2026-08
2026-08
This release tracker is LLM-curated and based on the official Microsoft product sources listed below. It provides an architect-grade summary of recent features, changes, and announcements. Always verify critical details against the official documentation. List of all raw markdown files for the releases are at https://github.com/pisinger/pisinger.github.io/tree/main/_ms_release_radar
Microsoft Security Release Radar - August 2026
Summary of security-relevant product releases, updates, patches, and deprecations across the Microsoft security stack for August 2026. Classification follows the authoritative
<!--status:CLASS-->markers in the source notes; priority reflects impact on security posture and operations.
🔐 Microsoft Sentinel
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | New data sources for UEBA behaviors and anomaly detection | Preview | Adds Fortinet FortiGate behaviors from CommonSecurityLog (40+ behaviors mapped to MITRE ATT&CK T1685, T1070, T1078, T1602.002), plus Check Point, Fortinet, Zscaler, and AWS GuardDuty anomaly rules with geo/ISP/threat-intel enrichment. |
| 🟡 | UEBA anomalies on behaviors | Preview | Adds contextual anomaly insights directly to UEBA behavior records (first-seen activity, high volumes, uncommon values, threat-intel matches) to reduce manual correlation. |
| 🔵 | SAP solution releases | New/Updated | SAP agentless v1.1.12 audit log performance and force-sal-filesystem; SAP BTP v3.1.1 adds a rule for unaudited custom apps and renames rules with SAP BTP prefix; SAP LogServ v3.0.5 enables ASIM content for RISE with SAP. |
🛡️ Microsoft Defender Cloud
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Update to CVE details data consumption in Azure Resource Graph | New/Updated | CVE details now consumed via microsoft.security/cvedetails resource type for better performance and scale; existing queries reading CVE details from VA records must be updated or may not return detailed properties. |
| ⚫ | Classic Defender for SQL APIs retirement | Deprecation | Classic Vulnerability Assessment and Advanced Threat Protection APIs retire August 16, 2027; migrate to the supported configuration model and update dependent scripts/automation. |
| 🔵 | On-demand malware scanning supports specific blobs, files, containers, and file shares | New/Updated | Defender for Storage on-demand malware scanning can now be scoped to a single blob/file, container/file share, or path prefix via REST API filters instead of scanning the whole account. |
| 🔵 | Breaking change: Unused actions no longer included in AWS and GCP overprovisioned identity assessments | New/Updated | Defender for Cloud CIEM no longer computes or displays the Unused actions list for AWS/GCP overprovisioned identity recommendations; use native AWS IAM and Google Cloud IAM tools for permission-usage validation. |
🔍 Microsoft Defender Endpoint
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Tamper protection in audit mode for Linux | Preview | [Linux] Detects and alerts on unauthorized modifications to Defender configs, files, directories, processes, and services (including by root) without blocking; available in Linux version 101.26072.0004+ (Insiders-slow). |
| 🟡 | Antivirus audit mode for Linux | Preview | [Linux] Real-time malware detection and alerting without auto-quarantine or process termination, letting teams evaluate efficacy before enforcing; Linux version 101.26062.0007+. |
| 🟢 | Offboarding API support for Linux | GA | [Linux] Automates offboarding of Linux servers via the Offboard machine API; Linux version 101.26062.0007+. |
| 🟢 | macOS release Build 101.26062.0012 | GA | [macOS] Release version 20.126062.12.0 shipped with bug and performance fixes. |
| 🟡 | Vulnerability assessment for Microsoft Store applications | Preview | Monitors vulnerabilities in Microsoft Store apps (Teams, Firefox, WhatsApp, Slack, Dropbox, and others) with software evidence showing file path and a suggested query. |
| 🟢 | macOS release Build 101.26062.0011 | GA | [macOS] Release version 20.126062.11.0 shipped; expanded local AI agent discovery (Preview) to include MCP server configurations. |
💿 MDE Release Notes
Windows
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Windows Antivirus platform 4.18.26080.3 / engine 1.1.26080.3 | New/Updated | [Windows] Defender Antivirus update adding health monitoring where Cisco Umbrella affects Network Protection and hardening against unauthorized network authentication credential exposure. |
| 🔵 | Fixed BitLocker encryption-state detection | New/Updated | [Windows] Fixed detection when encrypted volumes have no drive letter. |
| 🔵 | Fixed stuck platform updates | New/Updated | [Windows] Fixed platform updates that could remain stuck when the staging folder for the update was purged. |
| 🔵 | Fixed increased disk I/O from cleanup failure | New/Updated | [Windows] Resolved increased disk I/O when cleanup failed because the shared signature root location contained whitespace. |
| 🔵 | Fixed AMSI path exclusions | New/Updated | [Windows] Fixed path exclusions for AMSI scans when local memory-scan exceptions are enabled. |
| 🔵 | Fixed ASR warn unblock prompt | New/Updated | [Windows] Fixed the ASR warn unblock option that didn’t prompt users for admin approval. |
macOS
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | macOS 101.26062.0012 release | New/Updated | [macOS] Bug and performance fixes in release version 20.126062.12.0. |
| 🔵 | Expanded local AI agent discovery for MCP servers | New/Updated | [macOS] Expanded preview local AI agent discovery to include visibility into Model Context Protocol (MCP) server configurations in release 101.26062.0011. |
Linux
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Fixed long-running on-demand antivirus scans | New/Updated | [Linux] Resolved on-demand scans (quick, full, custom) taking longer than expected or appearing unresponsive; protection remained unaffected. |
| 🔵 | Engine signature verification enabled by default | New/Updated | [Linux] Defender now verifies the engine’s digital signature before loading and skips engines that fail; legacy engine signature verification settings are deprecated. |
| 🔵 | Fixed mdatp health offboarding status | New/Updated | [Linux] Resolved mdatp health incorrectly reporting a device as healthy after offboarding. |
| 🔵 | Reliability and quality improvements | New/Updated | [Linux] General reliability and quality improvements in release 101.26062.0007. |
🔬 Defender Container Sensor
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Sensor v0.11.6 | GA | Released August 2026 with security vulnerability fixes and dependency updates (deployed by Helm or Arc for K8s). |
| 🟢 | Sensor v0.11.5 | GA | Released August 2026 with improved pod inventory reliability on pod deletion events and updated runtime/telemetry dependencies addressing security vulnerabilities. |
| 🟢 | Sensor v0.10.9 | GA | Released August 2026 with security vulnerability fixes and dependency updates (deployed by Helm or Arc for K8s). |
| 🟢 | Sensor v0.10.8 | GA | Released August 2026 with improved pod inventory reliability on pod deletion events and updated runtime/networking dependencies addressing security vulnerabilities. |
| 🟢 | Sensor v0.9.66 | GA | Released August 2026 with security vulnerability fixes and dependency updates (AKS 1.35 or by Helm). |
| 🟢 | Sensor v0.9.65 | GA | Released August 2026 with improved pod inventory reliability on pod deletion events and updated runtime/networking dependencies addressing security vulnerabilities. |
| 🟢 | Sensor v0.8.59 | GA | Released August 2026 with security vulnerability fixes and dependency updates (AKS versions 1.34 and below). |
🩹 MDVM Fixed Inaccuracies
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔴 | Fixed incorrect recommendations in Gimp Vulnerabilities (CVE-2026-58380, CVE-2026-58384) | Security | Corrected false/incorrect vulnerability recommendations for Gimp (inaccuracy 148002). |
| 🔴 | Fixed incorrect recommendations in Zoom VDI Vulnerability (CVE-2026-53412) | Security | Corrected incorrect recommendations and improved Zoom Virtual Desktop Infrastructure detection logic (inaccuracy 149073). |
| 🔴 | Fixed incorrect recommendations in Cisco IOS XE Vulnerability (CVE-2019-12660) | Security | Corrected incorrect recommendations for Cisco IOS XE (inaccuracy 147834). |
| 🔴 | Fixed incorrect recommendations in Remote Help Vulnerability (CVE-2026-55014) | Security | Corrected incorrect recommendations for Remote Help. |
| 🔴 | Fixed incorrect recommendations in Autodesk Vulnerability (CVE-2025-34499) | Security | Corrected incorrect recommendations for Autodesk (inaccuracy 149458). |
| 🔴 | Updated CVSS score for CVE-2026-28387 | Security | Corrected the CVSS score for CVE-2026-28387 (inaccuracy 149610). |
| 🔴 | Fixed incorrect recommendations in pgAdmin4 Vulnerability (CVE-2026-17566) | Security | Corrected incorrect recommendations for pgAdmin4 (inaccuracy 150005). |
| 🔵 | Fixed incorrect detections in Vendor - Orb | New/Updated | Corrected erroneous vendor detections for Orb (inaccuracy 145199). |
| 🔵 | Enhanced Cisco Webex detection coverage | New/Updated | Added additional detection rules to improve Cisco Webex coverage (inaccuracy 140979). |
| 🔵 | Added MDVM support for Logitech Logi Options+ | New/Updated | Added vulnerability support for Logitech Logi Options+. |
| 🔵 | Added MDVM support for OBS Studio | New/Updated | Added vulnerability support for OBS Studio. |
| 🔵 | Added MDVM support for SAP Analysis for Microsoft Office | New/Updated | Added vulnerability support for SAP Analysis for Microsoft Office. |
| 🔵 | Fixed incorrect detections in Vendor - Metrohm | New/Updated | Corrected erroneous vendor detections for Metrohm. |
| 🔵 | Added MDVM support for Microsoft Power BI Report Server | New/Updated | Added vulnerability support for Microsoft Power BI Report Server. |
| 🔵 | Added MDVM support for Microsoft Dynamics NAV | New/Updated | Added vulnerability support for Microsoft Dynamics NAV. |
| 🔵 | Added MDVM support for Microsoft Remote Help | New/Updated | Added vulnerability support for Microsoft Remote Help. |
| 🔵 | Added MDVM support for Microsoft Windows Terminal | New/Updated | Added vulnerability support for Microsoft Windows Terminal. |
| 🔵 | Fixed incorrect detections in LEAP Accounting Plus | New/Updated | Corrected erroneous detections for LEAP Accounting Plus (inaccuracy 148671). |
| 🔵 | Enhanced WSL Update detection coverage | New/Updated | Added additional detection rules for Windows Subsystem for Linux Update (inaccuracy 146744). |
| 🔵 | Fixed incorrect detections in UTMApp UTM | New/Updated | Corrected erroneous detections for UTMApp UTM (inaccuracy 149165). |
| 🔵 | Fixed incorrect detections in Connectwise ScreenConnect Client | New/Updated | Corrected erroneous detections for Connectwise ScreenConnect Client. |
| 🔵 | Added MDVM support for Azure Storage Explorer | New/Updated | Added vulnerability support for Azure Storage Explorer. |
| 🔵 | Added MDVM support for Azure Monitor agent Linux extension | New/Updated | Added vulnerability support for the Azure Monitor agent Linux extension. |
| 🔵 | Added MDVM support for HEVC Video Extensions | New/Updated | Added vulnerability support for HEVC Video Extensions. |
| 🔵 | Added MDVM support for Microsoft Entra Connect | New/Updated | Added vulnerability support for Microsoft Entra Connect. |
| 🔵 | Added MDVM support for Microsoft Dynamics 365 Business Central | New/Updated | Added vulnerability support for Microsoft Dynamics 365 Business Central. |
🆔 Microsoft Defender Identity
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Defender for Identity sensor update (2.255.19347.63719) | New/Updated | Sensor update that includes security improvements. |
| 🔵 | Expanded automatic auditing support for AD CS, AD FS, and Entra Connect servers | New/Updated | Automatic Windows event auditing now configures auditing for AD FS, AD CS, and Microsoft Entra Connect on any eligible server running sensor v3.x, including non-domain controllers. |
🏢 Microsoft Entra ID
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Microsoft Entra Tenant Governance | GA | Discover and control shadow IT tenants, establish least-privilege governance relationships, and monitor configuration drift across Entra, Intune, Exchange Online, Teams, Purview, and Defender. |
| 🟢 | User-centric Access Reviews (UAR) | GA | Reviewers can evaluate a user’s access across multiple resources in a catalog in one unified view, spanning Entra ID groups and connected/disconnected applications. |
| 🟢 | Create workflows by cloning existing Lifecycle Workflows | GA | Lifecycle Workflows admins can clone an existing workflow from the admin center and modify details before creating it. |
| 🟢 | Microsoft Entra Resource Accounts for Teams Devices | GA | Passwordless, device-bound credential identity model replacing legacy password-based auth for Teams Rooms, Panels, Common Area Phones, and shared Teams devices. |
| 🟡 | Synchronize sAMAccountName with Microsoft Entra Domain Services | Preview | Entra DS now syncs sAMAccountName from onPremisesSamAccountName; enabled by default for new managed domains (Enterprise/Premium SKUs). |
| 🟡 | Manage identity lifecycle from the cloud with Microsoft Entra Cloud Sync | Preview | Provision users, groups, and memberships from Entra ID to on-premises AD DS, supporting cloud-native users, B2B guests, and identity governance from the cloud. |
| 🟡 | Microsoft Entra Global Secure Access MCP Firewall | Preview | Centralized visibility, Zero Trust policy enforcement, and runtime protection for MCP traffic between AI agents and remote MCP servers, including discovery of shadow MCP servers. |
| 🔵 | Enhancements to Security Administrator role | New/Updated | Expands the built-in Security Administrator role to include disabling/enabling non-privileged accounts, revoking active sessions, and forcing password resets; rollout completes by end of September 2026. |
| ⚫ | Replace MemberOf-Based Configurations by November 3, 2026 | Deprecation | Public Preview of the MemberOf rule operator is ending; configurations in dynamic groups, dynamic AUs, and entitlement management auto-assignment must be migrated by November 3, 2026. |
| 🔴 | Permission scope update for User.ReadBasic.All | Security | Removes unintended access to app role assignments and license details; apps needing those properties must grant User.Read.All and/or LicenseAssignment.Read.All. Addresses a vulnerability and is not a breaking change for intended use. |
📱 Microsoft Intune
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Unattended Remote Help sessions for Windows devices | New/Updated | [Windows] Authorized helpdesk agents can sign in to a physical Windows device with their own credentials without the user present, then view and control it to troubleshoot. |
| 🔵 | Newly available protected apps | New/Updated | Added Notion, Superhuman Mail, Calven, Heijmans, Notability, Ben for Intune, and Zoho SDP to the Intune protected apps list. |
| 🔵 | Declarative Device Management for Apple VPP apps | New/Updated | [iOS/iPadOS, macOS] DDM support for required VPP apps on iOS/iPadOS 17.2+/macOS 26+ with real-time status and per-app settings such as automatic updates. |
| 🔵 | Configure screen timeout for corporate Android devices | New/Updated | [Android] New Screen timeout setting capped by Time to lock screen, for COBO/COSU on Android 9+ and COPE on Android 15+. |
| 🔵 | Separate device and work profile passwords | New/Updated | [Android] New “Block one lock for device and work profile” setting requires separate locks for device and work profile; Android 9+. |
| 🔵 | Limit how long an Android work profile can stay off | New/Updated | [Android] New setting limits days a work profile may remain switched off (minimum three days, or 0 to disable). |
| 🔵 | Remove eSIMs during a device wipe with a settings catalog policy | New/Updated | [Android] New “Remove all eSIMs during a device wipe” setting for corporate-owned devices; Android 15+. |
| 🔵 | New updates to the Apple settings catalog | New/Updated | [iOS/iPadOS, macOS] New Settings Catalog options for OS 27 betas covering DDM App Settings, Web Content Filter, and Siri Settings for early testing. |
| 🔵 | Keep Android device screens on while charging | New/Updated | [Android] New settings catalogue option to keep fully managed/dedicated screens on for AC, USB, or wireless charging. |
| 🔵 | New policy settings for Windows | New/Updated | [Windows] New settings across admin template refreshes including Internet Explorer Protected Mode controls, Edge 150 policies, and an RDS smart-card interactive logon option. |
| 🔵 | Skip new Apple Setup Assistant panes during enrollment | New/Updated | [iOS/iPadOS, macOS] Added Apple OS 27 Setup Assistant skip keys for Liquid Glass and Accessibility Appearance in Automated Device Enrollment. |
| 🔵 | New single device page in the Intune admin center | New/Updated | The new single device page is on by default for all customers, with device properties, activity, tools, and reports, plus a toggle to revert. |
| 🟢 | Operating system version property in assignment filters | GA | operatingSystemVersion in assignment filters is GA for managed devices and apps, enabling OS-version/build-range scoping; existing assignments keep working. |
| 🔵 | Collect enhanced diagnostic logs from supervised Apple devices | New/Updated | [iOS/iPadOS, macOS] Supports Apple’s Enhanced Logging device action using an AppleCare token and DDM status reporting. |
| 🔵 | View expanded SIM inventory for corporate-owned Android devices | New/Updated | [Android] Surfaces EIDs, multiple ICCIDs, and activation state; EID reporting requires Android 13+, full inventory Android 15+. |
| 🔵 | Activate an eSIM on a corporate-owned Android device | New/Updated | [Android] Single-device eSIM activation with carrier activation code; Android 15+; personally owned work profile devices unsupported. |
| 🔵 | Remove an individual eSIM from a corporate-owned Android device | New/Updated | [Android] Remove a single eSIM without wiping the device using its ICCID; Android 15+ (work profile Android 17+). |
| 🔵 | Choose whether to remove eSIMs when wiping one device | New/Updated | [Android] Wipe dialog now lets you preserve or remove eSIMs on a single corporate-owned device. |
| 🔵 | Device inventory for personally owned Android Enterprise devices | New/Updated | [Android] Inventory for personally owned work profile devices managed by Android Management API, queryable via Resource Explorer and Multi-Device Query. |
| 🔵 | Audit mode for the Microsoft Defender Antivirus template for Linux | New/Updated | [Linux] New Audit value for Enforcement level detects real-time threats and reports alerts without quarantining, supported for Intune-managed and MDE-attached Linux devices. |
| 🔵 | Windows 365 for Agents security baseline | New/Updated | [Windows] Security baseline for Windows 365 for Agents Cloud PCs with recommended device-scoped settings for Windows 11, Edge, and Defender for Endpoint. |
| 🔵 | Memory scan setting for Microsoft Defender Antivirus on Linux | New/Updated | [Linux] New memory scan setting in the Linux antivirus template for finer control over how Defender inspects memory. |
☁️ Microsoft Defender Cloud Apps
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Unified RBAC enabled by default for new Defender for Cloud Apps customers | New/Updated | Starting August 2026, Defender unified RBAC is automatically enabled for new Defender for Cloud Apps customers with no manual workload activation. |
🚨 Microsoft Security Exposure Management
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Keyless authentication for the Microsoft Foundry connection | New/Updated | Connect a Microsoft Foundry resource to codename MDASH using keyless authentication (managed identity, no stored key); API key auth remains available. |
| 🔵 | Codename MDASH - Cancel scan | New/Updated | Scan cancellation, previously only in Defender CLI, is now available in the Defender portal from the scan details page. |
| 🟡 | Codename MDASH - Azure DevOps connector | Preview | Connect Azure DevOps organizations from the Defender portal, onboard repositories, and trigger remote on-demand agentic code scans. |
⛵ AKS
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | AppNet 2026-08-19 release | New/Updated | Azure Kubernetes Application Network (public preview) release notes covering retirements of AppNet 1.0–1.2, expanded regional availability, bug fixes, and component updates to Istio 1.28.10, 1.29.6, and 1.30.3. |
| 🟢 | Node Auto Provisioning on restricted public-network clusters | GA | Node Auto Provisioning can now be enabled on clusters with restricted publicNetworkAccess, including private API-server VNet-integrated clusters using UDR, when AKS networking guardrails pass. |
| 🟢 | Automatic availability zone placement | GA | Globally enabled; new VMSS or VirtualMachine node pools can use availabilityZones=["auto"], and existing VMSS pools can be updated after rollout. |
| 🟢 | Control-plane only upgrades to AKS LTS | GA | Allows control-plane-only upgrades into Long Term Support when the version skew policy is satisfied, so node pools can be upgraded afterward. |
| 🟢 | AKS Node pool Rollback | GA | Restore a node pool to its previous Kubernetes version and node image after an upgrade issue to minimize downtime. |
| 🟢 | Encryption in Transit and workload identity for Azure Files | GA | Azure File CSI driver now generally supports encryption in transit for NFS file shares and workload identity access to Azure Files storage. |
| 🟡 | Prepared Image Specification (PIS) | Preview | Create preconfigured node images with required container images and customizations already applied to reduce node startup times. |
| 🟡 | Capacity Reservation Group with existing node pool | Preview | Preview API 2026-01-02-preview+ lets you associate a Capacity Reservation Group with an existing node pool; zonal pools roll cordon/drain/reboot. |
| 🔵 | SSH node access and networking changes trigger node reimage | New/Updated | [Kubernetes 1.37+] SSH node access, IMDS restriction, network-isolated bootstrap profile, and outbound type changes now trigger an immediate node reimage; use Node Disruption Policy to control timing. |
| 🔵 | Managed identity update triggers node reimages | New/Updated | Updating a cluster from service principal to managed identity triggers node reimages; configure Node Disruption Policy to control disruptive reimages. |
| 🔵 | Istio Gateway API disables service account token automount | New/Updated | Istio Gateway API deployments now set automountServiceAccountToken=false, improving default security posture and unblocking policies requiring pods to disable automount. |
| 🔵 | GPU MIG profile validation | New/Updated | AKS validates GPU MIG instance profile slice width against VM SKU capacity, rejecting unsupported MIG profiles on lower-capacity GPU SKUs. |
| 🔵 | Entra ID SSH rejected on AzureContainerLinux node pools | New/Updated | AKS now rejects Entra ID SSH configuration on AzureContainerLinux node pools because the extension is incompatible with immutable OS nodes. |
| 🔵 | Application Gateway for Containers ALB add-on aligned with AKS versions | New/Updated | AKS automatically selects the compatible ALB controller image during cluster upgrades, reducing controller/feature-flag incompatibilities. |
| 🔵 | Fixed AKS Automatic App Routing default on Kubernetes 1.36+ | New/Updated | Fixed App Routing incorrectly defaulting to NGINX instead of Istio/Gateway API mode during cluster creation. |
| 🔵 | Node Auto Provisioning updated to Karpenter provider v1.14.0 | New/Updated | Adds the Balanced consolidation policy to reduce node churn. |
| 🔵 | Azure Policy add-on components updated | New/Updated | Gatekeeper bumped to 3.23.0 and Azure Policy add-on to 1.17.0. |
| 🔵 | CSI driver and monitoring component updates | New/Updated | Azure File, Blob, and Disk CSI drivers, Prometheus managed add-on (07-27-2026), and Container Insights 3.6.0 updated; Azure Linux/ACL/Ubuntu node images refreshed (202607.20.0, 202607.29.0). |
📦 Azure Container Apps
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Azure Developer CLI (azd) Extension Framework | GA | Enables developers, teams, and partners to extend azd with custom capabilities for tailored application development and deployment workflows. Availability 2026-08. |
⚡ Azure Functions
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Azure Developer CLI (azd) Extension Framework | GA | GA framework for building and distributing azd extensions that integrate custom tools and automate development and deployment tasks. Availability 2026-08. |
📊 Azure Monitor
| Indicator | Feature | Type | Description |
|---|---|---|---|
| ⚫ | Azure Operations Center retirement | Deprecation | Azure Operations Center retired in August 2026; use Azure Monitor and the Azure Copilot Observability Agent for monitoring and analysis. |
| 🔵 | Auxiliary / Lake table plans expansion | New/Updated | Expanded Auxiliary/Lake support for Azure tables, plan switching between Analytics and Auxiliary/Lake, and availability in sovereign clouds. |
| 🟢 | Performance Diagnostics custom threshold settings | GA | Custom threshold settings for continuous and on-demand diagnostics on Azure virtual machines are generally available. |
🏗️ Microsoft Foundry
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Enable and disable controls for Microsoft Foundry agents in Agent 365 | GA | Admins can control whether a Foundry agent is available organization-wide from the Microsoft Admin Center Agent 365 governance surface, without developer intervention. Availability 2026-08. |
| 🟢 | Azure Developer CLI (azd) Extension Framework | GA | GA framework for extending azd with custom capabilities for application development workflows. Availability 2026-08. |
📊 Microsoft Fabric
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Activator rules in Eventstream | GA | Create, edit, delete, and open alert rules without leaving Eventstream. |
| 🟢 | Data-driven styling and map improvements | GA | Adds value-based colors, data legends, marker rotation, traffic flow overlays, map view options, and improved layer settings to Fabric Maps. |
| 🟢 | Eventstream MQTT connector | GA | Connects MQTT brokers to Eventstream with TLS, mutual TLS, custom certificate authorities, and private network connectivity. |
| 🟡 | Reference data enrichment in Eventstream | Preview | Joins streaming events with Delta reference tables from a lakehouse using no-code or SQL-based enrichment. |
| 🟢 | Set alerts from Anomaly Detector | GA | Create an alert from a published anomaly detector configuration without switching to Real-Time Hub. |
| 🟡 | Workspace outbound access protection for Operations Agent | Preview | Applies workspace policies to outbound actions such as Teams notifications, workflow triggers, and cross-workspace operations. |
| 🟡 | Fabric Maps in Real-Time Dashboards | Preview | Add a published Fabric Map as a dashboard tile while keeping the map’s layers, filters, and styling in the map item. |
| 🟢 | Real-Time Dashboard KPI visualization | GA | At-a-glance metrics with goals, status indicators, trends, and conditional formatting. |
| 🟡 | Eventstream workspace monitoring with per-eventstream control | Preview | Choose which eventstreams emit performance, error, and node-health data to three KQL tables in the workspace monitoring Eventhouse. |
| 🟢 | Capacity Overview Events in Real-Time Hub | GA | Streams capacity summary and state signals to monitor utilization/health, detect throttling or lifecycle changes, and trigger alerts or automated actions. |
| 🟢 | PowerTable billing personas | GA | Role-based billing for Planners, Stakeholders, and Viewers in Fabric Planning. |
| 🟢 | Mirroring for Google BigQuery | GA | Continuously replicate BigQuery tables into OneLake as open Delta tables, with automatic schema evolution, Direct Lake for Power BI, and no Fabric replication compute or network ingress cost. |
| 🟡 | Google Lakehouse Runtime Catalog mirroring | Preview | Brings Google-managed Iceberg catalog metadata into OneLake without copying data, so the tables can be used across Fabric workloads. |
🔎 Microsoft Purview
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Data Quality capability region requirement | New/Updated | The Data Quality capability now requires the Microsoft Purview account and its data sources to be in the same Azure region. |
| 🟡 | DLP policies for non-Microsoft connected apps | Preview | Create DLP policies that protect sensitive data at rest in connected apps such as Box and Google Workspace, using existing Defender for Cloud Apps connectors and the same classification engine as Microsoft 365 locations. |
| 🔵 | Endpoint DLP capability clarifications | New/Updated | Clarifies that policies for apps not in a restricted apps list/group are supported on Windows but not macOS, and documents policy-tip behavior when sensitivity labels are conditions under mandatory labeling. |
| 🔵 | Cross-tenant Teams DLP enforcement clarification | New/Updated | In cross-tenant Teams chats and channels, DLP enforcement follows the tenant that initiated the conversation; home-tenant DLP policies don’t automatically apply. |
| 🟡 | Prepare Endpoint DLP for macOS 27 permission changes | Preview | Deploy client version 101.26072 or later, configure protection modes, monitor permission status, and notify users if they disable the required Device Control and Data Access permission. |
| 🔵 | DLP in Microsoft Edge for Business guidance | New/Updated | Explains policy sync status, investigation of managed/unmanaged app activity, and coverage limitations from duplicate app catalog entries, encoded traffic, dynamic endpoints, and shared URLs. |
| 🔵 | Data lifecycle management updates | New/Updated | Documents the automatic 30-day delay hold after removing the last hold from an inactive mailbox, and how to remove a retention hold from an unlicensed OneDrive site. |
| 🟡 | Priority Cleanup permanent deletion | Preview | After simulation, review, and approvals, selected SharePoint/OneDrive files bypass recycle bins and are no longer discoverable in SharePoint search, Microsoft 365 Copilot, or eDiscovery. |
| 🔵 | Data Security Posture Management support for Anthropic Claude Enterprise | New/Updated | Purview support for Anthropic Claude Enterprise now includes data classification, Insider Risk Management, Communication Compliance, eDiscovery, Data Lifecycle Management, and Compliance Manager. |
| 🔵 | eDiscovery app-only authentication unsupported | New/Updated | App-only authentication for eDiscovery cmdlets in Security & Compliance PowerShell is unsupported; transition automations to Microsoft Graph APIs where available. |
| 🟡 | Sensitivity label auto-labeling simulation and Insights | Preview | Run auto-labeling policies in simulation mode before enforcement and use the new Insights tab for at-a-glance policy performance. |
| 🟡 | Sensitivity label policies for non-Microsoft connected apps | Preview | Create auto-labeling policies protecting sensitive data at rest in non-Microsoft connected apps including Box and Google Workspace. |
| 🔵 | Sensitivity labels updates | New/Updated | Added external-user access guidance for user-defined permission labels, adaptive-scope PowerShell support beyond 100 SharePoint sites, OneNote version/capability guidance, and support guidance for failed policy rules. |
| 🔵 | On-demand classification scans on Windows endpoints | New/Updated | Run on-demand classification scans to discover sensitive information without waiting for files to be opened or modified; includes billing, monitoring/troubleshooting, and FAQ guidance. |
| 🔵 | Expanded Microsoft 365 audit log activities | New/Updated | Audit log now includes Microsoft Defender for Cloud, People Skills, Microsoft 365 Archive file-level policy, and Microsoft Purview permission activities. |
🐙 GitHub Security
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Customize Dependabot pull request branch names | New/Updated | New pull-request-branch-name options in .github/dependabot.yml let you set prefix, max length, separators, letter case, or a custom template; available to all github.com users and included in GHES 3.23. |
| 🔵 | License data quality improvements | New/Updated | License info now sourced from package registries (npmjs.org, PyPI, etc.) instead of primarily ClearlyDefined, cutting missing licenses roughly in half and adding version-range tracking; available across all of GitHub. |
🧠 Microsoft Copilot Studio
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | GitHub Copilot harness | GA | The GitHub Copilot harness, the orchestration layer for reasoning-heavy agents and workflows (planning, tool/MCP/connected-agent selection, native Word/Excel/PowerPoint/PDF creation in a sandbox), became GA on August 3, 2026 alongside the standard harness (announced in the September 2 Copilot blog round-up). |
Top 5 Action Items
| Priority | Action | Due | Affected Product(s) |
|---|---|---|---|
| 🔴 | Update Azure Resource Graph/API queries to read CVE details from the microsoft.security/cvedetails resource type. | ASAP | Microsoft Defender Cloud |
| 🔴 | Replace MemberOf-based dynamic group, AU, and auto-assignment configurations. | 2026-11-03 | Microsoft Entra ID |
| 🔴 | Migrate apps off User.ReadBasic.All for app role/license reads to User.Read.All and/or LicenseAssignment.Read.All. | Next review cycle | Microsoft Entra ID |
| 🔴 | Migrate classic Defender for SQL VA and ATP APIs to the supported configuration model and update dependent automation. | 2027-08-16 | Microsoft Defender Cloud |
| 🟡 | Plan the migration off the Machines should be configured securely (powered by MDVM) recommendation and verify Guest Configuration prerequisites. | Current sprint | Microsoft Defender Cloud - Recommendations & Alerts |
Security Architect Observations
- CVE data model changes in Defender for Cloud (
cvedetailsresource type) and the SQL API retirement signal a broader shift toward consolidated vulnerability consumption; downstream SIEM/AR workflows and custom dashboards should be revalidated for schema and endpoint drift. - Entra ID’s MemberOf deprecation and
User.ReadBasic.Allscope tightening both reduce long-term identity risk but require migration; dynamic group/AU designs built on MemberOf can silently stop updating after the deadline, creating governance gaps if unaddressed. - Defender security posture is moving toward keyless/managed-identity auth (MDASH Microsoft Foundry, Entra Resource Accounts, AKS workload identity for Azure Files); prioritize phasing out stored secrets and service principal credentials.
- AKS behavior changes (node reimages triggered by SSH/IMDS/outbound/managed-identity changes, automatic zonal placement) increase the need for Node Disruption Policies and maintenance windows to avoid workload impact.
- Unified RBAC default-on for new Defender for Cloud Apps customers plus expanded Security Administrator role rights require a review of least-privilege role assignments and separation of duties across the Defender estate.
- Linux security posture for MDE (engine signature verification by default, AV/tamper audit modes) offers defense-in-depth wins but introduces new telemetry and configuration surfaces to govern.
Security Operations Observations
- New Sentinel UEBA behaviors/anomalies (FortiGate, Check Point, Zscaler, AWS GuardDuty) expand detection coverage; tune and validate these new rules to avoid alert fatigue and confirm MITRE mapping in SOC workflows.
- MDVM vulnerability-support additions and CVE correction fixes (Gimp, Zoom VDI, Cisco IOS XE, pgAdmin4, etc.) reduce false positives; analysts should refresh exposure dashboards to reflect corrected CVSS scores and recommendations.
- Intune Defender Antivirus audit mode for Linux and MDE Linux audit-mode features create alert-only detections; SOCs should confirm these flow into the Defender portal and adjust triage playbooks for non-blocking findings.
- Defender for Identity automatic auditing for AD CS/AD FS/Entra Connect expands identity-attack surface visibility; ensure connectors and ingestion health are monitored for the new event sources.
- The GitHub Copilot fix for skipped tool-approval prompts is security-relevant to agentic workflows; security teams should verify approval enforcement in developer Copilot configurations.
- Copilot/agent governance additions (Foundry agent enable/disable in Agent 365, Entra MCP Firewall preview) introduce a new monitoring surface for shadow AI/MCP usage; operations should begin inventorying agent and MCP server usage.
References
This post is licensed under CC BY 4.0 by the author.