Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) solution that delivers comprehensive security for Software as a Service (SaaS) applications across your organization. This security platform provides visibility into shadow IT, threat protection, data loss prevention capabilities, and security posture management for cloud-based applications. The tool integrates with Microsoft Defender XDR to offer extended detection and response across the full attack chain. Recent updates include March 2026 changes to Secure Score category calculations that reclassify some recommendations from the Cloud apps category to Identity, more accurately reflecting where controls apply without changing the overall Secure Score.

Source

Microsoft announced several new Defender features at the RSA Conference 2026, most of which are in preview and have minimal technical documentation. The primary additions include AI-powered triage agents in Security Copilot that automatically classify security alerts, a new dashboard that consolidates identity-related security events, automated hardening actions based on attack predictions, and voice-call monitoring in Microsoft Teams.

Source

At RSA Conference 2026, Microsoft announced a comprehensive set of updates to Microsoft Sentinel, its cloud-native Security Information and Event Management (SIEM) platform. The announcements focus on AI-driven automation, simplified multi-tenant management, and enhanced data integration capabilities designed to help security operations centers (SOCs) operate more efficiently at scale.

Source

Microsoft Defender for Endpoint now includes an effective settings feature, generally available as of March 2026, that shows which security configurations are actually enforced on a device.

Source

The Defender deployment tool for Windows now ships as a single .exe with the onboarding package baked in, with configurable expiry dates, a required portal key to activate it, and onboarding event logs visible in the device timeline — replacing the old script/blob approach. The previous tool gave no clear status feedback, leaving admins unable to tell if onboarding was in progress or had failed.

Source

Microsoft Defender for Endpoint has received a set of new features and enhancements in February 2026, covering live response management, configuration visibility, vulnerability reporting, and predictive threat mitigation. These updates span endpoints running Windows, macOS, Linux, Android, and iOS. This article covers the most significant additions to the Defender portal and their operational impact on security teams.

Source

Microsoft integrates Teams with Defender for Office 365, enabling security admins to block external users directly from the Microsoft Defender portal using the Tenant Allow/Block List. This centralized security management feature rolls out in January 2026, supporting up to 4,000 domains and 200 email addresses with automatic blocking across chats, meetings, channels, and calls.

Source

Microsoft introduced the Microsoft Defender Experts Suite as an integrated security offering that combines managed extended detection and response (MXDR), incident response services, and direct access to Microsoft security advisors. Unlike purchasing these services separately, the suite provides a single unified SKU with per-user-per-month licensing and a designated security advisor who coordinates all three service components. The suite became generally available on January 1, 2026, with a promotional offer available through December 31, 2026.

Source

The Microsoft Security Copilot Dynamic Threat Detection Agent is an AI-powered backend service that automatically detects hidden threats in Microsoft Defender XDR and Microsoft Sentinel environments. Announced at Microsoft Ignite 2025 and now available in public preview, this always-on agent uses artificial intelligence to identify security gaps that traditional rule-based detection systems miss.

Source