rss.livelink.threads-in-node

Policy backup

techboy127 — Tue, 01 Sep 2026 22:34:56 GMT

Is it possible to backup the defender(custom antispam, anti phishing etc) policies. So they can be easily restored. As a disaster recovery mechanism or if I have to setup the tenant afresh. If yes what's the best method?

Stop identity attacks before they start with Microsoft ISPM recommendations

adipavekatz — Tue, 01 Sep 2026 16:00:00 GMT

Many major breaches involve compromised identities, excessive privileges, or misconfigured access. Long before ransomware detonates or data leaves the building, adversaries are quietly abusing valid accounts, excessive privileges or other misconfigurations to move deeper into the environment. Identity has become one of the most important attack surfaces you defend.

That is why Microsoft has a dedicated team of researchers who study how identity attacks actually happen. Just as important, we turn what they learn into action. Real attacker behavior becomes concrete recommendations you can use to harden your environment before an attack begins. With Microsoft Defender, that research reaches you as Identity Security Posture Management (ISPM) recommendations: prioritized guidance that tells you what to fix, why it matters, and how to remediate it.

What are identity security posture recommendations?

Identity security posture recommendations are prioritized, attack-driven recommendations that address the weaknesses attackers exploit most, from overprivileged accounts to weak credentials and risky permissions. Rather than handing you a long hygiene checklist, ISPM recommendations tie each recommendation to a real attack technique. That shifts the question from "what setting do I need to change?" to "what attack am I going to prevent today?"

That framing also changes how you prioritize. You can start with the fixes that close the most dangerous attack paths first, not just the ones that are quickest to clear. It gives identity admins and the SOC and others shared view of the same risk, and as our researchers uncover new techniques, the recommendations evolve, so your posture keeps pace with the threat.

New recommendations

We are excited to announce five new ISPM recommendations geared toward emerging attack patterns you need to be aware of:

Ensure no privileged SaaS app accounts exist outside of IdP control

Most SaaS platforms let you create admin accounts directly inside the app, separate from your corporate identity provider (IdP). Those local admins are convenient, but they sit outside the protections every other identity relies on: No outside centrally managed identity controls as Conditional Access, and little to no monitoring. Attackers know it. We’ve seen a rise in SaaS data-exfiltration campaigns that specifically hunt for these app-native admin accounts, because once they find one they can sign in and operate without tripping any of your usual defenses.

This recommendation surfaces those accounts so you can bring them under your identity provider, where you can manage them with single sign-on, multifactor authentication, Conditional Access, and lifecycle governance apply automatically and where your SOC can finally see them.

This attack pattern aligns with MITRE ATT&CK techniques including Valid Cloud Accounts (T1078.004) and Account Manipulation (T1098).

Ensure service accounts are not assigned Domain Admin or Global Admin roles

Service accounts run your apps and integrations, and because they are not tied to a person, they are easy to over-provision and easy to forget. When one is assigned Domain Admin or Global Admin, it becomes a quiet path to the top of your environment. Supply-chain intrusions like SolarWinds showed how attackers ride a trusted service identity straight into the highest levels of access, often without anyone noticing, because no one watches a service account the way they watch a user.

This recommendation flags service accounts holding those top-tier roles so you can right-size them. It shrinks the blast radius if one is ever compromised and keeps a non-human account from becoming a hidden administrative backdoor.

This attack pattern aligns with MITRE ATT&CK techniques including Valid Accounts: Domain Accounts (T1078.002) and Cloud Accounts (T1078.004)

Ensure non-admin accounts cannot reset passwords for sensitive groups

Sometimes a standard user account quietly holds the ability to reset passwords for members of a sensitive group, a leftover of delegated permissions no one revisited. On paper that user is low privilege. In practice they are one password reset away from becoming an administrator. Attackers look for exactly this kind of shadow admin: compromise an unremarkable account, reset a privileged password, and walk in through the front door, no exploit required.

This recommendation finds those unintended password-reset rights over sensitive groups and helps you remove them, closing a direct path from ordinary user to full administrator.

This attack pattern aligns with MITRE ATT&CK techniques as Account Manipulation (T1098)

Ensure non-admin identities cannot have WriteDACL permissions on sensitive groups

Deep in Active Directory, some permissions can be abused to grant additional rights and gain control of a sensitive group. One of them, the right to modify an object's access control list (known as WriteDACL), is especially dangerous in the wrong hands. If a non-admin identity holds it over a sensitive group, that identity can simply rewrite the group's permissions and grant itself privileged control. It is one of the most reliable escalation paths attackers use.

This recommendation identifies non-admin identities with that permission over sensitive groups so you can strip it, eliminating a well-worn route from a regular account to Domain Admin.

This attack pattern aligns with MITRE ATT&CK techniques as Account Manipulation (T1098)

Ensure external and guest accounts are not granted privileged roles

Guest and external accounts make collaboration easy, but they live partly outside your control. Their security depends on another organization's hygiene, and they blend in, which makes them an attractive target. When one of these accounts is also granted a privileged role, a single compromise on the other side of that relationship becomes a privileged foothold inside your tenant.

This recommendation highlights external and guest identities holding sensitive roles so you can remove that access, preventing an outside account from being used for persistence, escalation, or reaching your data.

This attack pattern aligns with MITRE ATT&CK techniques as Valid Cloud Accounts (T1078.004) and Account Manipulation Cloud Roles (T1098.003)

Additional high-impact identity posture recommendations

In addition to the five new recommendations, several existing ISPM recommendations remain especially important. We continue to see attackers exploit the weaknesses they address, which makes them high-value fixes for strengthening your identity posture.

Here is why each one still earns priority.

Remove dormant accounts from sensitive groups

A privileged account no one uses is a gift to an attacker. It still carries powerful access, but because nobody signs into it, nobody notices when someone else does. Ransomware crews and intrusion groups seek out these forgotten admin accounts precisely because they can operate from one for weeks without raising suspicion. Removing dormant privileged accounts takes that stealthy, high-impact option off the table before it is ever used.

Reduce lateral movement path risk to sensitive entities

Reduce lateral movement path risk to sensitive entities helps close one of the most common ways identity attacks become domain-wide compromises: an attacker starts with a non-sensitive account, then follows permissions, group memberships, local admin rights, active sessions, or other identity relationships until they can reach highly sensitive credentials. This maps to well-known lateral movement and privilege escalation techniques, where adversaries abuse excessive permissions or exposed credential paths to move from an initial foothold toward Domain Admin or another high-value identity. This recommendation highlights exposed entities with risky lateral movement paths and provides remediation guidance to reduce the number of non-sensitive accounts on each path. By removing unnecessary privileges and memberships, teams can shrink the attack graph around sensitive entities and prevent a small compromise from becoming a privileged identity breach

Use least privileged administrative role

Use least privileged administrative roles in Microsoft Entra ID reduces the blast radius of a compromised admin account. In many identity attacks, adversaries first gain access through phishing, password spray, or stolen credentials, then abuse valid cloud accounts to escalate privileges, create persistence, or access sensitive data. This maps to the known attack technique Valid Accounts where an attacker uses a legitimate account’s assigned permissions instead of malware or exploits. Assigning narrow, task-specific admin roles instead of broad roles like Global Administrator limits what an attacker can do if that account is compromised and makes privilege escalation harder.

Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users

Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users reduces the window of opportunity after an admin session is stolen. This maps to known session-theft techniques such as Steal Web Session Cookie and Web Session Cookie, where adversaries use stolen authentication cookies to access cloud services as an already-authenticated user, sometimes bypassing MFA because the session was established before the theft. By requiring admins to reauthenticate more often and preventing persistent browser sessions, organizations make stolen sessions expire sooner and reduce the chance that a compromised admin browser session becomes long-lived access to sensitive systems.

Stay ahead of attackers

Attackers keep evolving, so your identity posture has to evolve with them. The strongest defense is not a one-time cleanup, it is continuously closing the gaps attackers depend on, from stolen credentials to excessive privilege and lateral movement. That is exactly what ISPM recommendations are built to help you do, turning live attacker research into clear actions you can take today.

In the Microsoft Defender portal, review your ISPM recommendations, start with the five new proactive exposures, and prioritize the highest-risk attack paths first. Every path you close is one an attacker cannot take.

Next steps

Start by reviewing your identity security posture recommendations in the Microsoft Defender portal under Exposure management > Recommendations. Prioritize recommendations that expose privileged identities, sensitive groups, service accounts, or attack paths to critical assets, then remediate unnecessary privileges, delegated permissions, and unmanaged identity access.

To explore your Microsoft Identity Security Posture Management (ISPM) recommendations, see: https://security.microsoft.com/exposure-secure-scores

Documentation

For more details as licensing and prerequisites, see:

Microsoft Defender for Identity security posture assessments - Microsoft Defender for Identity | Microsoft Learn

Defender XDR: Tables not supported for table management

atharvc — Thu, 27 Aug 2026 07:01:27 GMT

I am trying to extend the table retention of specific tables to allow them to flow to Sentinel Analytics but keep getting the message "This table is not supported for table management" in the Sentinel > Configuration > Tables page.

The Sentinel workspace is connected in System > Settings > Microsoft Sentinel.

I can see the table type is XDR in the list which seems to be the reason why it can't be managed.

Any ideas why this table is not able to be managed.

Monthly News-August 2026

EdFisher — Wed, 05 Aug 2026 22:15:47 GMT

Microsoft Defender
Monthly news - August 2026 Edition

This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from July 2026. We are now including news related to Defender for Cloud in the Defender portal. For all other Defender for Cloud news, have a look at the dedicated Defender for Cloud Monthly News here.

🚀 New Virtual Ninja Show episode:

Actionable threat insights (find all of them here)

Microsoft Defender

(Public Preview) Microsoft Defender now assesses posture risk for AI agents, including enterprise agents and local agents discovered on endpoint devices. Risk levels are based on active risk indicators, such as configuration, access, runtime activity, endpoint and user context, and active alerts. Security teams can use posture risk and recommendations to prioritize risky agents and improve agent security posture. For more information, see AI agent posture risk in Microsoft Defender.
(Generally available) The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information, see Investigate a domain .
(Generally available) With a Microsoft Agent 365 license, Microsoft Defender provides discovery, security posture, threat detection and investigation, and real-time protection for the AI agents in your tenant. Onboarding includes enabling data collection, connecting the Microsoft 365 app connector, and connecting Copilot Studio for real-time protection of Copilot Studio agents. For more information, see Protect AI agents using Microsoft Defender.
(Generally available) Improved access to Playbook Generator: Following the GA release of Playbook Generator May 31st, the team focused on streamlining the onboarding experience and reducing friction related to Security Copilot wallet provisioning. Playbook Generator remains included with Microsoft Sentinel and does not consume SCUs for generating, testing, or running playbooks, yet customer feedback highlighted friction around Security Copilot wallet provisioning and initial setup requirements. The team worked on simplifying access and reducing onboarding barriers so organizations can more quickly take advantage of AI-assisted playbook creation, testing, and automation capabilities.
For all other Sentinel News, have a look at the "What's new in Microsoft Sentinel blog post - July edition"

Identity Security

(Generally available) Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x.
Migration readiness reasons on the Sensors page: When a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see Troubleshoot "Not ready for migration" status.
(Public Preview) Expanded SaaS app support in Password protection. The Password protection page now includes password risks from SaaS apps connected through Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce and ServiceNow, appear on the Password Hygiene and Password Policies tabs. Each SaaS app requires a Defender for Cloud Apps app connector. For more information, see Investigate identity password protection.

The Password Protection Page

Automatic RPC auditing on domain controllers: Defender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later. You no longer need to apply a tag manually to enable RPC auditing. For more information, see Configure RPC auditing.

Microsoft Defender Experts MDR

General Availability of Microsoft Defender Experts MDR P2: Microsoft Defender Experts MDR (formerly Microsoft Defender Experts for XDR) is expanding with new third-party and multi-cloud coverage powered by Microsoft Sentinel, with the launch of Defender Experts MDR P2 service. Defender Experts MDR provides a 24/7 managed detection and response service that reduces noise, adds expert context, and drives action. In addition to the Microsoft Defender products, this new service supports key non-Microsoft sources across cloud (AWS), identity (Okta), email (Proofpoint), network (Palo Alto Networks, Cisco, Fortinet, ZScaler), and endpoint (CrowdStrike) that are ingested in Microsoft Sentinel, providing E2E visibility and protection for customers operating heterogenous environments. Defender Experts will continue expanding our scope to other non-Microsoft products to deliver on this promise. For more information, see the Microsoft Defender Experts MDR documentation.

Microsoft Security Exposure Management / Defender Vulnerability Management

(Private Preview) Codename MDASH - Agentic code scanner is now available in private preview in Microsoft Security Exposure Management. Codename MDASH uses a multi-model agentic AI system to detect code vulnerabilities with greater depth and accuracy than traditional static analysis. Security teams can run scans from Defender CLI or through a GitHub connector, review findings in the Defender portal, and use results to help prioritize code security risks. For more information, see Agentic code security overview.
(Private Preview) Codename MDASH - MAI-Augmented scan profile private preview. The MAI-Augmented scan profile is now available in preview as part of Codename MDASH. The MAI-Augmented profile can be used when triggering a scan through the Defender CLI. It includes MAI-Cyber-1-Flash, a new cyber-specialized model that extends the current agentic scanner in addition to the existing required models. Security teams can choose this profile when triggering a scan from Defender CLI or continue using a scan profile based on the existing models. For more information, see Scan with a scan profile.
OT data connectors in Microsoft Security Exposure Management: Microsoft Security Exposure Management now supports operational technology (OT) data connectors for Armis, Dragos, and Forescout. OT data connectors bring OT asset and vulnerability data from supported third-party OT platforms into the Defender portal. This helps security teams view OT devices alongside other assets, enrich device inventory with OT context, and investigate vulnerabilities across IT and OT environments. For more information, see OT data connectors.

Microsoft Defender for Endpoint

(Public Preview) AI agent runtime protection includes these enhancements: - Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI and the GitHub Copilot app. - Network inspection is now supported for agents that don't expose vendor-supported event interfaces, including OpenClaw and similar Node.js-based Claw agents. For more information, see AI agent runtime protection with Defender for Endpoint.
(Generally available) Available from Defender for Endpoint on Linux version 101.26042.0011 and later. The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow. The tool automates prerequisite validation, supports custom installation paths, enables deployment of specific Defender versions from preferred update channels, and works seamlessly in environments that use local repositories. In addition to a simplified deployment experience, customers can now gain complete visibility into deployment progress through Device Timeline integration, providing step-by-step installation, upgrade, and onboarding status, Advanced Hunting queries for fleet-wide deployment monitoring, and detailed error reporting, including deployment stage, status, exit code, and failure reason to simplify troubleshooting. These capabilities help administrators quickly identify deployment issues, track onboarding progress, and understand deployment outcomes across their Linux estate.

The Defender for Endpoint Onboarding page

Microsoft Defender for Office 365

Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations. Starting July 2026, new Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model by default. For more information, see Configure Unified RBAC for Defender for Office 365 and MC1246006.
Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet.
Prompt injection protection: Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Defender for Office 365.

Detecting CVE-2026-54121 (Certighost) with Microsoft Defender

EdanZwick — Fri, 31 Jul 2026 17:41:07 GMT

What is CVE-2026-54121?

CVE-2026-54121 is an authentication-bypass vulnerability in Active Directory Certificate Services that allows an attacker to obtain certificates for arbitrary domain computer accounts, including Domain Controllers. A valid Domain Controller certificate enables escalation to full domain compromise: it can be used to obtain Kerberos tickets that authenticate the attacker as a Domain Controller. Those tickets can then be used to perform attacks such as DCSync, or to recover the Domain Controller's password hash for later use.

The flaw lies in an AD CS enrollment fallback known as a chase, which occurs when the CA cannot resolve the requester. In such cases, the vulnerable CA contacts a client-supplied Domain Controller, specified in the cdc attribute, to retrieve fresher identity data and incorporates the response into the issued certificate, without verifying that it is communicating with a legitimate Domain Controller. The chase fallback occurs only for templates that require a DNS name, and only on CAs with the EDITF_ENABLECHASECLIENTDC flag enabled.

A public proof of concept was released on July 24, 2026. Microsoft has not observed confirmed threat-actor exploitation, and the activity seen so far appears consistent with security testing. Organizations with affected AD CS configurations should apply the July 14 security update. Organizations should identify exposed Certificate Services hosts, confirm whether the required environmental conditions exist, enable the recommended AD CS auditing, and monitor for the suspicious authentication and certificate-enrollment activity described below.

More details about VCE-2026-54121 can be found here.

What to do

The response follows a simple order: know your exposure, patch it, instrument it, and watch for the activity.

1. Identify affected systems

Certighost affects Windows Server 2012 through Windows Server 2025, including Server Core installations, but several conditions must all be present for a given environment to be exploitable:

An Enterprise Certification Authority integrated with Active Directory
Enrollment through the machine certificate template
A default ms-DS-MachineAccountQuota value, or a machine account already controlled by the attacker
Network reachability between the Certification Authority and the attacker's host over SMB and LDAP
A valid domain account, with no administrative privileges required

2. Patch

The primary and durable remediation is the July 14, 2026 security update, applied to every AD CS host that runs an Enterprise Certification Authority. The update validates the lookup target before the Certification Authority contacts it, rejecting invalid or attacker-controlled targets before enrollment continues. Nothing else in this post replaces patching. The monitoring below gives you defense in depth and visibility, not an alternative to the fix.

3. Turn on AD CS auditing

The certificate request and issuance activity at the center of this attack is only useful to defenders if it is being recorded, and AD CS certificate services auditing is not enabled by default. With it on, the same events power detection and investigation across Microsoft Defender, and Kerberos authentication telemetry requires no additional configuration.

Organizations that have Microsoft Defender for Identity sensors installed on their AD CS servers and have completed the required sensor configuration can typically skip this step, as the necessary Certificate Services auditing settings are already enabled as part of the deployment prerequisites.

Enabling AD CS auditing takes two settings:

Turn on the Certification Services audit subcategory. Under Advanced Audit Policy, Object Access, enable success and failure for Certification Services. Set it through Group Policy, or with auditpol:

auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

Set the Certification Authority audit filter. In the Certification Authority console this is the Auditing tab; it can also be set with certutil, followed by a service restart:

certutil -setreg CA\AuditFilter 127 Restart-Service CertSvc -Force

With both in place, the Certification Authority records Security log events for certificate lifecycle operations, including event 4886 when a certificate request is received and event 4887 when a request is approved and a certificate is issued. Each event captures the requester, the template used, and the request disposition. For Certighost, this is the record that makes the abuse visible: a certificate issued for a Domain Controller identity, requested through a machine template by a low-privileged principal, is an issuance pattern that should never occur normally, and these events let defenders detect it, investigate it, and correlate it with the PKINIT authentication and DCSync activity that follow.

For complete guidance, see Configure Windows event auditing — Microsoft Defender for Identity.

4. Watch for alerts

Attempts to exploit this vulnerability are detected by Microsoft Defender for Identity with the alert :

"Potential Certighost (CVE-2026-54121) AD CS abuse."

The alert fires on the malicious certificate requests crafted to exploit this flaw, the anomalous issuance pattern at the heart of the technique, so you do not need to author a custom rule to catch the core activity. Ensure Defender for Identity is deployed on your domain controllers and AD CS servers and treat this alert as high priority.

Example of Potential Certighost (CVE-2026-54121) AD CS abuse alert within Microsoft Defender

Because the exploitation chain touches several stages of an identity attack, you may also see supporting alerts that commonly appear alongside this activity, though on their own they do not confirm a Certighost attempt:

Security principal reconnaissance (LDAP)
Suspicious Active Directory Certificate Services abuse tool activity
Suspected suspicious Kerberos ticket request
DCSync attack (replication of directory services)

Learn more

To stay on top of the latest Defender for Identity capabilities, follow our What's New documentation page.

MDTI convergence in Microsoft Sentinel and Defender XDR is complete

AmelieDarchicourt — Wed, 29 Jul 2026 16:00:00 GMT

Beginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal, giving customers real-time Microsoft threat intelligence across detection, investigation, response, hunting, and automation at no additional cost. Announced last year, this unified SecOps experience reduces fragmented context and tool handoffs, creating a clearer path from threat signal to informed action.

Latest features converging

Entity enrichments: all the intel, right where you need it

Defender entity pages surface threat intelligence enrichments in the Threat Intelligence Insights tab for IP addresses, domains, URLs, and files. This unified view combines reputation data and scores, attributed reports, infrastructure relationships, services, certificates, DNS and WHOIS records, trackers, cookies, and sandbox analysis, helping analysts assess risk and investigate incidents without switching tabs. For more information, see View threat intelligence in entity pages.

Screenshot of the Threat Intelligence Insights tab under Threat Analytics in the Defender portal showing reputation risk.

Screenshot of the Threat Intelligence Insights tab under Threat Analytics in the Defender portal showing WHOIS records.

MDTI Sentinel data connectors and APIs

Microsoft Threat Intelligence data that previously required the Premium MDTI connector is now available through the free Microsoft Threat Intelligence connector in Sentinel, enabling free and premium indicator feeds through one setup. MDTI APIs are also available by default to Microsoft Defender XDR and Microsoft Sentinel customers, without a separate MDTI license SKU, so teams can enrich investigations through Sentinel or external SIEM, SOAR, and automation tools.

As a reminder, the API surface remains unchanged, and no customer migration is required. Customers do not need to perform endpoint mapping, code changes, tooling changes, or cutover activities.

Features previously released

Threat Intelligence Library

Microsoft’s threat actor profiles, intelligence reports, OSINT articles, MSTIC and MTP research, and indicators of compromise (IoCs) are now available through Threat Analytics in the Defender portal, at no additional cost beyond the existing license.

Screenshot of the Threat Analytics dashbaord in the Defender portal.

Threat Analytics Enhancements

Reports now bring together embedded IoCs, MITRE ATT&CK mappings, targeted industries, actor origins, and automatic incident correlation, so defenders can move from reading intelligence to applying it in investigations.

Screenshot of the Threat Analytics page in the Defender portal showing actor profile overview.

Case Linking

Security teams can link investigation cases directly to relevant IoCs, making it easier to document findings, collaborate across response workflows, and show how intelligence informed action.

Reference the table below to see the full list of features available with the MDTI convergence into Microsoft Defender XDR and Sentinel.

Chart showing full list of MDTI capabilities converged into Defender XDR and Sentinel

Actions for existing MDTI customers

Starting August 1, the standalone MDTI pages (Intel Profiles, Intel Explorer & Intel Projects) will be retired. All MDTI capabilities will be accessible via the Threat Analytics tab in the Defender portal instead of the Threat Intelligence tab. No migration action is needed. Customers will now access the MDTI value via the Threat Analytics tab in the Defender portal instead of the Threat Intelligence tab. Explore our documentation for more details and reach out to your account team or partner if you need have questions or need assistance on how to reduce your current license and transition to this new unified threat intelligence experience in Defender XDR or Sentinel at no additional cost.

Get started

To access threat intelligence in the Microsoft Defender portal:

Go to the Microsoft Defender portal and sign in.
Use the Threat intelligence navigation menu to access Intelligence explorer and Intel profiles.
Investigate entities enriched with threat intelligence by selecting IP addresses, domains, URLs, or files from incidents, alerts, or search results.

Graph API Endpoint for the Vulnerability Profile

scottholland — Tue, 28 Jul 2026 12:02:06 GMT

I can use this endpoint to get threat reports via the graph api

GET

https://graph.microsoft.com/beta/security/threatIntelligence/article

but threat Analytics reports that come in from defender that are category: vulnerability, aren't in there However they are written up in an article style. What endpoint do I need to hit to get these types of reports.

SmartScreen reputation issue for EV Code Signed Windows application

zyinfo — Tue, 11 Aug 2026 13:58:41 GMT

Hello Microsoft Defender Threat Intelligence Team,

We are the developer of a legitimate Windows desktop application called "ShangJing".

Recently, our users reported that Microsoft Defender SmartScreen displays the following warning when downloading and launching our application:

"Microsoft Defender SmartScreen can't verify this file is safe."

The application is not malicious and has been digitally signed with a GlobalSign EV Code Signing Certificate.

Application information:

Product Name:

ShangJing

Publisher:

Zhaoyi Information Technology (Shanghai) Co., Ltd.

Certificate:

GlobalSign EV Code Signing Certificate

File:

尚镜_2.0.0_platinum_setup.exe

Issue:

Users receive SmartScreen reputation warning when downloading our application.

We have already submitted the file through Microsoft Security Intelligence submission portal 7 days ago, but we have not received any update yet.

Submission ID:

0c015296-b9cf-4130-9eaf-fc59cd145370

The file is distributed through our official website:

https://www.changine.cn/downloads

We would like to understand:

1. Is this caused by insufficient SmartScreen reputation for a newly released binary?

2. Is there any additional verification required from the software publisher side?

3. How can we ensure our legitimate application gains proper SmartScreen reputation?

Our application is widely used for live streaming and camera-related workflows. It does not contain any malicious behavior.

We would appreciate any guidance from the Microsoft team.

Thank you.

Microsoft Defender now integrates with Dragos, Forescout, & Armis for OT Security

Caroline_Lee — Tue, 14 Jul 2026 13:46:58 GMT

Co-author(s): Amit Cohen and Hadar Shindler

Operational technology (OT) environments are unlike anything else in cybersecurity. The systems that run our factories, power grids, water treatment plants, pipelines, and transportation networks weren’t built with modern threats in mind — and they can’t simply be patched, rebooted, or scanned the way IT systems can. A misstep doesn’t just create an alert backlog; it can stop a production line, disrupt critical services, or put physical safety at risk.

To support customers in bringing their OT security solutions into their Security Operation (SOC) platform, we’re excited to announce an expansion of the Microsoft ecosystem with new OT security integrations from Dragos, Forescout, and Armis from ServiceNow. This gives customers greater flexibility to use the OT security solutions that best fit their environments.

Expanding OT coverage in Defender with new partner integrations

We’ve built new connectors for Dragos, Forescout and Armis that are now ready for customers to start using.

Dragos

"Strong OT defense starts with knowing what is running in your operational environment, the vulnerabilities those assets carry, the threats targeting your systems, and the data to determine root cause. That kind of intelligence comes from years of operating inside OT environments and tracking the groups behind those threats. As OT threats continue to grow and AI accelerates how quickly adversaries can approach the OT boundary, integrating Dragos into Microsoft Defender strengthens how organizations see, understand, and defend their OT environments."

-Robert M. Lee, CEO and Co-Founder, Dragos, Inc.

Forescout

"Our integration with Microsoft Defender represents a significant step forward in helping organizations defend their most critical operations against today's rapidly evolving cyber threats. By combining Forescout's industry-leading visibility and protection for IoT, OT, and network-connected assets with Microsoft's leadership in endpoint, identity, cloud, and security operations, we're delivering a more unified approach to cyber defense. Together, we're enabling healthcare providers, government agencies, critical infrastructure operators, and enterprises comprehensive visibility across IT and OT environments while empowering security teams to detect, investigate, and respond to threats faster and with greater confidence."

-Robert McNutt, Chief Strategy Officer, Forescout

Armis

“Fragmented security is no longer an option as threats to critical infrastructure evolve at machine speed. By deepening our integration with Microsoft, we are unifying visibility and context in complex OT and IoT environments. Integrating Armis Centrix™ with Microsoft Defender equips security teams with real-time, actionable insights to identify and mitigate risks across their entire operational footprint.”

-Nadir Izrael, Group Vice President, Armis from ServiceNow

Bringing OT and IT Security Together

With these new integrations, signals, asset inventory and vulnerabilities from Dragos, Forescout, and Armis from ServiceNow flow directly into Microsoft Defender — giving security operations teams a single, unified view across IT, OT, and IoT.

What this means for customers:

Unified visibility across IT and OT. OT assets and vulnerabilities surface alongside IT signals in Defender, so the SOC can see and reason about them in one place.
Cross-domain correlation. Identity, endpoint, cloud, and OT signals are correlated automatically.
Streamlined investigation and response. Analysts can pivot from an OT detection to related IT activity (and back) without switching tools or losing context.
Specialized depth, unified breadth. Customers keep the deep OT expertise of their chosen partner platform and gain the enterprise-wide coverage of Defender.

Let’s take a look at some of new the user experience updates that showcase these integrations.

Figure 1. Discovered devices by OT partner in device inventory

The Device Inventory now will show OT devices discovered through a new partner integration (see Figure 1). Industrial assets like substation relays and switches from vendors are automatically surfaced with rich context, criticality, vendor, model, firmware, and discovery source alongside built-in recommendations to classify critical assets and protect unmanaged OT devices. The result: unified visibility across IT and OT from a single view, so security teams can find, prioritize, and protect previously unseen devices faster.

Figure 2. Vulnerabilities and exposure across OT devices

The Vulnerabilities view now includes a dedicated OT Partner CVEs tab, surfacing thousands of vulnerabilities on operational technology devices discovered through partner integrations. Every CVE is enriched with severity, CVSS score, age, active threats, and exposed device count, and the list is sorted by exposure so the most widespread, highest-impact risks rise to the top. Most importantly, security teams can now see OT vulnerabilities alongside IT in a single, prioritized view, making it faster to focus remediation where it matters most.

Figure 3. Discovered devices exposed by OT integration

Selecting a CVE opens a detail panel with a dedicated Exposed devices discovered by OT partner tab, listing every affected device along with its OS platform and last seen date. For CVE-2024-7264, that means a clear view of all 75 exposed devices in one place, from OT controllers to sales workstations. The benefit is that security teams can move from a single vulnerability straight to the exact devices at risk, making it easy to scope impact and drive targeted remediation without leaving the view.

Figure 4. Discovered vulnerabilities by OT integration

Drilling into a specific device, like the Substation-North-HMI2 shown here, reveals a dedicated Discovered vulnerabilities by OT partner tab alongside the standard device views such as incidents, timeline, and security recommendations. It lists every vulnerability found on that device by the OT partner, complete with severity, CVSS score, publication and detection dates, and active threats. The benefit is a complete, device-level picture of OT risk right where analysts investigate, so they can see exactly what a single asset is exposed to and prioritize remediation without switching tools or context.

Built for customer choice and flexibility

We’re excited to expand our integration ecosystem, giving customers the flexibility to work with the OT solutions they already trust. These integrations help bring specialized OT context into broader security workflows, enabling SOC teams, risk managers, and security leaders to collaborate more effectively while using the tools that best fit their environment.

Get started

The Dragos, Forescout, and Armis integrations are available in public preview starting today. Customers can enable them through the Defender portal and begin ingesting OT signals from their partner platform of choice.

Ask Microsoft Anything: Attack Disruption with Microsoft Defender on July 14

TrevorRusher — Tue, 07 Jul 2026 18:55:19 GMT

Hey Defender enthusiasts! Just wanted to remind you all that we are holding an AMA next week at 9AM PST on July 14 with the Attack Disruption team. Come learn about Attack Disruption—Microsoft Defender’s built‑in, AI-powered capability that stops in‑progress attacks at machine speed by analyzing attacker intent, identifying compromised assets, and containing threats before they spread. Bring your questions and hear directly from product experts on real‑world scenarios and best practices.

Hope to see you there!

Event Link: Ask Microsoft Anything: Microsoft Defender Attack Disruption | Microsoft Community Hub

DefenderXDR "Preparing new space for data and connecting them" is stuck , and never finished !

PanosGR191 — Tue, 07 Jul 2026 18:08:06 GMT

Hello everyone,
I am delivering SC-200 courses and on the lab environment of Skillable (or even free-tiers) when you have to "initiate" the data space for DefenderXDR, the process seems to be stuck .... never finished and we are "locked" in the page of a ...coffee cup and the phrase
"Hang on. We are preparing new spaces for your data and connecting them. "

does anyone else have same problem ?
Any resolution , (I have already open a support ticket to Skillable support, but I haven't got resolution for over 1+day , and cannot open or continue the lab (for connecting or onboarding Microsoft Defender for Endpoint ) which is frustrating for the participants-students

Thanks
Panos

Looking for a simple deployment guide

MeatBear11 — Tue, 07 Jul 2026 16:17:36 GMT

MS Learn is a great starting point, but it just doesn't seem to cover the steps needed to get up and running safely.

I have concerns about adding or setting something that suddenly creates a vulnerability or exposure. Where is the installation guide that installs and configures the solution then tells you, "You are now protected". Do I really want to set my own policies? Why aren't the default set of rules good enough, safe enough. I can't have a solution that is so complicated I need to hire a team to manage it 24 hours a day. I am okay investigating an alert and helping a user solve a pop-up question. Why is every major corporation around the world required to re-invent the same or similar policies the company next door is creating to make this tool work?

I want to onboard all of our Intune devices and monitor anything that CAN'T be stopped by default security measures. Just the fact that Sentinel appears to be changing as an embedded tool within Defender gives me hope that this will be getting closer to a more manageable tool. But that still seems a way off.

I am ready to do the reading and research to get this set up but I am hoping for a guide that is specific enough to achieve a final result.

Thank for understanding my challenges here.

Feature Request: Manual Invocation Mode for Embedded Security Copilot Experiences to reduce cost !

PanosGR191 — Sun, 05 Jul 2026 16:32:54 GMT

Hello, I see that Copilot for Security in XDR dashboards , if used in embedded mode (I mean whenever you are opening a case to investigate) you get AUTOMATICALLY a summary of the incident , and you are consuming SCU costs.

I want a way either globally as a tenant option, or through a pwsh to be able to DISABLE this, or be able to PRESS the AI button AND THEN generate the AI reply (and consume SCU credits ..)

Current behavior:

Open Incident --> Copilot automatically generates Incident Summary --> SCUs ARE consumed

Desired behavior:

Open Incident --> No AI execution --> Click "Generate Summary" MANUALLY --> SCUs consumed

I am not talking about RBAC controls to assign WHO of my admins can use Security Copilot, I have set that, BUT I want my admin to decide IF they want AI to help them (and consume - pay for that SCU credits-costs) OR NOT !!

At the moment I havent found any solution, except to educate my admin to press CANCEL the moment he/she opens such an XDR dashboard ! :)

Does anyone knows something ?

Regards, Panos

Monthly news - July 2026

HeikeRitter — Wed, 01 Jul 2026 09:30:09 GMT

Microsoft Defender
Monthly news - July 2026 Edition

This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from June 2026. We are now including news related to Defender for Cloud in the Defender portal. For all other Defender for Cloud news, have a look at the dedicated Defender for Cloud Monthly News here.

🚀 New Virtual Ninja Show episode:

Weekly Security News: We publish a short 1ish minute video every week with updates across our Microsoft Security stack. Subscribe to our YouTube channel, so you don't miss the next episode.

Actionable threat insights (find all of them here)

Microsoft Defender

Two Workbooks capabilities in the unified Microsoft Defender portal moved to GA:
- Advanced Hunting connector - build custom dashboards directly on top of Advanced Hunting (XDR) dat. Query XDR tables and visualize them in Workbooks for richer investigations and reports.
- Workspace filter / multi-workspace experience - scope and filter workbooks by workspace, with workspace selection integrated into the workbook itself rather than relying on the global selector.
MTO Tenant Groups let MSSPs and large enterprises organize their multitenant view in Microsoft Defender by grouping tenants logically (e.g., by region, business unit, or customer cohort). Learn more here.
Custom Detections support in Microsoft Sentinel Repositories. Custom Detections can now be managed as code in Microsoft Sentinel Repositories, the same way customers already manage analytic rules, playbooks, parsers and workbooks. Detection engineers connect a GitHub or Azure DevOps repo to their workspace; Custom Detections placed in the repo are reconciled on every commit. A standalone Bicep path via the Microsoft Security Bicep extension lets teams deploy from any CI/CD pipeline (ADO Pipelines, GitHub Actions, custom runners).
(General Availability) The following advanced hunting schema tables are now generally available:
- The CloudAuditEvents table contains information about cloud audit events for various cloud platforms protected by the organization's Defender for Cloud.
- The CloudDnsEvents table contains information about DNS activity events from cloud infrastructure environments.
- The CloudProcessEvents table contains information about process events in multicloud hosted environments.
(Public Preview) The AgentsInfo table in advanced hunting is now available in preview. The AIAgentsInfo table is transitioning to this new table, which provides a unified schema that supports agent inventory and governance for all agent types, including Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents. Microsoft Agent 365 customers should use the AgentsInfo table today. The AIAgentsInfo table remains accessible until July 1, 2026. Update your queries to use AgentsInfo before this date. For more information, see Advanced hunting schema - Naming changes.
For all other Sentinel News, have a look at the "What's new in Microsoft Sentinel blog post - June edition"

Identity Security

(Public Preview) The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live. For more information, see Identity Security dashboard.

Identity Security dashboard overview

(Public Preview) On the Coverage and maturity page, the Review and improve coverage side panel for SaaS Identities now includes an Observed column and a Show Only Observed Applications toggle. By default, the panel shows only SaaS applications detected in your environment. Turn off the toggle to see other supported SaaS applications you can onboard to expand your identity coverage. For more information, see Coverage and maturity.
New alerts were added to the Defender for Identity security alerts related to Microsoft Entra ID, Active Directory as well as other identity providers. For a full list of those new alerts, check out our documentation.
Recent ShinyHunters attacks on Salesforce show how OAuth tokens and connected apps are being weaponized to bypass MFA at scale. The upgraded Salesforce connector for Defender for Cloud Apps helps detect these attacks faster, with richer connected-app context and investigation-ready signals. Customers already using the connector are advised to enable the additional events in the Salesforce console for tighter protection, and eligible customers not yet using it are advised to connect Salesforce. Learn more.

Microsoft Defender for Endpoint / Microsoft Defender Vulnerability Management

(Public Preview) Local AI agent discovery: as part of the Defender AI agents experience, Microsoft Defender now automatically discovers supported local AI agents running on onboarded Windows & macOS devices. Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization. For more information, see Discover local AI agents.
AI Assets page
(Preview) Local AI agent runtime protection on Windows endpoints is now available in public preview. Microsoft Defender inspects the agent loop (user prompts, tool calls, and tool responses) and can block risky activity before it executes, helping stop prompt injection and unsafe agent actions at the device level. Blocked and audited events appear as alerts in Microsoft Defender to support incident correlation and investigation workflows.
The new version of the Defender deployment tool for Windows streamlines onboarding and enhances security by:
- Bundling the onboarding package directly into the tool's executable.
- Generating a key during deployment package creation that is required for running the tool.
- Enabling users to configure an expiry date for the package to reduce the risk of unauthorized use.
  In addition:
- You have the option of downloading the package as either an .exe or a .zip file, whichever best suits your organization's needs.
- A new Deployment packages page in the Defender portal facilitates management of downloaded packages by providing centralized visibility into all the packages and their current status.
Now generally available: Selective Response Actions enables organizations to tailor high-impact security operations on devices during onboarding. It provides precise control over how response actions are applied on Tier-0 systems and other high-value assets, helping maintain operational stability while delivering strong protection.
Enable selective response actions
The new exposure score model in Defender Vulnerability Management is now generally available. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such as internet-facing status and criticality. More details here.
Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface. This recommendation provides centralized visibility into internet-facing devices across the environment.
Many predefined SaaS application classification rules were added to the critical assets list. Have a look at our documentation for the full list. These classifications require onboarding to Microsoft Defender for Cloud Apps.

Defender of XDR - Quarantine - Lack of filter/search options

DarkingDK — Wed, 01 Jul 2026 05:55:09 GMT

Hi Microsoft,

I love what you're doing with the Defender XDR portal, but could you please show some love to the Quarantine section soon?

On a daily basis, I have to review emails caught in quarantine for false positives, and the lack of search and filtering options is appalling.

As a company based in Denmark, 99% of legitimate emails come from .dk domains. Yet there is no way to search for or filter on something this simple.

If I type .dk into the search box, I get 0 results, even though I can clearly see .dk sender addresses on the page. The filter options only allow me to enter full sender or recipient email addresses, which is of course almost useless in a quarantine-review context.

Some examples of filters that would be extremely useful:

Sender domain ends with .dk
Sender domain contains .dk
URL domain filtering
Attachment name filtering
Saved filter views
More flexible search across message properties

The Quarantine experience could be made dramatically better with relatively little effort.

So please, pretty please, give the Quarantine portal some attention. It's often the part of Defender that security teams interact with every single day.

Need information on generating sample events for Threat Intelligence" (both duplicate posts)

gokhantatar — Tue, 11 Aug 2026 13:58:39 GMT

Two things are tripping this up, and they're common mix-ups:

First — Attack Simulation Training doesn't generate Threat Intelligence events. If you used the built-in phishing simulator, its logs only show up under Email & collaboration → Attack simulation training → Simulations — they're intentionally excluded from real Threat Intelligence telemetry. That's likely why nothing's showing up even though you ran a campaign.

Second — your EICAR test should actually work, but check the right place: not the generic Office 365 Management Activity API's AuditLogRecordType page in isolation — go specifically to the RecordType values used for Defender for Office 365 threat events:

28 = ThreatIntelligence (phishing/malware events)
41 = ThreatIntelligenceUrl (Safe Links time-of-click/block events)
Plus ThreatIntelligenceAtpContent, ThreatFinder, MSTIC

To reliably generate one:

Confirm Purview audit logging is enabled for the tenant first — if it isn't, nothing downstream gets logged regardless of what you trigger.
From an external mailbox, send a test user the EICAR string as a .txt attachment (exact 68-byte string, see Microsoft's anti-malware testing doc). Defender for Office 365 should detect and quarantine it.
Verify it landed first in the portal UI: Email & collaboration → Explorer → Malware tab — if it's there, the underlying ThreatIntelligence record exists and the Management API call should return it (allow a short delay; these aren't instant).
For the Safe Links side, send a known-safe-but-flagged test URL (Microsoft publishes test URLs for this) to trigger ThreatIntelligenceUrl.

If it shows up in Explorer but still doesn't appear via the Management API, that's usually an API subscription/permission issue (you need an active subscription to the DLP.All or relevant Office 365 Management API content type, not just Graph permissions) — worth checking separately from the detection side.

Can the Microsoft Defender portal show the server details as per security group?

gokhantatar — Tue, 11 Aug 2026 13:58:34 GMT

Yes — this is exactly what Device Groups + RBAC are designed for in Microsoft Defender (assuming you're managing these servers through Defender for Endpoint, which is the typical path for cross-vendor server monitoring).

The model:

Device groups are the scoping unit (not Entra security groups directly) — create one per vendor/company (e.g., "Company A Servers", "Company B Servers"), using a matching rule (tag, OS, name pattern, etc.) to auto-assign devices.
RBAC roles then get tied to an Entra security group and granted access to only specific device groups. So: Company A's people go in an Entra group → that group is assigned an MDE role scoped to "Company A Servers" only → they only ever see those devices, alerts, and incidents in the portal.
You as admin keep your existing Global Admin/Security Admin role (or get added to both device groups' RBAC scope), so you retain visibility across both.

Path: Settings → Endpoints → Permissions → Device groups to create the groups, then Permissions → Roles to create a role and tie it to your Entra security group with that device group as the scope.

One thing to verify before committing to this design: this RBAC model affects what shows in alerts, incidents, advanced hunting (scoped automatically), and inventory — but make sure nobody from Company A/B also needs organization-wide Defender features like global threat analytics, since those aren't scopable the same way.

If you're actually talking about servers monitored via Defender for Cloud (Azure subscription-based, not MDE-onboarded), the equivalent mechanism is Azure RBAC at the subscription/resource group level (assign Security Reader scoped to the RG containing Company A's VMs) — different mechanism, same outcome. Worth clarifying which portal/product this is so the right one gets recommended.

Microsoft Defender Incident – Handling incident severity change

gokhantatar — Thu, 25 Jun 2026 20:27:49 GMT

There's no dedicated history/audit endpoint for field-level transitions (like "this incident went from Low → High at timestamp X") in the /security/incidents Graph API — the incident object only exposes the current severity plus a lastUpdateDateTime, not a change log. So this isn't something you're missing; it genuinely doesn't exist as a queryable history today.

Also worth knowing before you build around it: Graph change notifications (webhooks) are not documented as supported for /security/incidents — subscription/webhook support is only documented for the legacy /security/alerts resource, and that resource is deprecated with removal expected around April 2026. So polling is currently the only supported pattern for incidents specifically, not a limitation of your approach — there's no webhook alternative to fall back to yet.

Given that, the fix is in your polling strategy, not in finding a hidden feature: instead of filtering once at creation time and then ignoring the incident, poll using $filter=lastUpdateDateTime gt {last_poll_timestamp}. Since lastUpdateDateTime bumps on any property change — including a severity escalation — this catches incidents that started as Low/Informational and later got escalated, without re-fetching everything.

A pattern that works well in practice:

GET /security/incidents?$filter=lastUpdateDateTime gt {last_poll_time}&$orderby=lastUpdateDateTime asc

Then in your own store, diff the incoming severity against what you last recorded for that id to detect the transition yourself — you're effectively reconstructing the history client-side since the API won't give it to you natively. Store (incidentId, severity, lastUpdateDateTime) on each poll and compare.

One gotcha: this still won't tell you the exact moment the severity changed if multiple fields changed between polls — only that it changed sometime between your last two poll timestamps. If you need second-level precision on transition timing, you'd need to poll more frequently (your 5-minute interval is probably fine for SOC triage purposes, but not for precise SLA timestamping).

Is "Endpoint Security Policies" available to us? (error getting Intune policies)

goslackware — Thu, 25 Jun 2026 14:28:35 GMT

Question

We'd like to use Defender \ Endpoint Security Policies.

Is that possible for my tenant's environment?

Getting below error on "Defender \ Endpoint Security Policies" page

"There seems to be an issue getting your Intune policies"

Details of our environment

Purpose of defender

To protect our server fleet that's running outside of Azure

Tenant

GCC - Moderate Scoped

Region

Commercial Azure East US 2

Subscription

Microsoft Defender for Servers Plan 1

(No other subscription, etc.)

Defender Client OS

Windows 2016, 2019, 2022

RHEL8, 9

(No desktops\laptops)

Agents installed on each Windows and Linux server

Defender is onboarded

Arc is onboarded

Configured Settings and Errors

Defender \ Settings \ Configuration management \ Enforcement scope

https://security.microsoft.com/securitysettings/endpoints/configuration_management2

Error at top of page

"Intune is not configured to allow Microsoft Defender for Endpoint to manage security configuration settings."

Use MDE to enforce security configuration settings from Intune

Set to ON

Enable configuration management

Windows Server devices

On tagged devices

Windows Server Domain Controller devices

On tagged devices

Linux devices

On tagged devices

Security settings management for Microsoft Defender for Cloud onboarded devices.

Set to ON

Manage Security settings using Configuration Manager

Set to OFF

Defender \ Settings \ Configuration management \ Intune Permissions

https://security.microsoft.com/securitysettings/endpoints/intune_permissions

Getting error

"Access needed

You don't have the right permissions in AAD to view this information (in addition to those you already have in MDE). To adjust your permissions, go to the AAD portal."

Defender \ Endpoint Security Policies

https://security.microsoft.com/policy-inventory

On main page, getting below error

There seems to be an issue getting your Intune policies

If I try to make a new policy

There seems to be an issue loading the policy authoring wizard.

Intune \ Endpoint security

https://intune.microsoft.com/#view/Microsoft_Intune_Workflows/SecurityManagementMenu

Getting Error

You don't have access

Intune roles | My permissions

https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/RolesLandingMenuBlade/~/myPermissions

You're an administrator with full permissions to all Microsoft Intune resources.

Intune roles | Administrator Licensing

https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/RolesLandingMenuBlade/~/administratorLicensing

Allow admins without an Intune license to access Intune. Their scope of access is determined by the Intune roles you've assigned them.

I've clicked the box "Allow access to unlicensed admins"

Alternatives

If Defender \ Endpoint Security Policies isn't available, as alternatives, I guess we could use

SCCM Antimalware policies to manage Windows servers

Deploying a central mdatp_managed.json to manage Linux servers

However, it would be greatly preferred to use the Defender \ Endpoint Security Policies feature for Windows and Linux

Securing the invisible workforce

Nagaraj Venkatesh — Wed, 17 Jun 2026 12:35:52 GMT

Non-human identities are now the majority of the identity estate in most enterprises. Service principals access organizational resources across SharePoint, Azure, and Microsoft 365, Service accounts run critical business processes on-premises, OAuth apps move data across SaaS boundaries, and AI agents increasingly operate autonomously at machine speed.

As NHIs have grown in number and importance, so to have the threats targeting them. Midnight Blizzard showed how damaging compromised NHI can be. Attackers moved laterally across cloud resources and accessed sensitive data without ever triggering user-centric controls like MFA. The challenge many security teams are faced with however is that they simply do not have the visibility into what NHI’s even exist within their organization. Unlike their human counterparts, NHI can vary drastically in purpose, behaviour and risk profile. The one consistency is that most organizations lack a formal process for their creation, management and governance. For instance, while these identities often carry high and standing privileges, those permissions are typically granted at creation and never revisited. They authenticate programmatically so they cannot be enrolled in, or benefit from the protections of multi-factor authentication.

As AI adoption accelerates, this issue has become even more urgent. Every AI agent needs an identity to function. That identity accesses data, invokes APIs, and takes action, autonomously, continuously, and at an unprecedented velocity. But because AI tooling has moved faster than guidance, many agents were never given identities of their own, many riding on existing Service Principles. This means that those ordinary app registrations may in fact represent autonomous agents making decisions and taking action. This new reality further compresses the window between compromise and impact and makes securing non-human identities a prerequisite for safely deploying AI at enterprise scale.

Today, I am excited to share more about the non-human identity protection available within Microsoft Defender. These capabilities bring NHIs into the same unified platform where security teams already work and protect human identities with purpose-built experiences for discovery, risk assessment, business context, governance, threat detection, and attack disruption.

The Challenge:

We hear consistently from customers that they cannot answer fundamental questions about their NHI estate:

How many non-human identities exist? Across Entra ID, Active Directory, and SaaS applications, the true count consistently exceeds expectations, often by an order of magnitude.
Which ones are still in use? NHIs accumulate over time. Decommissioning is rare and dormant identities retain active permissions indefinitely.
Which ones hold more access than they need? Permissions are granted broadly at provisioning and seldom revisited. Over-privilege is not the exception—it is the default state.
Who is responsible for them? Without established ownership, remediating a risky NHI requires significant manual effort just to identify the right person to engage.
Which ones are powering AI agents? Many agents ride on NHIs created long before the agent existed, making them indistinguishable from routine integrations.

These are the questions that drive the capabilities we are delivering.

Raising the bar for NHI protection with Defender

Microsoft Defender helps protect non-human identities through six integrated focus areas: Visibility, Risk analysis, relationships and access mapping, governance policies, AI Agent awareness and Detection and Disruption. Together, these areas help organizations discover NHI risk, understand relationships and permissions, enforce governance, identify AI-driven identity activity, and detect or disrupt threats before they escalate.

1. Visibility:

When Entra service principals, Active Directory service accounts, and SaaS-connected OAuth apps are managed in separate consoles with separate workflows, security teams cannot form a coherent picture of NHI exposure. These gaps in visibility translate directly into gaps in protection.

Defender delivers a unified identity inventory for both human and non-human identities within a single view and investigation workflow. For non-human identities, coverage includes:

Source	Coverage
Microsoft Entra ID	All service principals
Active Directory	All service accounts
SaaS Apps	All OAuth-connected apps

Unified visibility across all non-human identities in a single pane of glass

This consolidated inventory is the foundation that security insights, risk scoring, business context, governance, and threat detection all build on. Security teams work from one place, using the same investigation workflows they already use for human identities, across the entire NHI population.

2. Risk insights and analysis:

Visibility into what exists is the starting point. What security teams need next is a clear understanding of which identities carry risk, what kind of risk, and how they should prioritize. Similar to how we review risk signals for human identities, Defender continuously evaluates the NHI estate and surfaces findings across key risk pivots:

Actionable insights into your unique NHI footprint

Unused Identities

NHIs that have not authenticated over extended periods but retain active permissions. These identities serve no current business purpose while remaining fully available for misuse if compromised.

Over-Privileged Identities

NHIs whose granted permissions significantly exceed their observed usage. Defender analyses the gap between what an identity can do and what it actually does, identifying where privilege can be safely reduced without impacting operations.

High-Privileged Identities

Some NHI’s however require elevated roles or broad permissions to perform their intended use. These NHIs pose the highest lateral movement risk if compromised. For context, these privileges can sometimes exceed the access held by admins in the organization.

Identity Risk Score for NHIs

The new Identity Risk Score within Defender also extends to NHI. Ever NHI now has a dynamic risk score , informed by Microsoft’s global threat intelligence, exposure indicators, and observed activity patterns.

The score is fully explainable. For every NHI, Defender shows the specific factors that contributed—what combination of privilege, exposure, and activity drove the assessment, and why. Analysts see the reasoning directly: an identity scored high because it is unused, holds broad directory permissions, and is published by an unverified publisher. This means analysts can act on the score with confidence, without needing to conduct a separate investigation to understand what it means.

These insights allow teams to rank their entire NHI estate by risk and systematically focus investigation where it matters most.

Risk insights for NHI for effective prioritization

3. Relationship mapping:

Knowing that an NHI is risky is necessary but not sufficient for remediation. Security teams need business context: what application depends on this identity, who owns it, what resources can it access, and with what permissions.

Without this information, even a critical finding stalls. Can we disable this identity, or will it break a production workflow? Who do we contact to coordinate? What is the scope of exposure if this identity is compromised?

Defender introduces a Graph for NHIs that visually maps these relationships directly.

Graph connecting risk to business context for faster remediation

What application depends on this NHI? Understanding downstream dependencies before taking remediation action.
Who owns it? Identifying the owner for coordinated response.
What resources or crown jewels does it access, and with what permissions? Determining the sensitivity of accessed resources to assess actual severity.

With this context directly available in the investigation experience, security teams can assess risk, evaluate business impact, and coordinate remediation without switching tools or conducting manual discovery.

4. Governance policies

When we extrapolate this out to enterprise scale, with thousands to tens of thousands of NHIs, manual remediation simply cannot keep pace with the rate at which risk accumulates. Organizations need governance policies that enforce decisions automatically and consistently.

Defender enables this through governance policies. Organizations can define policies that leverage the insights Defender surfaces like unused timeframe, privilege level, risk score, over-privilege status, AI agent association and then map them to automated disablement of identities that exceed acceptable risk.

Example: An NHI that has been unused for 90+ days, holds high-privilege roles, and carries a risk score above 70 exceeds the organization’s risk tolerance → disable the identity.

Automated governance policies that turn risk insights into enforcement at scale

This shifts NHI security from periodic audit cycles to continuous posture management. The NHI estate stays within organizational risk tolerance because policy enforces the standard automatically, at the scale the environment demands.

5. AI Agent awareness

Agents built on platforms like Copilot Studio, Azure AI Foundry, and third-party frameworks require identities to authenticate, access data, and take action. In practice, many agents operate using traditional NHI that were provisioned for other workloads, making them indistinguishable from routine integrations at the identity layer.

The risk profile, however, is materially different:

Agents are autonomous. They make decisions and execute actions without human approval at each step.
Agents are high-velocity. They perform hundreds of operations per minute across multiple systems.
Agents interact with sensitive data. They access documents, query databases, read communications, and invoke APIs, often with broad permissions to support flexible workflows.

When a misconfigured identity backs an AI agent, the risk compounds significantly because the agent continues to operate autonomously, with legitimate access, at machine speed, across whatever resources it can reach.

Defender infers which NHIs are used by AI agents and surfaces this signal directly in the inventory, risk insights, and assessment. This enables security teams to prioritize investigation of agent-backed NHIs and apply differentiated governance like stricter controls, shorter review cycles, and tighter privilege boundaries for identities backing

Visibility into service principals powering AI agents and their associated risk

6. Detection and disruption

Posture and governance reduce the attack surface. But when an attacker compromises a non-human identity, detection speed and response automation determine whether the attack is contained or succeeds.

Microsoft Defender brings the same detection and disruption capabilities that protect human identities to the non-human estate.

Threat Detection for NHIs

Defender detects anomalous and malicious activity involving non-human identities using behavioral analytics and Microsoft’s global threat intelligence. Detections are purpose-built for how NHIs operate because the signals indicating compromise in a NHI is fundamentally different from those in a human account, and our detection models reflect that.

Detecting anomalous and suspicious activities on non-human identities

Every alert is enriched with full context from the identity inventory, risk insights, and graph. Analysts see not just what happened, but which identity was involved, what it can reach, who owns it, and how critical it is immediately, without manual correlation.

Disrupting Attacker Persistence

We are introducing new disruption capabilities designed to address the persistence techniques attackers use against non-human identities. These capabilities focus on the specific actions that turn a legitimate non-human Identity into an attack path, such as adding credentials for off-tenant use or modifying permissions and role assignments to expand access.

Rather than broad remediation, the approach targets the exact moves attackers use to establish and maintain control. By directly addressing actions like unauthorized credential additions and privilege expansion, these capabilities help remove attacker access while preserving legitimate application functionality.

Why This Maters

Every AI agent requires an identity. As organizations scale agent deployments, the NHI estate grows with them and inherits every existing gap: over-privilege, absent ownership, insufficient monitoring.

What has changed is speed. An AI agent with a compromised identity operates autonomously and never sleeps. The window between compromise and impact has compressed to the point where periodic manual review is no longer adequate. Automated visibility, continuous risk assessment, policy-driven governance, and real-time detection and disruption are now requirements.

The organizations investing in NHI protection today are building the security foundation their AI strategy depends on.

Getting Started

Non-human identity protection is available in Microsoft Defender today:

Visit the unified identity inventory in Defender to see all NHIs across Entra ID, Active Directory, and SaaS.
Review risk insights to identify unused, over-privileged, high-risk NHIs, and NHIs used by agents.
Explore the identity graph to understand business context, ownership, and resource access.
Configure risk-based governance policies to enforce organizational risk tolerance at scale.

These capabilities are integrated into the same platform and workflows security teams already use for human identity protection—no separate tools, no additional deployment. Learn more about the NHI protections provided by Defender within our docs here.