agents can access.

Assess exposure and investigate local agents

After discovering agents, security teams need to understand what those agents are connected to and what risk they may introduce. The exposure graph in Defender provides a clear visual of the agent’s blast radius including the agent associated devices, identities, and MCP context. These data sources can be used to investigate agent activity in advanced hunting, alongside the data from endpoints, identities, email, and cloud. Risk indicators and security recommendations are also available to help teams prioritize risks.

For ready-to-use queries, see Discover local AI agents with Microsoft Defender.

Secure local agents while they operate

AI agents are good for productivity, but they also undeniably introduce new security risks to organizations. For example, prompt injection can be hidden in a file, web page, repository, or tool response that an agent reads. If the agent follows an attacker’s instructions, the attacker could attempt to misuse the user's access, run unwanted commands, modify code, or expose sensitive information.

Defender inspects supported points in the agent loop and stops malicious instruction before an agent acts on them. When Defender detects prompt injection, it raises a suspicious AI prompt injection alert with agent and session context. Administrators can view detections and validate accuracy in audit mode, then move selected device groups to block mode for enforcement. In block mode, Defender can stop the action before it continues and notify the user in the agent experience and through Windows.

In preview, Defender currently supports runtime protection via agent-native event inspection and network inspection for discovered agents for Windows; coverage varies by agent and inspection approach.

• Agent-native event inspection (Hooks) uses vendor-supported event interfaces to inspect user prompts, tool requests before execution, and tool responses after execution.
• Network inspection extends protection to supported agents that don't expose an agent-native event interface by inspecting supported agent-to-model network flows.

Security teams can investigate agent-related threats in Defender with the rich context of existing endpoint protection, alerting, incident correlation, and investigation workflows.

Deploy runtime protection at scale

As local AI agent adoption grows, security teams need a scalable way to deploy runtime protection consistently across managed devices in the organization. In Defender, security teams can create a Windows policy, select the Microsoft Defender AI agent runtime protection profile and configure AI Agent protection settings with one of three values:

• Default: Runtime protection is disabled.
• Audit: Defender detects and reports prompt injection while allowing the supported agent action to continue.
• Block: Defender detects prompt injection and blocks supported agent actions before they run.

We recommend beginning with a limited group in Audit mode, reviewing detections for one to two weeks, and then moving to Block mode when your organization is ready to enforce protection.

In public preview, Microsoft Intune also provides a native AI agent runtime protection for Microsoft Defender endpoint security policies. Security teams can configure agent-native event inspection on enrolled Windows devices without relying on a custom deployment script. Now, security teams can choose either Microsoft Defender portal or Microsoft Intune portal to deploy runtime protection at scale.

For configuration requirements and deployment steps, see Set up AI agent runtime protection with Microsoft Defender for Endpoint.

To safely validate your configuration on a test device, see AI agent runtime protection demonstration.

Learn more:

• Microsoft Learn: Local AI agent discovery overview
• Microsoft Learn: Discover local AI agents with Microsoft Defender for Endpoint
• Microsoft Learn: Local AI agent runtime protection
• Microsoft Learn: Set up local AI agent runtime protection
• Microsoft Learn: Local AI agent support matrix

Every new threat raises a familiar set of questions. Is it targeting our industry? Are we exposed? What should we investigate first? 

Answering those questions takes more than another feed or a longer list of indicators. It takes intelligence that brings the relevant context together and helps your team understand which threats matter to your organization and where to investigate next. 

With the new Threat Intelligence experience in Microsoft Defender, we're bringing Microsoft threat intelligence, third-party sources, and your team's own insights together around the way you work. Threat Intelligence Overview helps you prioritize the threats most relevant to your organization. Threat Intelligence Explorer gives analysts a centralized experience to search, filter, and investigate the intelligence behind them. 

Focus on the threats that matter to your organization 

A threat can be significant globally without being your team's most urgent concern. Your industry, the regions where you operate, and what's happening in your environment all shape what deserves attention. 

Threat Intelligence Overview puts that context at the center of your starting page. The personalized dashboard brings the external threat landscape together with insights about your organization, highlighting relevant threats, their impact, and your exposure. 

You can focus on industries and regions of interest, see threats actively affecting your organization, and identify where a closer investigation is needed. For an analyst planning the day's research or a security leader reviewing emerging risks, the starting point is the same: what matters to us right now? From there, you can move into Explorer to examine the intelligence behind a threat. 

Bring Microsoft, third-party, and your own intelligence into the same investigation 

A Microsoft report may explain how an actor operates. A third-party feed may identify infrastructure associated with that activity. Your own team may have intelligence from a previous investigation. Each contributes a different part of the picture. 

Threat Intelligence Explorer lets you work with those sources together. Microsoft Research articles and indicators sit alongside connected third-party feeds and intelligence curated by your organization. 

Start with what you know: an actor's name, a CVE, a domain, or an IP address. Free-text search finds matching intelligence across the types and sources available to your organization. Refine the results by type, industry, geography, or source, then follow relationships to understand how individual findings fit together. 

Threat Intelligence Explorer covers indicators, threat actors, campaigns, attack patterns, tools, vulnerabilities, and reports. You can move from understanding a threat to examining its associated intelligence, then continue from an indicator's details into the relevant Defender entity page for deeper investigation. 

Follow a lead from relevance to investigation 

Suppose your team is researching Aqua Blizzard. The question is not simply what the actor does, but whether its activity should change your priorities. 

In Threat Intelligence Overview, you can review threats relevant to your industry and regions alongside available impact and exposure information. In Threat Intelligence Explorer, a search for the actor brings together matching intelligence from Microsoft, your connected feeds, and your organization's repository. 

From there, you can review a report, filter the results, and follow available relationships to associated intelligence. If an indicator warrants a closer look, continue into its Defender entity page to investigate further. 

As the picture becomes clearer, you can tag relevant records in your Threat Intelligence Platform and curate intelligence for the team. What began as a question about a threat actor becomes focused research, a deeper investigation where needed, and intelligence your colleagues can build on. 

Keep the intelligence you rely on 

Threat Intelligence Overview and Explorer replace the previous Threat Intelligence pages (Threat Analytics, Intel Management) with a personalized starting point and a shared investigation workspace. The Microsoft reports you rely on remain available in full detail (build on convergence of Microsoft Defender Threat Intelligence into Microsoft Sentinel and Defender XDR), and your existing intelligence carries over. 

The transition is designed to preserve existing threat intelligence capabilities, with the new experience bringing them together through Threat Intelligence Overview and Explorer. Customers with an eligible Microsoft Defender license can access the new experience. For details on eligible licenses, see Microsoft Defender XDR prerequisites. 

Learn more 

• Explore threat intelligence with Intel Explorer 

• Transition to the new Threat intelligence experience 

AI is transforming the attacker’s operating model, accelerating threats to unprecedented speed and scale. Yet many security operations centers still depend on fragmented data, tools, intelligence, and workflows. Analysts spend valuable time rebuilding context and coordinating action across systems, while the economics of operating the SOC become increasingly difficult to sustain. Security operations need a new operating model, one that brings protection and operations together and gives people and agents the shared context they need to defend at scale.

On September 23, 2026, Microsoft announced the public preview of Integrated Security Operations Center (ISOC) in Microsoft Defender. The ISOC benefit enables eligible Microsoft Defender Suite, Microsoft 365 E5 and E7 customers to unlock more value from their existing investments by bringing XDR, SIEM, threat intelligence, automation, and AI together in Microsoft Defender.

A new foundation for security operations

The ISOC benefit brings protection and operations together in Microsoft Defender, helping eligible customers get more from their Microsoft investments and build the foundation for agentic security.

Customers benefit from:

• Native threat protection: Microsoft Defender provides threat protection solutions across identities, endpoints, SaaS apps, email and collaboration tools, and cloud workloads.
• Integrated security operations: SIEM capabilities are now available out-of-the-box in Microsoft Defender, giving eligible customers access to security operations capabilities without requiring a traditional SIEM deployment.
• Built-in retention: Retention for eligible customers will extend from 30 to 90 days across all Microsoft Defender data, Azure Activity, and Office 365 Activity, starting November 15, 2026.
• Expand visibility: Starting October 1, eligible customers can expand visibility with more than 500 connectors, using a $2.40 per GB pay-as-you-go ingestion meter. Regional pricing and other terms may vary.
• Built for future: Bring signals, context, and workflows together in one integrated experience, establishing the foundation for agentic AI security that helps accelerate investigation and response, and improve security outcomes.

Start with Microsoft Defender data. Expand when you need to.

ISOC builds on the security data already available across Microsoft Defender and other select Microsoft sources, providing a rich, Microsoft-native foundation for integrated security operations. Supported Microsoft Defender log sources are automatically available without separate ingestion requirements. Eligible customers receive 30 days of included Microsoft Defender data retention in public preview, extending to 90 days starting November 15, 2026.

Data sources covered by this new benefit include:

• Microsoft Defender for Endpoint
• Microsoft Defender for Office 365
• Microsoft Defender for Identity
• Microsoft Defender for Cloud Apps
• Microsoft Defender for Cloud
• Microsoft Entra Identity Protection logs
• Azure Activity and audit logs, via connector
• Office 365 Activity and audit logs, via connector

Now in Public Preview

Starting today, eligible customers will begin seeing new security operations capabilities roll out in public preview, directly within the Microsoft Defender portal, with no additional configuration.  An ISOC workspace is required for broader data ingestion and workspace-dependent capabilities.

Out of the box capabilities include:

• Case management – The new Cases experience will help analysts accelerate investigations, streamline response, and improve cross-team coordination. The new Cases experience brings incidents, collaboration, task assignment, automation, AI-powered summaries, and governance into a shared workspace, enabling security teams to manage the entire incident lifecycle in one place. Read blog to learn more.
• Workbooks – Gain real-time visibility into your security operations with custom dashboards. Monitor threats, track trends, measure outcomes, and report on key performance indicators across analysts, SOC managers, and executives.
• Playbook generation in natural language – Use natural language to create and orchestrate automation workflows, helping teams move faster and reduce manual effort.

An ISOC workspace is required for broader data ingestion and workspace-dependent capabilities like UEBA, Content Hub connectors for additional data ingestion, repositories (CI/CD), and threat intelligence.

Additional security operations capabilities will be added to the ISOC benefit over time as they become available, giving organizations a simple path to start with what is built into Microsoft Defender and expand as their security needs evolve.

Frequently asked questions

1. Is ISOC a new Microsoft security product?

ISOC is not a new standalone product. It is a benefit that expands the value of your existing investments in Microsoft Defender Suite, Microsoft 365 E5 and E7 investments by bringing security operations capabilities from our SIEM solution, Microsoft Sentinel, directly into Microsoft Defender.

2. Is there a minimum seat requirement?

No. There is no minimum seat threshold for eligible licenses. Standard product terms apply.

3. What are the prerequisites to get started with ISOC?

Customers need an active, eligible Microsoft Defender Suite, Microsoft 365 E5 or E7 license. An Azure subscription is required to create an ISOC workspace and use workspace-dependent capabilities.

4. What is included in the ISOC benefit in public preview?

Starting September 23, eligible Microsoft 365 E5 and E7 customers without an active Sentinel workspace will receive:

• 30 days of included Microsoft Defender data retention, with 90 days planned for November 15.
• Out-of-the-box security operations capabilities including Case Management, Workbooks, and playbook generation in natural language.
• Additional Microsoft and non-Microsoft data ingestion via 500 connectors in Content Hub, UEBA, Repositories (CI/CD) and threat intelligence (requires an ISOC workspace).

5. When can I use the $2.40/GB PAYG ingestion meter?

Starting October 1, 2026, eligible customers can use the $2.40 per GB meter to ingest non-Microsoft data through more than 500 connectors. Regional pricing and other terms may vary.

6. What should customers who already use Microsoft Sentinel do?

There is no change for customers currently using Microsoft Sentinel. The current Microsoft Sentinel offering will continue to exist as is. Existing Microsoft Sentinel customers will have the choice to move to ISOC starting November 15, 2026, if they meet the relevant licensing eligibility criteria. 

Get started with ISOC in Microsoft Defender

Start with the capabilities available in Microsoft Defender, then create an ISOC workspace when your team needs broader data and workspace-dependent capabilities.

• Announcement blog: https://aka.ms/ISOCannouncement
• Learn more about ISOC in Microsoft Defender: https://aka.ms/ISOCDefender
• Get started with Case management: https://aka.ms/caseindefender
• Start using the security operations capabilities in Microsoft Defender: Documentation

Security work extends beyond the signal

Identifying a threat, exposure, or data risk is only the start. Security teams still need to assign ownership, bring together the right context, coordinate investigation and response, document decisions, track actions, and maintain accountability through resolution.

That work is not identical across organizations. Each team has its own responsibilities, processes, service-level commitments, and automation. Security teams need a work model they can adapt to how their organization operates, rather than forcing every security matter through a fixed workflow.

The operating model is also changing as AI agents take on more investigation and response work. Analysts, automation, and agents need a shared workspace where work can be delegated, reviewed, and advanced with the right context and human oversight.

Introducing the Case: the operational unit that brings together security context, people, process, automation, and actions to manage security work through resolution.

Introducing Case Management in Microsoft Defender

We are introducing Case Management in Microsoft Defender, starting with Incident Cases, your new home for incident response. Incident Cases bring together the familiar incident experience with powerful new case capabilities, combining alert correlation, response actions, workflow management, collaboration, automation, and lifecycle tracking in a single working experience. Incident Cases become the primary working entity for incident response in Microsoft Defender. They bring the context analysts rely on, including the attack story, alerts, affected assets, evidence, and response information, into the same workspace used to assign work, coordinate the response, track progress, and maintain the operational record.

Incident Cases build on the Defender Incident experience and the customer investments around it. The result is not a separate ticket layered on top of an investigation. It is one place to understand the security matter and drive the work required to resolve it.

One workspace for the complete response

Case Management expands the incident response experience around the work security teams need to perform, not only the information they need to review.

Adapt the workflow to how your organization operates

Security teams can shape Case records and lifecycle management around their operating model. Custom fields and custom statuses allow teams to capture organization-specific information and reflect their processes. SLA policies track targets such as acknowledgement, escalation, and resolution times based on attributes such as status, severity, and team.

Investigate, collaborate, and act in context

The Incident Case keeps the investigation context and operational workflow together. Analysts can work with the attack story, alerts, assets, and evidence while managing ownership, status, findings, comments, attachments and tasks from the same Case. Case creation and updates can also trigger automation and playbooks, helping teams apply consistent handling as work progresses.

Maintain accountability from creation through closure

Case activity provides a record of changes and actions throughout the lifecycle. Case data can also support reports and dashboards across lifecycle, ownership, status, severity, classification, and other Case attributes, giving security leaders greater visibility into how work moves through the organization.

VIDEO:  https://aka.ms/casedemovideo

Video 1. Analysts manage the Case lifecycle while retaining Defender investigation context.

Bringing protection and operations closer together

Case Management is part of Defender’s Integrated Security Operations Center (ISOC) experience, which unifies security operations across protection, investigation, and response. By bringing key SIEM capabilities like cases, workbooks, automation, and reporting together in one platform, Defender helps organizations strengthen security, improve operational efficiency, and build the foundation for agentic security. Learn more in the [ISOC announcement].

Designed for work shared by people and agents

Project Perception introduced Microsoft's direction for an agentic security system designed for the realities of AI. Case Management is a foundational component of that vision, providing a shared operational workspace where analysts and AI agents collaborate on the same security matter, with agent work connected directly to investigation context, workflow, and human oversight.

The first integration links agentic sessions to Incident Cases for the Investigation Agent workflow. From the Case, analysts can connect relevant agentic work to the investigation and see when a session requires human attention. The direction is to expand this approach to additional agentic playbooks and Case types over time.

As analysts delegate more work to agents, the Case can provide the shared context in which people, automation, and agents contribute to the same security outcome, with human review remaining part of the workflow.

Looking ahead, this foundation can extend to additional agentic playbooks and Case types—from exposure remediation to threat intelligence—while preserving the context, participants, and processes each workflow requires.

Built for a smooth transition from Incidents

Incident Cases are designed to preserve existing customer workflows and investments while introducing the Case experience.

• Existing Incident-based workbooks, workflows, automations, playbooks (logic apps), and integrations continue to function with Incident Cases.
• Existing Incident APIs continue to work on top of the Case schema. New Case-only properties are available through the Case API.
• Incident Cases use the existing Incident role-based access control model, with Incident permissions and scoping carried over to Cases.
• Each Incident Case has a one-to-one mapping with an Incident during this phase, and no manual migration or reconfiguration is required to begin using the Case experience.

Detailed compatibility and transition guidance are available in Microsoft Learn, including information for APIs, automation, reporting, permissions, and integrations.

Availability and get started

Incident Cases in Microsoft Defender will be available in public preview beginning September 23,2026.

To learn more and start using Case Management:

• Microsoft Learn: Case Management in Microsoft Defender
• Watch the Case Management demo
• Read the Integrated Security Operations Center (ISOC) announcement
• Read the Project Perception announcement

Many major breaches involve compromised identities, excessive privileges, or misconfigured access. Long before ransomware detonates or data leaves the building, adversaries are quietly abusing valid accounts, excessive privileges or other misconfigurations to move deeper into the environment. Identity has become one of the most important attack surfaces you defend.

That is why Microsoft has a dedicated team of researchers who study how identity attacks actually happen. Just as important, we turn what they learn into action. Real attacker behavior becomes concrete recommendations you can use to harden your environment before an attack begins. With Microsoft Defender, that research reaches you as Identity Security Posture Management (ISPM) recommendations: prioritized guidance that tells you what to fix, why it matters, and how to remediate it.

What are identity security posture recommendations?

Identity security posture recommendations are prioritized, attack-driven recommendations that address the weaknesses attackers exploit most, from overprivileged accounts to weak credentials and risky permissions. Rather than handing you a long hygiene checklist, ISPM recommendations tie each recommendation to a real attack technique. That shifts the question from "what setting do I need to change?" to "what attack am I going to prevent today?"

That framing also changes how you prioritize. You can start with the fixes that close the most dangerous attack paths first, not just the ones that are quickest to clear. It gives identity admins and the SOC and others shared view of the same risk, and as our researchers uncover new techniques, the recommendations evolve, so your posture keeps pace with the threat.

New recommendations

We are excited to announce five new ISPM recommendations geared toward emerging attack patterns you need to be aware of:

Ensure no privileged SaaS app accounts exist outside of IdP control

Most SaaS platforms let you create admin accounts directly inside the app, separate from your corporate identity provider (IdP). Those local admins are convenient, but they sit outside the protections every other identity relies on: No outside centrally managed identity controls as Conditional Access, and little to no monitoring. Attackers know it. We’ve seen a rise in SaaS data-exfiltration campaigns that specifically hunt for these app-native admin accounts, because once they find one they can sign in and operate without tripping any of your usual defenses.

This recommendation surfaces those accounts so you can bring them under your identity provider, where you can manage them with single sign-on, multifactor authentication, Conditional Access, and lifecycle governance apply automatically and where your SOC can finally see them.

This attack pattern aligns with MITRE ATT&CK techniques including Valid Cloud Accounts (T1078.004) and Account Manipulation (T1098).

Ensure service accounts are not assigned Domain Admin or Global Admin roles

Service accounts run your apps and integrations, and because they are not tied to a person, they are easy to over-provision and easy to forget. When one is assigned Domain Admin or Global Admin, it becomes a quiet path to the top of your environment. Supply-chain intrusions like SolarWinds showed how attackers ride a trusted service identity straight into the highest levels of access, often without anyone noticing, because no one watches a service account the way they watch a user.

This recommendation flags service accounts holding those top-tier roles so you can right-size them. It shrinks the blast radius if one is ever compromised and keeps a non-human account from becoming a hidden administrative backdoor.

This attack pattern aligns with MITRE ATT&CK techniques including Valid Accounts: Domain Accounts (T1078.002) and Cloud Accounts (T1078.004)

Ensure non-admin accounts cannot reset passwords for sensitive groups

Sometimes a standard user account quietly holds the ability to reset passwords for members of a sensitive group, a leftover of delegated permissions no one revisited. On paper that user is low privilege. In practice they are one password reset away from becoming an administrator. Attackers look for exactly this kind of shadow admin: compromise an unremarkable account, reset a privileged password, and walk in through the front door, no exploit required.

This recommendation finds those unintended password-reset rights over sensitive groups and helps you remove them, closing a direct path from ordinary user to full administrator.

This attack pattern aligns with MITRE ATT&CK techniques as Account Manipulation (T1098)

Ensure non-admin identities cannot have WriteDACL permissions on sensitive groups

Deep in Active Directory, some permissions can be abused to grant additional rights and gain control of a sensitive group. One of them, the right to modify an object's access control list (known as WriteDACL), is especially dangerous in the wrong hands. If a non-admin identity holds it over a sensitive group, that identity can simply rewrite the group's permissions and grant itself privileged control. It is one of the most reliable escalation paths attackers use.

This recommendation identifies non-admin identities with that permission over sensitive groups so you can strip it, eliminating a well-worn route from a regular account to Domain Admin.

This attack pattern aligns with MITRE ATT&CK techniques as Account Manipulation (T1098)

Ensure external and guest accounts are not granted privileged roles

Guest and external accounts make collaboration easy, but they live partly outside your control. Their security depends on another organization's hygiene, and they blend in, which makes them an attractive target. When one of these accounts is also granted a privileged role, a single compromise on the other side of that relationship becomes a privileged foothold inside your tenant.

This recommendation highlights external and guest identities holding sensitive roles so you can remove that access, preventing an outside account from being used for persistence, escalation, or reaching your data.

This attack pattern aligns with MITRE ATT&CK techniques as Valid Cloud Accounts (T1078.004) and Account Manipulation Cloud Roles (T1098.003)

Additional high-impact identity posture recommendations

In addition to the five new recommendations, several existing ISPM recommendations remain especially important. We continue to see attackers exploit the weaknesses they address, which makes them high-value fixes for strengthening your identity posture.

Here is why each one still earns priority.

Remove dormant accounts from sensitive groups

A privileged account no one uses is a gift to an attacker. It still carries powerful access, but because nobody signs into it, nobody notices when someone else does. Ransomware crews and intrusion groups seek out these forgotten admin accounts precisely because they can operate from one for weeks without raising suspicion. Removing dormant privileged accounts takes that stealthy, high-impact option off the table before it is ever used.

Reduce lateral movement path risk to sensitive entities

Reduce lateral movement path risk to sensitive entities helps close one of the most common ways identity attacks become domain-wide compromises: an attacker starts with a non-sensitive account, then follows permissions, group memberships, local admin rights, active sessions, or other identity relationships until they can reach highly sensitive credentials. This maps to well-known lateral movement and privilege escalation techniques, where adversaries abuse excessive permissions or exposed credential paths to move from an initial foothold toward Domain Admin or another high-value identity. This recommendation highlights exposed entities with risky lateral movement paths and provides remediation guidance to reduce the number of non-sensitive accounts on each path. By removing unnecessary privileges and memberships, teams can shrink the attack graph around sensitive entities and prevent a small compromise from becoming a privileged identity breach

Use least privileged administrative role

Use least privileged administrative roles in Microsoft Entra ID reduces the blast radius of a compromised admin account. In many identity attacks, adversaries first gain access through phishing, password spray, or stolen credentials, then abuse valid cloud accounts to escalate privileges, create persistence, or access sensitive data. This maps to the known attack technique Valid Accounts where an attacker uses a legitimate account’s assigned permissions instead of malware or exploits. Assigning narrow, task-specific admin roles instead of broad roles like Global Administrator limits what an attacker can do if that account is compromised and makes privilege escalation harder.

Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users

Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users reduces the window of opportunity after an admin session is stolen. This maps to known session-theft techniques such as Steal Web Session Cookie and Web Session Cookie, where adversaries use stolen authentication cookies to access cloud services as an already-authenticated user, sometimes bypassing MFA because the session was established before the theft. By requiring admins to reauthenticate more often and preventing persistent browser sessions, organizations make stolen sessions expire sooner and reduce the chance that a compromised admin browser session becomes long-lived access to sensitive systems.

Stay ahead of attackers

Attackers keep evolving, so your identity posture has to evolve with them. The strongest defense is not a one-time cleanup, it is continuously closing the gaps attackers depend on, from stolen credentials to excessive privilege and lateral movement. That is exactly what ISPM recommendations are built to help you do, turning live attacker research into clear actions you can take today.

In the Microsoft Defender portal, review your ISPM recommendations, start with the five new proactive exposures, and prioritize the highest-risk attack paths first. Every path you close is one an attacker cannot take.

Next steps

Start by reviewing your identity security posture recommendations in the Microsoft Defender portal under Exposure management > Recommendations. Prioritize recommendations that expose privileged identities, sensitive groups, service accounts, or attack paths to critical assets, then remediate unnecessary privileges, delegated permissions, and unmanaged identity access.

To explore your Microsoft Identity Security Posture Management (ISPM) recommendations, see: https://security.microsoft.com/exposure-secure-scores

Documentation

For more details as licensing and prerequisites, see:

Microsoft Defender for Identity security posture assessments - Microsoft Defender for Identity | Microsoft Learn

Microsoft Defender
Monthly news - August 2026 Edition

This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from July 2026. We are now including news related to Defender for Cloud in the Defender portal. For all other Defender for Cloud news, have a look at the dedicated Defender for Cloud Monthly News here. 

🚀 New Virtual Ninja Show episode:

• Redefining identity security for the modern enterprise
• One policy engine to govern them all: Securing agentic AI with Microsoft Purview
• Building a modern detection pipeline with ContentOps
• Securing local AI agents with Microsoft Defender
• Microsoft Defender: Extending critical protection for emerging threats in Team

Actionable threat insights (find all of them here)

• Email threat landscape: Q2 2026 trends and insights
• Enhancing AI security through global AI red teaming
• Least privilege for AI agents: Identity, access, and tool binding

Microsoft Defender

• (Public Preview) Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access, runtime activity, endpoint and user context, and active alerts. Security teams can use posture risk and recommendations to prioritize risky agents and improve agent security posture. For more information, see AI agent posture risk in Microsoft Defender.
• (Generally available) The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information, see Investigate a domain .
• (Generally available) With a Microsoft Agent 365 license, Microsoft Defender provides discovery, security posture, threat detection and investigation, and real-time protection for the AI agents in your tenant. Onboarding includes enabling data collection, connecting the Microsoft 365 app connector, and connecting Copilot Studio for real-time protection of Copilot Studio agents. For more information, see Protect AI agents using Microsoft Defender.
• (Generally available) Improved access to Playbook Generator: Following the GA release of Playbook Generator May 31st, the team focused on streamlining the onboarding experience and reducing friction related to Security Copilot wallet provisioning. Playbook Generator remains included with Microsoft Sentinel and does not consume SCUs for generating, testing, or running playbooks, yet customer feedback highlighted friction around Security Copilot wallet provisioning and initial setup requirements. The team worked on simplifying access and reducing onboarding barriers so organizations can more quickly take advantage of AI-assisted playbook creation, testing, and automation capabilities.
• For all other Sentinel News, have a look at the "What's new in Microsoft Sentinel blog post - July edition"

Identity Security

• (Generally available) Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x.
• Migration readiness reasons on the Sensors page: When a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see Troubleshoot "Not ready for migration" status.
• (Public Preview) Expanded SaaS app support in Password protection. The Password protection page now includes password risks from SaaS apps connected through Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce and ServiceNow, appear on the Password Hygiene and Password Policies tabs. Each SaaS app requires a Defender for Cloud Apps app connector. For more information, see Investigate identity password protection.

• Automatic RPC auditing on domain controllers: Defender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later. You no longer need to apply a tag manually to enable RPC auditing. For more information, see Configure RPC auditing.

Microsoft Defender Experts MDR

• General Availability of Microsoft Defender Experts MDR P2: Microsoft Defender Experts MDR (formerly Microsoft Defender Experts for XDR) is expanding with new third-party and multi-cloud coverage powered by Microsoft Sentinel, with the launch of Defender Experts MDR P2 service. Defender Experts MDR provides a 24/7 managed detection and response service that reduces noise, adds expert context, and drives action. In addition to the Microsoft Defender products, this new service supports key non-Microsoft sources across cloud (AWS), identity (Okta), email (Proofpoint), network (Palo Alto Networks, Cisco, Fortinet, ZScaler), and endpoint (CrowdStrike) that are ingested in Microsoft Sentinel, providing E2E visibility and protection for customers operating heterogenous environments. Defender Experts will continue expanding our scope to other non-Microsoft products to deliver on this promise. For more information, see the Microsoft Defender Experts MDR documentation.

Microsoft Security Exposure Management / Defender Vulnerability Management

• (Private Preview) Codename MDASH - Agentic code scanner is now available in private preview in Microsoft Security Exposure Management. Codename MDASH uses a multi-model agentic AI system to detect code vulnerabilities with greater depth and accuracy than traditional static analysis. Security teams can run scans from Defender CLI or through a GitHub connector, review findings in the Defender portal, and use results to help prioritize code security risks. For more information, see Agentic code security overview.
• (Private Preview) Codename MDASH - MAI-Augmented scan profile private preview. The MAI-Augmented scan profile is now available in preview as part of Codename MDASH. The MAI-Augmented profile can be used when triggering a scan through the Defender CLI. It includes MAI-Cyber-1-Flash, a new cyber-specialized model that extends the current agentic scanner in addition to the existing required models. Security teams can choose this profile when triggering a scan from Defender CLI or continue using a scan profile based on the existing models. For more information, see Scan with a scan profile.
• OT data connectors in Microsoft Security Exposure Management: Microsoft Security Exposure Management now supports operational technology (OT) data connectors for Armis, Dragos, and Forescout. OT data connectors bring OT asset and vulnerability data from supported third-party OT platforms into the Defender portal. This helps security teams view OT devices alongside other assets, enrich device inventory with OT context, and investigate vulnerabilities across IT and OT environments. For more information, see OT data connectors.

Microsoft Defender for Endpoint

• (Public Preview) AI agent runtime protection includes these enhancements: - Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI and the GitHub Copilot app. - Network inspection is now supported for agents that don't expose vendor-supported event interfaces, including OpenClaw and similar Node.js-based Claw agents. For more information, see AI agent runtime protection with Defender for Endpoint.
• (Generally available) Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation, supports custom installation paths, enables deployment of specific Defender versions from preferred update channels, and works seamlessly in environments that use local repositories. In addition to a simplified deployment experience, customers can now gain complete visibility into deployment progress through Device Timeline integration, providing step-by-step installation, upgrade, and onboarding status, Advanced Hunting queries for fleet-wide deployment monitoring, and detailed error reporting, including deployment stage, status, exit code, and failure reason to simplify troubleshooting. These capabilities help administrators quickly identify deployment issues, track onboarding progress, and understand deployment outcomes across their Linux estate. 

Microsoft Defender for Office 365

• Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations. Starting July 2026, new Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model by default. For more information, see Configure Unified RBAC for Defender for Office 365 and MC1246006.
• Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet.
• Prompt injection protection: Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Defender for Office 365.

What is CVE-2026-54121?

CVE-2026-54121 is an authentication-bypass vulnerability in Active Directory Certificate Services that allows an attacker to obtain certificates for arbitrary domain computer accounts, including Domain Controllers. A valid Domain Controller certificate enables escalation to full domain compromise: it can be used to obtain Kerberos tickets that authenticate the attacker as a Domain Controller. Those tickets can then be used to perform attacks such as DCSync, or to recover the Domain Controller's password hash for later use.

The flaw lies in an AD CS enrollment fallback known as a chase, which occurs when the CA cannot resolve the requester. In such cases, the vulnerable CA contacts a client-supplied Domain Controller, specified in the cdc attribute, to retrieve fresher identity data and incorporates the response into the issued certificate, without verifying that it is communicating with a legitimate Domain Controller. The chase fallback occurs only for templates that require a DNS name, and only on CAs with the EDITF_ENABLECHASECLIENTDC flag enabled.

A public proof of concept was released on July 24, 2026. Microsoft has not observed confirmed threat-actor exploitation, and the activity seen so far appears consistent with security testing. Organizations with affected AD CS configurations should apply the July 14 security update. Organizations should identify exposed Certificate Services hosts, confirm whether the required environmental conditions exist, enable the recommended AD CS auditing, and monitor for the suspicious authentication and certificate-enrollment activity described below.

More details about VCE-2026-54121 can be found here. 

What to do

The response follows a simple order: know your exposure, patch it, instrument it, and watch for the activity.

1. Identify affected systems

Certighost affects Windows Server 2012 through Windows Server 2025, including Server Core installations, but several conditions must all be present for a given environment to be exploitable:

• An Enterprise Certification Authority integrated with Active Directory
• Enrollment through the machine certificate template
• A default ms-DS-MachineAccountQuota value, or a machine account already controlled by the attacker
• Network reachability between the Certification Authority and the attacker's host over SMB and LDAP
• A valid domain account, with no administrative privileges required

2. Patch

The primary and durable remediation is the July 14, 2026 security update, applied to every AD CS host that runs an Enterprise Certification Authority. The update validates the lookup target before the Certification Authority contacts it, rejecting invalid or attacker-controlled targets before enrollment continues. Nothing else in this post replaces patching. The monitoring below gives you defense in depth and visibility, not an alternative to the fix.

3. Turn on AD CS auditing

The certificate request and issuance activity at the center of this attack is only useful to defenders if it is being recorded, and AD CS certificate services auditing is not enabled by default. With it on, the same events power detection and investigation across Microsoft Defender, and Kerberos authentication telemetry requires no additional configuration.

Organizations that have Microsoft Defender for Identity sensors installed on their AD CS servers and have completed the required sensor configuration can typically skip this step, as the necessary Certificate Services auditing settings are already enabled as part of the deployment prerequisites.

Enabling AD CS auditing takes two settings:

Turn on the Certification Services audit subcategory. Under Advanced Audit Policy, Object Access, enable success and failure for Certification Services. Set it through Group Policy, or with auditpol:

Set the Certification Authority audit filter. In the Certification Authority console this is the Auditing tab; it can also be set with certutil, followed by a service restart:

With both in place, the Certification Authority records Security log events for certificate lifecycle operations, including event 4886 when a certificate request is received and event 4887 when a request is approved and a certificate is issued. Each event captures the requester, the template used, and the request disposition. For Certighost, this is the record that makes the abuse visible: a certificate issued for a Domain Controller identity, requested through a machine template by a low-privileged principal, is an issuance pattern that should never occur normally, and these events let defenders detect it, investigate it, and correlate it with the PKINIT authentication and DCSync activity that follow.

For complete guidance, see Configure Windows event auditing — Microsoft Defender for Identity.

4. Watch for alerts

Attempts to exploit this vulnerability are detected by Microsoft Defender for Identity with the alert :

"Potential Certighost (CVE-2026-54121) AD CS abuse."

 The alert fires on the malicious certificate requests crafted to exploit this flaw, the anomalous issuance pattern at the heart of the technique, so you do not need to author a custom rule to catch the core activity. Ensure Defender for Identity is deployed on your domain controllers and AD CS servers and treat this alert as high priority.

Because the exploitation chain touches several stages of an identity attack, you may also see supporting alerts that commonly appear alongside this activity, though on their own they do not confirm a Certighost attempt:

• Security principal reconnaissance (LDAP)
• Suspicious Active Directory Certificate Services abuse tool activity
• Suspected suspicious Kerberos ticket request
• DCSync attack (replication of directory services)

Learn more

• CVE-2026-54121 — Security Update Guide, Microsoft (Active Directory Certificate Services Elevation of Privilege Vulnerability)
• Configure Windows event auditing — Microsoft Defender for Identity

To stay on top of the latest Defender for Identity capabilities, follow our What's New documentation page.

Beginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal, giving customers real-time Microsoft threat intelligence across detection, investigation, response, hunting, and automation at no additional cost. Announced last year, this unified SecOps experience reduces fragmented context and tool handoffs, creating a clearer path from threat signal to informed action.

Latest features converging

Entity enrichments: all the intel, right where you need it

Defender entity pages surface threat intelligence enrichments in the Threat Intelligence Insights tab for IP addresses, domains, URLs, and files. This unified view combines reputation data and scores, attributed reports, infrastructure relationships, services, certificates, DNS and WHOIS records, trackers, cookies, and sandbox analysis, helping analysts assess risk and investigate incidents without switching tabs. For more information, see View threat intelligence in entity pages.

MDTI Sentinel data connectors and APIs

Microsoft Threat Intelligence data that previously required the Premium MDTI connector is now available through the free Microsoft Threat Intelligence connector in Sentinel, enabling free and premium indicator feeds through one setup. MDTI APIs are also available by default to Microsoft Defender XDR and Microsoft Sentinel customers, without a separate MDTI license SKU, so teams can enrich investigations through Sentinel or external SIEM, SOAR, and automation tools.

As a reminder, the API surface remains unchanged, and no customer migration is required. Customers do not need to perform endpoint mapping, code changes, tooling changes, or cutover activities.

Features previously released

Threat Intelligence Library

Microsoft’s threat actor profiles, intelligence reports, OSINT articles, MSTIC and MTP research, and indicators of compromise (IoCs) are now available through Threat Analytics in the Defender portal, at no additional cost beyond the existing license.

Threat Analytics Enhancements

Reports now bring together embedded IoCs, MITRE ATT&CK mappings, targeted industries, actor origins, and automatic incident correlation, so defenders can move from reading intelligence to applying it in investigations.

Case Linking

Security teams can link investigation cases directly to relevant IoCs, making it easier to document findings, collaborate across response workflows, and show how intelligence informed action.

Reference the table below to see the full list of features available with the MDTI convergence into Microsoft Defender XDR and Sentinel.

Actions for existing MDTI customers

Starting August 1, the standalone MDTI pages (Intel Profiles, Intel Explorer & Intel Projects) will be retired. All MDTI capabilities will be accessible via the Threat Analytics tab in the Defender portal instead of the Threat Intelligence tab. No migration action is needed. Customers will now access the MDTI value via the Threat Analytics tab in the Defender portal instead of the Threat Intelligence tab. Explore our documentation for more details and reach out to your account team or partner if you need have questions or need assistance on how to reduce your current license and transition to this new unified threat intelligence experience in Defender XDR or Sentinel at no additional cost.

Get started

To access threat intelligence in the Microsoft Defender portal:

1. Go to the Microsoft Defender portal and sign in.
2. Use the Threat intelligence navigation menu to access Intelligence explorer and Intel profiles.
3. Investigate entities enriched with threat intelligence by selecting IP addresses, domains, URLs, or files from incidents, alerts, or search results.

Co-author(s): Amit Cohen and Hadar Shindler

Operational technology (OT) environments are unlike anything else in cybersecurity. The systems that run our factories, power grids, water treatment plants, pipelines, and transportation networks weren’t built with modern threats in mind — and they can’t simply be patched, rebooted, or scanned the way IT systems can. A misstep doesn’t just create an alert backlog; it can stop a production line, disrupt critical services, or put physical safety at risk.

To support customers in bringing their OT security solutions into their Security Operation (SOC) platform, we’re excited to announce an expansion of the Microsoft ecosystem with new OT security integrations from Dragos, Forescout, and Armis from ServiceNow. This gives customers greater flexibility to use the OT security solutions that best fit their environments.

Expanding OT coverage in Defender with new partner integrations

We’ve built new connectors for Dragos, Forescout and Armis that are now ready for customers to start using.

Dragos

"Strong OT defense starts with knowing what is running in your operational environment, the vulnerabilities those assets carry, the threats targeting your systems, and the data to determine root cause. That kind of intelligence comes from years of operating inside OT environments and tracking the groups behind those threats. As OT threats continue to grow and AI accelerates how quickly adversaries can approach the OT boundary, integrating Dragos into Microsoft Defender strengthens how organizations see, understand, and defend their OT environments."

-Robert M. Lee, CEO and Co-Founder, Dragos, Inc.

Forescout

"Our integration with Microsoft Defender represents a significant step forward in helping organizations defend their most critical operations against today's rapidly evolving cyber threats. By combining Forescout's industry-leading visibility and protection for IoT, OT, and network-connected assets with Microsoft's leadership in endpoint, identity, cloud, and security operations, we're delivering a more unified approach to cyber defense. Together, we're enabling healthcare providers, government agencies, critical infrastructure operators, and enterprises comprehensive visibility across IT and OT environments while empowering security teams to detect, investigate, and respond to threats faster and with greater confidence."

-Robert McNutt, Chief Strategy Officer, Forescout

Armis

“Fragmented security is no longer an option as threats to critical infrastructure evolve at machine speed. By deepening our integration with Microsoft, we are unifying visibility and context in complex OT and IoT environments. Integrating Armis Centrix™ with Microsoft Defender equips security teams with real-time, actionable insights to identify and mitigate risks across their entire operational footprint.”

-Nadir Izrael, Group Vice President, Armis from ServiceNow

Bringing OT and IT Security Together

With these new integrations, signals, asset inventory and vulnerabilities from Dragos, Forescout, and Armis from ServiceNow flow directly into Microsoft Defender — giving security operations teams a single, unified view across IT, OT, and IoT.

What this means for customers:

• Unified visibility across IT and OT. OT assets and vulnerabilities surface alongside IT signals in Defender, so the SOC can see and reason about them in one place.
• Cross-domain correlation. Identity, endpoint, cloud, and OT signals are correlated automatically.
• Streamlined investigation and response. Analysts can pivot from an OT detection to related IT activity (and back) without switching tools or losing context.
• Specialized depth, unified breadth. Customers keep the deep OT expertise of their chosen partner platform and gain the enterprise-wide coverage of Defender.

Let’s take a look at some of new the user experience updates that showcase these integrations.

Figure 1. Discovered devices by OT partner in device inventory

The Device Inventory now will show OT devices discovered through a new partner integration (see Figure 1). Industrial assets like substation relays and switches from vendors are automatically surfaced with rich context, criticality, vendor, model, firmware, and discovery source alongside built-in recommendations to classify critical assets and protect unmanaged OT devices. The result: unified visibility across IT and OT from a single view, so security teams can find, prioritize, and protect previously unseen devices faster.

Figure 2. Vulnerabilities and exposure across OT devices

The Vulnerabilities view now includes a dedicated OT Partner CVEs tab, surfacing thousands of vulnerabilities on operational technology devices discovered through partner integrations. Every CVE is enriched with severity, CVSS score, age, active threats, and exposed device count, and the list is sorted by exposure so the most widespread, highest-impact risks rise to the top. Most importantly, security teams can now see OT vulnerabilities alongside IT in a single, prioritized view, making it faster to focus remediation where it matters most.

Figure 3. Discovered devices exposed by OT integration

Selecting a CVE opens a detail panel with a dedicated Exposed devices discovered by OT partner tab, listing every affected device along with its OS platform and last seen date. For CVE-2024-7264, that means a clear view of all 75 exposed devices in one place, from OT controllers to sales workstations. The benefit is that security teams can move from a single vulnerability straight to the exact devices at risk, making it easy to scope impact and drive targeted remediation without leaving the view.

Figure 4. Discovered vulnerabilities by OT integration

Drilling into a specific device, like the Substation-North-HMI2 shown here, reveals a dedicated Discovered vulnerabilities by OT partner tab alongside the standard device views such as incidents, timeline, and security recommendations. It lists every vulnerability found on that device by the OT partner, complete with severity, CVSS score, publication and detection dates, and active threats. The benefit is a complete, device-level picture of OT risk right where analysts investigate, so they can see exactly what a single asset is exposed to and prioritize remediation without switching tools or context.

Built for customer choice and flexibility

We’re excited to expand our integration ecosystem, giving customers the flexibility to work with the OT solutions they already trust. These integrations help bring specialized OT context into broader security workflows, enabling SOC teams, risk managers, and security leaders to collaborate more effectively while using the tools that best fit their environment.

Get started

The Dragos, Forescout, and Armis integrations are available in public preview starting today. Customers can enable them through the Defender portal and begin ingesting OT signals from their partner platform of choice.

• Integrate the Dragos OT data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
• Integrate the Forescout OT data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn
• Integrate the Armis OT data connector in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn

Microsoft Defender
Monthly news - July 2026 Edition

This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from June 2026. We are now including news related to Defender for Cloud in the Defender portal. For all other Defender for Cloud news, have a look at the dedicated Defender for Cloud Monthly News here. 

🚀 New Virtual Ninja Show episode:

• Redefining identity security for the modern enterprise
• One policy engine to govern them all: Securing agentic AI with Microsoft Purview
• Building a modern detection pipeline with ContentOps
• Securing local AI agents with Microsoft Defender
• Microsoft Defender: Extending critical protection for emerging threats in Team

Weekly Security News: We publish a short 1ish minute video every week with updates across our Microsoft Security stack. Subscribe to our YouTube channel, so you don't miss the next episode. 

Actionable threat insights (find all of them here)

• Securing AI agents: When AI tools move from reading to acting
• Chromium extension uses AI‑related branding to redirect browser search
• Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Microsoft Defender

• Two Workbooks capabilities in the unified Microsoft Defender portal moved to GA:
  • Advanced Hunting connector - build custom dashboards directly on top of Advanced Hunting (XDR) dat. Query XDR tables and visualize them in Workbooks for richer investigations and reports.
  • Workspace filter / multi-workspace experience - scope and filter workbooks by workspace, with workspace selection integrated into the workbook itself rather than relying on the global selector.
• MTO Tenant Groups let MSSPs and large enterprises organize their multitenant view in Microsoft Defender by grouping tenants logically (e.g., by region, business unit, or customer cohort). Learn more here. 

• Custom Detections support in Microsoft Sentinel Repositories. Custom Detections can now be managed as code in Microsoft Sentinel Repositories, the same way customers already manage analytic rules, playbooks, parsers and workbooks. Detection engineers connect a GitHub or Azure DevOps repo to their workspace; Custom Detections placed in the repo are reconciled on every commit. A standalone Bicep path via the Microsoft Security Bicep extension lets teams deploy from any CI/CD pipeline (ADO Pipelines, GitHub Actions, custom runners).

• (General Availability) The following advanced hunting schema tables are now generally available:

  • The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by the organization's Defender for Cloud.

  • The CloudDnsEvents table contains information about DNS activity events from cloud infrastructure environments.

  • The CloudProcessEvents table contains information about process events in multicloud hosted environments.

• (Public Preview) The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use the AgentsInfo table today. The AIAgentsInfo table remains accessible until July 1, 2026. Update your queries to use AgentsInfo before this date. For more information, see Advanced hunting schema - Naming changes.

• For all other Sentinel News, have a look at the "What's new in Microsoft Sentinel blog post - June edition"

Identity Security

• (Public Preview) The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live. For more information, see Identity Security dashboard.

• (Public Preview) On the Coverage and maturity page, the Review and improve coverage side panel for SaaS Identities now includes an Observed column and a Show Only Observed Applications toggle. By default, the panel shows only SaaS applications detected in your environment. Turn off the toggle to see other supported SaaS applications you can onboard to expand your identity coverage. For more information, see Coverage and maturity.

• New alerts were added to the Defender for Identity security alerts related to Microsoft Entra ID, Active Directory as well as other identity providers. For a full list of those new alerts, check out our documentation.

• Recent ShinyHunters attacks on Salesforce show how OAuth tokens and connected apps are being weaponized to bypass MFA at scale. The upgraded Salesforce connector for Defender for Cloud Apps helps detect these attacks faster, with richer connected-app context and investigation-ready signals. Customers already using the connector are advised to enable the additional events in the Salesforce console for tighter protection, and eligible customers not yet using it are advised to connect Salesforce. Learn more.

Microsoft Defender for Endpoint / Microsoft Defender Vulnerability Management

• (Public Preview) Local AI agent discovery: as part of the Defender AI agents experience, Microsoft Defender now automatically discovers supported local AI agents running on onboarded Windows & macOS devices. Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization. For more information, see Discover local AI agents.

  AI Assets page

   

• (Preview) Local AI agent runtime protection on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and unsafe agent actions at the device level. Blocked and audited events appear as alerts in Microsoft Defender to support incident correlation and investigation workflows.

• The new version of the Defender deployment tool for Windows streamlines onboarding and enhances security by:

  • Bundling the onboarding package directly into the tool's executable.

  • Generating a key during deployment package creation that is required for running the tool.

  • Enabling users to configure an expiry date for the package to reduce the risk of unauthorized use.
    In addition:

  • You have the option of downloading the package as either an .exe or a .zip file, whichever best suits your organization's needs.

  • A new Deployment packages page in the Defender portal facilitates management of downloaded packages by providing centralized visibility into all the packages and their current status.

• Now generally available: Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection.

  Enable selective response actions

   

• The new exposure score model in Defender Vulnerability Management is now generally available. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. More details here. 

• Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface. This recommendation provides centralized visibility into internet-facing devices across the environment.

• Many predefined SaaS application classification rules were added to the critical assets list. Have a look at our documentation for the full list. These classifications require onboarding to Microsoft Defender for Cloud Apps.