2026-04
2026-04
This release tracker is LLM-curated and based on the official Microsoft product sources listed below. It provides an architect-grade summary of recent features, changes, and announcements. Always verify critical details against the official documentation. List of all raw markdown files for the releases are at https://github.com/pisinger/pisinger.github.io/tree/main/_ms_release_radar
Microsoft Security Release Radar - April 2026
📦 Azure Container Apps
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Defender for Cloud support for Azure Container Apps (Serverless Containers Posture) | Preview | Bring Azure Container Apps environments into Defender for Cloud’s Serverless Containers Posture experience for unified posture management. |
| 🟢 | Confidential Compute support on Azure Container Apps | GA | Run regulated containerized workloads with hardware-level isolation for data-in-use protection. |
| 🟢 | Monitor HTTP traffic in Azure Container Apps | GA | New ContainerAppHTTPLogs diagnostic setting category exposes detailed HTTP access logs for high-volume request data. |
| 🟢 | Additional OpenTelemetry destinations (New Relic, Dynatrace, Elastic) | GA | Enhanced OTel capabilities with expanded third-party observability platform endpoint options. |
| 🟢 | Override Scale Rules in Azure Functions on Azure Container Apps | GA | New allowScalingRuleOverride property lets customers override platform-managed KEDA scale rules. |
| 🟡 | Azure Container Apps Sandboxes | Preview | Run untrusted code safely in sandboxed environments for agentic apps, multi-tenant platforms, and CI/CD systems. |
🧱 Azure Container Instances
No updates for April 2026.
⛵ AKS
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔴 | CVE-2026-31431: Linux kernel algif_aead local privilege escalation | Security | Lets a pod escalate to root on the underlying node. Affects Ubuntu 20.04 FIPS, 22.04, 24.04, and Azure Linux 3.0. Mitigation in node image versions 202604.13.0 and 202604.24.0. |
| 🔴 | Ingress NGINX project retirement announced | Security | Maintenance ended March 2026. Production workloads supported through November 2026. Migrate to Gateway API implementation. |
| ⚫ | AKS Kubernetes LTS version 1.29 deprecated | Deprecation | Upgrade clusters to a supported version. |
| ⚫ | AKS Kubernetes version 1.32 moved to Long Term Support only | Deprecation | Use LTS support plan or upgrade to a supported standard-support version. |
| 🟡 | AKS-managed NAT Gateway V2 preview | Preview | New outbound type in supported public Azure regions. |
| 🟡 | Custom kube-reserved and hard eviction kubelet configuration preview | Preview | Customize default kubelet configuration through custom node preview feature. |
| 🟡 | AKS List Available VM SKUs API preview | Preview | View VM SKUs supported on AKS and available in your subscription. |
| 🟡 | AKS-managed GPU metrics in Azure Managed Prometheus | Preview | GPU metrics supported by default in Prometheus and Grafana dashboards. |
| 🟡 | Capacity Based Surge for node pool upgrades | Preview | Set MaxUnavailable and MaxSurge values with fallback behavior for capacity constraints. |
| 🟢 | Gateway API-based ingress for application routing add-on | GA | Generally available alternative to Ingress NGINX. |
| 🟢 | AKS Automatic clusters can migrate to AKS Standard in additional regions | GA | Managed system node pools can now migrate after adding a system node pool. |
| 🟢 | spec.minReadySeconds in Application Routing Gateway ConfigMap | GA | Reduces disruption during rolling upgrades with extra initialization time. |
| 🔴 | Istio CRD installer busybox registry fix | Security/Fix | Fixed issue where CRD installer could pull busybox from unintended registry in AGC environments. |
| 🔴 | AKS Automatic ClusterRoleBinding protection | Security/Fix | Blocks privileged ClusterRoleBinding create/update to reduce privilege escalation risk via service account impersonation. |
| 🔵 | Fixed empty PUT reconcile failures with CustomRouteTableInvalidUpdateAttempt | Fix | Resolved failures on clusters using bring-your-own route tables. |
| 🔵 | Artifact Streaming + Pod Sandboxing validation | Fix | Added validation to prevent enabling unsupported combination. |
| ⚫ | AKS 1.36 Automatic clusters preconfigured with Gateway API | Deprecation | New Automatic clusters will use Gateway API instead of Managed NGINX due to Ingress NGINX retirement. |
| ⚫ | Mesh Membership requires Managed Gateway API add-on | Deprecation | Clusters must have Gateway API enabled before joining an Azure Kubernetes Application Network. |
| ⚫ | HTTP Proxy Trusted CA limit of 20 certificates | Deprecation | Cannot add more than 20 Trusted CA certificates when using HTTP Proxy. |
| ⚫ | kube-proxy reduced privileges for K8s 1.30+ | Deprecation | kube-proxy uses NET_ADMIN and SYS_RESOURCE capabilities instead of privileged: true. |
| ⚫ | Fleet-managed resources via ClusterResourcePlacement | Deprecation | Fleet-managed resources deployed through managed namespace selection for separate rollout. |
| 🔵 | Azure Policy add-on updated to 1.16.1 | Update | Gatekeeper updated to 3.20.1-8 with CVE fixes. |
| 🔵 | Istio add-on revisions updated (asm-1-27, asm-1-28, asm-1-29) | Update | asm-1-29 available, asm-1-26 deprecated. |
| 🔵 | Azure Monitor Container Insights updated to 3.3.0 | Update | Updated container monitoring agent. |
| 🔵 | Node Auto Provisioning updated to Karpenter v1.10.2 | Update | Artifact Streaming uniformly disabled by default. |
| 🔵 | Application Routing NGINX updated to 1.13.9 | Update | Updated NGINX ingress controller image. |
| 🔵 | Azure Disk/File/Blob CSI drivers updated | Update | Multiple CSI driver versions updated across AKS versions. |
| 🔵 | Cloud-provider-azure components updated | Update | April 2026 releases for cloud-controller-manager, cloud-node-manager, health-probe-proxy. |
| 🔵 | Cilium updated to v1.17.10 | Update | Updated for K8s 1.32 and 1.33 to support Gateway API scenarios. |
⚡ Azure Functions
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Azure Functions support for Java 25 | GA | Develop and deploy apps using Java 25 on Linux and Windows, including Flex Consumption plan. |
| ⚫ | Azure Functions runtime v3 on Linux Consumption stops September 30, 2026 | Deprecation | Function Apps using runtime v3 will stop functioning. Migrate to runtime v4 or Flex Consumption. |
| 🟢 | Azure Functions supports MCP resource triggers | GA | Expose resources directly from Functions-hosted MCP servers for Python, TypeScript, .NET, and Java. |
| ⚫ | Python support on Azure Functions Windows retired March 31, 2027 | Deprecation | Python apps on Windows will stop running. Migrate to Linux before March 31, 2027. |
🔁 Azure Logic Apps
No updates for April 2026.
📊 Azure Monitor
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | OTLP ingestion options for container monitoring | Preview | Published and reorganized OpenTelemetry public preview documentation for container monitoring. |
| 🟡 | Service Level Indicators (SLIs) public preview | Preview | New article for Service Level Indicators public preview. |
| 🟡 | Performance Diagnostics configurable threshold values | Preview | New configurable threshold values feature in public preview. |
| 🟢 | Azure Monitor pipeline GA updates | GA | GA updates across pipeline documentation including TLS setup, transformations, sizing, troubleshooting. |
| 🟢 | Reliability guide for Azure Monitor Logs | GA | Comprehensive guide covering availability zone protection, workspace replication, data export, DR recommendations. |
| ⚫ | HTTP Data Collector API deprecation notices | Deprecation | Added deprecation notices with migration guidance to Logs Ingestion API. |
| ⚫ | Application Insights Classic API retirement dates | Deprecation | Updated with explicit retirement dates for Node.js and .NET SDKs. |
| 🔵 | Observability Agent documentation rewritten | Update | Four Copilot Observability Agent articles reorganized around common scenarios. |
| 🔵 | App Center migration guidance updated | Update | Clearer support-request steps and revised retirement timeline. |
| 🔵 | OpenTelemetry data collection guidance reorganized | Update | Task-based articles for data collection, resource detection, configuration, and enablement. |
| 🔵 | Java configuration guidance consolidated | Update | JMX metrics, sampling overrides, and telemetry processors in one article. |
| 🔵 | Connection strings guidance simplified | Update | Removed duplicate setup steps, points to main OTel configuration experience. |
| 🔵 | Logs Ingestion API documentation updated | Update | Migration guidance, workspace overview, and DCR cross-references added. |
| 🔵 | Summary rules documentation updated | Update | Thresholds corrected, parameter naming fixed, limitations section updated. |
| 🔵 | REST API Index restructured | Update | APIs organized into Azure Monitor, Application Insights, and Logs sections. |
☁️ Microsoft Defender Cloud Apps
No updates for April 2026.
🧠 Microsoft Copilot Studio
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Hold and resume for voice-enabled agents | GA | Pause mid-conversation and resume for more natural calling experience. |
| 🟡 | Real-time voice agents (Preview) | Preview | Build and deploy real-time voice agents with NLU, multilingual, knowledge integration, and voice tuning. |
| 🟢 | Automated agent evaluations via Power Automate connector | GA | Trigger agent evaluations automatically using Copilot Studio connector. |
| 🟡 | Automated agent evaluations from REST API (Preview) | Preview | Integrate evaluation into CI/CD and custom automation pipelines via Power Platform API. |
| 🟢 | Agent usage estimator | GA | Forecast Copilot credit consumption before deploying at scale. |
| 🟡 | Custom metrics for agent analytics (Preview) | Preview | Define custom analytics categories and visualize alongside built-in analytics. |
| 🟢 | Agent-to-agent (A2A) protocol connectivity | GA | Connect agents to other agents using the A2A protocol. |
| 🟡 | Display name suffix for agents (Preview) | Preview | Identify agents across environments in Teams and M365 Copilot using environment variables. |
| 🟡 | GPT-5.5 Reasoning (Deep) experimental model (Preview) | Preview | Experimental model for agents requiring deep analytical reasoning. |
| 🟢 | Analytics Viewer role | GA | Share analytics access without granting broader maker permissions. |
🔬 Defender Container Sensor
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Sensor v0.10.4 — Preview | Preview | Upgraded Go and dependencies to address security vulnerabilities and improve runtime stability. |
| 🟡 | Sensor v0.9.53 — Preview | Preview | Upgraded Go and dependencies to address security vulnerabilities and improve runtime stability. |
| 🟢 | Sensor v0.8.50 — GA | GA | Upgraded Go and dependencies to address security vulnerabilities and improve runtime stability. |
🚨 Microsoft Security Exposure Management
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | APIs with Sensitive Data classification rule | Update | New predefined Cloud resource classification for critical assets list identifying APIs containing sensitive data. |
🛡️ Microsoft Defender Cloud
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Defender for Containers runtime protection on EKS Bottlerocket | GA | Runtime protection now generally available for EKS Bottlerocket clusters. |
| 🟢 | Anti-malware detection and blocking | GA | Anti-malware detection and blocking is now generally available. |
| 🟢 | DNS Detection for Kubernetes | GA | DNS-based threat detection for Kubernetes is now generally available. |
| 🟢 | Defender for Storage integration in Azure portal Storage Center | GA | Integrated storage security in the Azure portal Storage Center experience. |
| 🟢 | Container security capabilities in Azure Government cloud | GA | Container security now available in Azure Government cloud. |
| 🔵 | Defender for SQL servers on machines plan update for Fairfax | Update | Updated plan for Fairfax (US Government) customers. |
🛡️ Microsoft Defender Unified SecOps
No updates for April 2026.
🎯 Microsoft Defender XDR
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | View action status in Activities tab (Preview) | Preview | Track automatic attack disruption and predictive shielding action status per incident. |
| 🟡 | AIAgentsInfo table expanded columns (Preview) | Preview | Deeper visibility into AI agents beyond Copilot Studio, including Foundry, third-party, and LOB agents. |
| 🟢 | Built-in alert tuning rules | GA | Suppress alerts from common benign activity in Defender for Endpoint and Defender for Office 365 without affecting AIR investigations. |
| 🟢 | Defender Experts navigation entry | GA | Dedicated Defender Experts entry in Defender portal navigation menu for consistent access. |
🔍 Microsoft Defender Endpoint
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Secure Boot 2023 certificate recommendation in Microsoft Secure Score | Preview | Identifies devices that haven’t transitioned to new Secure Boot 2023 certificates ahead of June 2026 expiration. |
| 🟡 | View action status in Activities tab (Preview) | Preview | Track automatic attack disruption and predictive shielding action status for Contain user, GPO hardening, Safeboot hardening. |
| 🟢 | Linux build 101.26032.0000 | GA | Release version 30.126032.0000.0 with expanded kernel module visibility and offline intelligence update optimization. |
| 🟢 | macOS build 101.26032.0016 | GA | Release version 20.126032.16.0 with bug and performance fixes. |
| 🟢 | macOS build 4.18.25040.1 | GA | Native root detection for Microsoft Defender now GA. |
| 🟢 | Windows Antivirus Platform 4.18.26030.3011 / Engine 1.1.26030.3008 | GA | March 2026 Windows Antivirus release. |
| 🟢 | macOS build 101.26022.0020 | GA | Resolved performance regression causing degraded responsiveness under high load. |
| 🟢 | macOS build 101.26022.0018 | GA | Bug and performance fixes including CVE-2025-68664/5 LangGrinch fix. |
💿 MDE Detailed Releases
Windows
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔴 | CVE-2026-41091: Microsoft Defender Elevation of Privilege Vulnerability | Security/Fix | Improper link resolution before file access (Important). Fixed in Engine 1.1.26040.8. |
| 🔴 | CVE-2026-45584: Microsoft Defender Remote Code Execution Vulnerability | Security/Fix | Heap-based buffer overflow (Critical). Fixed in Engine 1.1.26040.8. |
| 🔴 | CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability | Security/Fix | DoS vulnerability (Low). Fixed in Platform 4.18.26040.7. |
| 🔵 | Performance improvement for SFC cache build during engine reload | Update | Optimized SFC cache build performance during engine reload. |
| 🔵 | Reduced API calls for Device Control to prevent Entra throttling | Update | Reduced API calls and improved logging for Device Control. |
| 🔵 | Improved TVM Block logic handling | Update | Enhanced TVM Block logic processing. |
| 🔵 | Fixed TVM Warn temporary paths exclusion issue | Fix | Resolved issue when Tamper Protection Exclusions and DLAM are enabled. |
| 🔵 | Fixed Defender managed type when migrating from Co-management to Intune | Fix | Corrected managed type handling during migration. |
macOS
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Native root detection for Microsoft Defender | GA | Native root detection for Microsoft Defender is now generally available. |
| 🔵 | Bug and performance fixes (101.26032.0016) | Update | General bug and performance improvements. |
| 🔵 | Performance improvement and bug fixes (4.18.25040.1) | Update | Performance improvements alongside root detection GA. |
| 🔵 | Resolved performance regression under high load (101.26022.0020) | Fix | Fixed degraded responsiveness and stability under high load conditions. |
| 🔴 | CVE-2025-68664/5 LangGrinch (langchain vulnerability) (101.26022.0018) | Security | Fixed langchain vulnerability. |
| 🔵 | macOS >= 14 only packaging (101.26022.0018) | Update | Packaging now supports macOS 14 and later only. |
| 🔵 | Bug and performance fixes (101.26022.0018) | Update | General bug and performance improvements. |
Linux
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Expanded visibility into Linux kernel module (.ko) file activity | Update | Includes creation, rename, and deletion monitoring for kernel modules. |
| 🔵 | Offline security intelligence update optimization | Update | Updates now run at most once per configured interval, reducing redundant downloads during service restarts. |
| 🔵 | Resolved SELinux policy cleanup issue on RHEL-based systems | Fix | Ensures safe removal of legacy SELinux modules while preserving customer-defined policies during upgrades. |
🏢 Microsoft Entra ID
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Microsoft Entra Agent ID platform | GA | Identity and authorization framework for AI agents with OAuth 2.0, MCP, and A2A protocol support. |
| 🟡 | Account Discovery for connected applications (Preview) | Preview | Visibility into all accounts including orphan accounts within connected applications. Requires Entra ID Governance or Entra Suite license. |
| 🟡 | Entra ID federation with External ID (EEID) (Preview) | Preview | Let users sign in to customer-facing apps using existing workforce Entra ID identities via standards-based federation. |
| 🟡 | App-based branding via Branding themes (Preview) | Preview | Create different branding experiences for specific applications. |
| 🔵 | Migrate from Entra Connect Sync to Entra Cloud Sync | Update | Beginning July 2026, phased transition notifications. Cloud Sync replaces Connect Sync for identity synchronization. |
| 🔵 | SCIM provisioning apps to use modern authentication | Update | OAuth 2.0 Client Credentials and workload identity federation replacing Authorization Code grant. |
| 🟡 | $count filtering in sign-ins API (Preview) | Preview | Perform count computations directly in sign-ins API requests. |
| 🔵 | Workload identity-based auth for SAP SuccessFactors provisioning | Update | New authentication option starting May 2026 using Entra workload identity and short-lived tokens instead of static credentials. |
📊 Microsoft Fabric
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Stream Mirrored Database change feeds into Eventstreams (Preview) | Preview | Stream Delta CDF row-level changes from mirrored databases into Eventstream for low-latency event-driven processing. |
| 🟡 | Custom CA and mTLS support in Eventstream connectors (Preview) | Preview | Specify custom CA and client certificates from Azure Key Vault for Kafka-based sources and Schema Registry. |
| 🟢 | Eventstream SQL operator | GA | Production-ready code-first transformation operator with multiple destinations and event-time processing. |
| 🟡 | Customer Managed Keys (CMK) for Eventhouse (Preview) | Preview | Bring your own Azure Key Vault key to encrypt Eventhouse data at rest. |
| 🔵 | Stream SQL Change Events to Fabric Eventstream | Update | SQL Server 2025, Azure SQL DB, and Azure SQL MI push CloudEvents-formatted changes directly into Eventstream. |
| 🟡 | Eventstream workspace monitoring (Preview) | Preview | Automatic Eventhouse tables for per-minute data volume, watermark delay, backlog, and error metrics. |
🏗️ Microsoft Foundry
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Foundry Local model inference | GA | Production-ready local model inference on Windows, macOS Apple Silicon, and Linux x64. |
| 🟢 | GPT-5.5 model available | GA | Latest GPT-5 family model with default quota for Tier 5 and Tier 6 subscriptions. |
| 🟡 | Microsoft Agent Framework tracing (Preview) | Preview | Agent Framework agents emit OpenTelemetry traces into Foundry for debugging and production observability. |
| 🟡 | Hosted-agent tracing (Preview) | Preview | Hosted-agent sessions, tool calls, and run steps surface in Foundry traces. |
| 🟡 | CodeAct with Hyperlight (alpha) | Preview | Sandboxed Python code execution in Hyperlight micro-VMs for low-risk tool chains. |
| 🟡 | Continuous evaluation custom evaluators (Preview) | Preview | Bring code-based or prompt-based evaluators into continuous evaluation. |
| 🟡 | Agent Monitoring Dashboard (Preview) | Preview | Track operational metrics and evaluation results including token usage, latency, success rate, and evaluator scores. |
| 🟢 | Agent inventory in Foundry Control Plane | GA | Find supported agents across subscription from Operate view. |
| 🟡 | GPT-image-2 (Preview) | Preview | OpenAI’s latest image generation model with 4K resolution, editing, and up to 10 images per request. |
| 🟡 | Microsoft first-party AI models (Preview) | Preview | MAI-Image-2, MAI-Image-2-Efficient, MAI-Voice-1, and MAI-Transcribe-1. |
| 🟢 | Gemma 4 in Foundry catalog | GA | Google DeepMind’s open-weight models with multimodal input and up to 256K context. |
| 🟢 | Claude Opus 4.7 | GA | Anthropic’s most capable GA model with stronger instruction following and improved vision. |
| 🟢 | Microsoft Agent Framework 1.0 | GA | Unified multi-agent orchestration SDK for .NET and Python reaches GA. |
| 🟢 | Foundry Toolkit for VS Code | GA | Model playground, agent builder, and one-click deploy. |
| 🟡 | Batch evaluations for third-party agents (Preview) | Preview | Cloud-based batch evaluations against agents built on any framework. |
| 🟡 | Audio and image input in score model grader (Preview) | Preview | Evaluation graders accept audio and image content alongside text. |
| 🟢 | Notification center | GA | Tenant-level notifications with email delivery for critical alerts. |
| 🔵 | SDK & language updates | Update | Python/JS/TS beta agents, .NET 2.0 GA, Java streaming fix. |
🆔 Microsoft Defender Identity
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Identity Explorer (Preview) | Preview | Visualize identity attack paths and exposure scenarios as interactive graphs using hunting graph. Requires Sentinel Data Lake license. |
| 🟡 | Custom account correlation rules (Preview) | Preview | Link accounts belonging to the same identity using UPN prefix, suffix, or domain rules. |
| 🟢 | Automatic Windows event auditing configuration for sensors v3.x | GA | Streamlines deployment by automatically applying required auditing settings to new sensors and correcting misconfigurations. |
📱 Microsoft Intune
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Multi Admin Approval enforces on API calls by automation | Update | MAA now applies to Microsoft Graph API calls by service principals and automation scripts. HTTP 403 if approval headers missing. |
| 🔵 | EPM support approved elevation requests from all device users | Update | Expanded from primary user/enroller to all users of a device, improving shared device scenarios. |
| 🔵 | Configure credential manager permissions for Android Enterprise | Update | Control which apps act as system-level credential providers on Android 14+ managed devices. |
| 🔵 | Block location setting for Android Enterprise with three options | Update | Location setting now has Device default, Location enabled, and Location disabled options. |
| 🔵 | Access management for Apple services | Update | Configure service access for Apple accounts on organization-owned devices via ABM/ASM. |
| 🔵 | Userless ADE for visionOS and tvOS devices | Update | Enroll and manage Apple Vision Pro and Apple TV through ABM/ASM without user affinity. |
| 🔵 | Support for Ubuntu 26.04 LTS | Update | Ubuntu 22.04 LTS support ends August 2026. |
| 🟡 | Preview new device page in Intune admin center | Preview | Redesigned single device view with Device action status, Tools and reports, Properties, and Device details tabs. |
| 🔵 | Suspend and restore Managed Home Screen remote actions | Update | Temporarily suspend MHS on Android devices without removing policies or requiring PIN. |
| 🔵 | Updated minimum Intune Management Extension version (1.58.103.0) | Update | Devices on earlier versions no longer receive configurations or updates. |
| 🔵 | Autopatch update risk visibility report | Update | Classifies devices as Current, Exposed, or Critical with granular patch compliance insight. |
| 🔵 | Microsoft Edge v139 security baseline | Update | New settings, updated defaults, and retired settings. Existing profiles don’t auto-update. |
| 🔵 | Direct Android LOB app management | Update | Upload APK files directly to Intune without publishing to Managed Google Play for COBO and COSU devices. |
| 🔵 | New protected apps: Harvey AI, Continia Expense App | Update | Newly available protected apps for Intune. |
| 🟡 | Change Review Agent suggestions in Multi Admin Approval (Preview) | Preview | Risk-based recommendations for Windows PowerShell scripts directly in MAA experience. |
| 🔵 | Compliance policy reporting guidance | Update | Clarified reporting behavior for device check-in timing and user association. |
| ⚫ | Intune Data Warehouse (beta) connector retirement in Power BI | Deprecation | Transition to connector v2 or OData Feed connector. Transition starts April 20, 2026. |
| 🔵 | Support for Android XR devices | Update | Manage Android XR devices using Android Enterprise dedicated and fully managed enrollment modes. |
| 🔵 | New TeamViewer connector experience | Update | Replaces existing connector. Must migrate within 12 months to maintain functionality. |
📧 Microsoft Defender Office 365
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Promotions folder for bulk email (Preview) | Preview | Configure anti-spam policies to deliver bulk mail below BCL threshold to Promotions folder in supported Outlook versions. |
| 🟢 | Security Copilot email summary on Email entity page | GA | Generate AI summary of email entity data directly from Email entity page with Security Copilot subscription. |
| 🟢 | Remove users from Teams chats | GA | Remove internal users from Teams chats in Teams message entity panel is now generally available. |
| 🟢 | New RBAC permission for email content associated with alerts | GA | Granular Unified RBAC permission for analysts to preview/download email messages associated with security alerts. |
🔎 Microsoft Purview
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Collection policies support sensitivity labels as condition (Preview) | Preview | Scope detection to items with specific sensitivity labels for browser and network cloud apps. |
| 🔵 | Teams call logs retention policies | Update | New PowerShell-based retention policies for Teams call data records separate from chat retention. |
| 🟡 | Glossary migration and asset enablement (Preview) | Preview | One-time process to migrate glossary terms into Unified Catalog for centralized management. |
| 🟡 | Bulk import/edit/move for Unified Catalog (Preview) | Preview | Bulk create data products, critical data elements, glossary terms, and move terms between governance domains. |
| 🟢 | Advanced resource sets | GA | Now available to all customers with pricing consistent with classic data governance rates. |
| 🟡 | Data quality on-premises support for Oracle and SQL Server (Preview) | Preview | On-premises database scanning via Kubernetes-hosted runtime without data leaving premises. |
| 🟡 | Data quality thresholds with alerts (Preview) | Preview | Configure alerts for rule-level and data asset-level thresholds. |
| 🟡 | DLP URL contains text condition for unmanaged cloud apps (Preview) | Preview | Scope DLP rules to specific URLs or exclude URLs from policy enforcement. |
| 🟡 | Email notifications for browser and network DLP (Preview) | Preview | End-user email notifications with 10-minute batching window when activity is blocked. |
| 🟡 | DLP policy tip reference for Outlook mobile and macOS (Preview) | Preview | Reference article for DLP policy tips on Android, iOS, and macOS Outlook. |
| 🟡 | Proactive AI insights from DSPM (Preview) | Preview | Auto-creates and refreshes investigation every 24 hours with exfiltration risk counts across five categories. |
| 🔵 | Data Security Investigation Contributor role | Update | Auto-provides access to Compliance Administrator, Organization Management, Data Security Management, and Insider Risk Management role groups. |
| 🟡 | Sentinel with partner solutions for Varonis (Preview) | Preview | DSPM now supports Varonis for holistic Salesforce data insights. |
| 🟡 | CMK encryption for eDiscovery direct exports (Preview) | Preview | Customer-managed key encryption for exported investigation data at rest. |
| 🔵 | eDiscovery review set limit increased to 100 | Update | Maximum review sets per case increased from 20 to 100. |
| 🟡 | Advanced review set explorer (Preview) | Preview | New left navigation pane, KQL operators, sample queries, and Getting started tab. |
| 🟡 | Preview content while triaging Insider Risk alerts (Preview) | Preview | Identify false positives and confirm sensitive data presence before escalation. |
| 🟢 | Auto-labeling policies with label override for files | GA | Option to always override lower-priority labels even if manually applied, now extended to SharePoint and OneDrive files. |
| 🟢 | Sensitivity labels for user-defined permissions in Office for the web | GA | Apply labels configured for user-defined permissions while using Office for the web. |
| 🔵 | Label policies Export to CSV/Zip | Update | Export policy configuration for sensitivity labels and DLP policies. |
| 🟢 | Export policy configuration as ZIP | GA | Point-in-time snapshot of all DLP and sensitivity label publishing policies in XML format. |
🤖 Microsoft Security Copilot
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Security Analyst Agent (Public Preview) | Preview | Deep multi-step investigations across Defender and Sentinel telemetry to surface high-impact risks with prioritized insights and evidence. |
🔐 Microsoft Sentinel
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Account Name now consistently UPN prefix for analytics rule alerts | Update | Update automation by July 1, 2026. Account Name will always be UPN prefix only. New UPN-related fields added. |
| 🟡 | Microsoft Sentinel data federation (Preview) | Preview | Analyze security data in-place from Fabric, ADLS, and Databricks without copying, using KQL, notebooks, and custom graphs. |
| 🟡 | Transform data with filter and split features (Preview) | Preview | Reduce noise before ingestion, control costs, and route data between analytics and data lake tiers. |
| 🟡 | VS Code connector builder agent (Preview) | Preview | AI-powered low-code agent to build Sentinel connectors in minutes. |
| 🟡 | Build custom security graphs (Preview) | Preview | Tailored graphs across Sentinel data lake and third-party data to uncover attack paths and blast radius. |
| 🟢 | Entity analyzer | GA | Out-of-the-box explainable entity risk assessments for URLs and identities. Charged for SCUs starting April 1, 2026. |
| 🟢 | AI-powered SIEM migration tool | GA | Accelerate migrations from Splunk and QRadar with AI-assisted experience. |
| 🟡 | Cost estimation tool (Preview) | Preview | Guided meter-level cost estimator with three-year projections for data growth and spend planning. |
| 🟡 | Row-level access using Sentinel scoping (Preview) | Preview | Row-level RBAC to control data access without workspace separation. |
Top 5 Action Items
| Priority | Action | Due | Affected Product(s) |
|---|---|---|---|
| 🔴 | Apply AKS node image upgrade to versions 202604.13.0+ to mitigate CVE-2026-31431 (Linux kernel LPE) | Immediate | AKS |
| 🔴 | Apply Windows Defender Antivirus Engine 1.1.26040.8 to fix CVE-2026-45584 (Critical RCE) and CVE-2026-41091 (Important EoP) | Immediate | Defender Endpoint |
| 🔴 | Migrate from Ingress NGINX to Gateway API-based ingress before November 2026 | November 2026 | AKS |
| 🔴 | Update Sentinel automation rules and Logic Apps to use UPN prefix/suffix instead of full UPN for Account Name | July 1, 2026 | Sentinel |
| 🔴 | Migrate Azure Functions runtime v3 on Linux Consumption to v4 or Flex Consumption | September 30, 2026 | Azure Functions |
Security Architect Observations
- AKS CVE-2026-31431 (algif_aead LPE) is the highest-severity item this month — any pod (including non-root, no special capabilities) can escalate to node root. Existing nodes are not patched in-place; node image upgrade or DaemonSet mitigation is required. Combined with the Ingress NGINX retirement, AKS tenants face two concurrent migration pressures that should be sequenced carefully.
- Three CVEs in Microsoft Defender Antivirus (one Critical RCE CVE-2026-45584, one Important EoP CVE-2026-41091, one Low DoS CVE-2026-45498) require immediate engine/platform updates. The heap-based buffer overflow (RCE) is particularly concerning for environments where Defender processes untrusted files.
- Entra Connect Sync to Cloud Sync migration begins July 2026 with phased notifications. Organizations with complex sync configurations (large directories, advanced features) will be in later waves, but should begin readiness assessment now. The SCIM modern auth and SAP SuccessFactors workload identity changes add to the identity modernization roadmap.
- Sentinel Account Name consistency change (UPN prefix only by July 1) will break automation rules and playbooks that use full UPN equality checks. This requires a systematic audit of all downstream automation before the deadline.
- Purview auto-labeling with override now extends to SharePoint and OneDrive files, enabling mandatory label application even over manually applied lower-priority labels. Review existing label policies to prevent unintended overrides in sensitive data environments.
Security Operations Observations
- Defender XDR built-in alert tuning rules (GA) reduce noise from common benign activity in Defender for Endpoint and Office 365 without affecting AIR investigations — review and enable to improve SOC efficiency.
- Security Analyst Agent in Security Copilot (Preview) performs multi-step investigations across Defender and Sentinel — evaluate for Tier 1 triage automation to reduce mean-time-to-respond.
- Defender for Identity Identity Explorer (Preview) provides interactive attack path visualization — useful for proactive lateral movement and privilege escalation discovery, but requires Sentinel Data Lake license.
- MDE Linux kernel module visibility expanded to include creation, rename, and deletion events — update detection rules to cover kernel module file activity as a potential rootkit or persistence indicator.
- Purview DSPM proactive AI insights auto-generate daily investigations with exfiltration risk counts — integrate into existing data security monitoring workflows for continuous sensitive data exposure visibility.
- Intune Multi Admin Approval now applies to API automation — service principals and scripts modifying Intune resources will get HTTP 403 without approval headers. Update automation scripts or use the Exclusions tab to prevent operational disruption.
References
This post is licensed under CC BY 4.0 by the author.