Microsoft Defender for Endpoint has received a set of new features and enhancements in February 2026, covering live response management, configuration visibility, vulnerability reporting, and predictive threat mitigation. These updates span endpoints running Windows, macOS, Linux, Android, and iOS. This article covers the most significant additions to the Defender portal and their operational impact on security teams.

Source

Microsoft integrates Teams with Defender for Office 365, enabling security admins to block external users directly from the Microsoft Defender portal using the Tenant Allow/Block List. This centralized security management feature rolls out in January 2026, supporting up to 4,000 domains and 200 email addresses with automatic blocking across chats, meetings, channels, and calls.

Source

Microsoft introduced the Microsoft Defender Experts Suite as an integrated security offering that combines managed extended detection and response (MXDR), incident response services, and direct access to Microsoft security advisors. Unlike purchasing these services separately, the suite provides a single unified SKU with per-user-per-month licensing and a designated security advisor who coordinates all three service components. The suite became generally available on January 1, 2026, with a promotional offer available through December 31, 2026.

Source

The Microsoft Security Copilot Dynamic Threat Detection Agent is an AI-powered backend service that automatically detects hidden threats in Microsoft Defender XDR and Microsoft Sentinel environments. Announced at Microsoft Ignite 2025 and now available in public preview, this always-on agent uses artificial intelligence to identify security gaps that traditional rule-based detection systems miss.

Source