The CISO Cheat Sheet to Microsoft Digital Defense Report 2026
I know we’re all busy, so I’ve pulled the most important data from this year’s Microsoft Digital Defense Report into one short read. The full report is well worth exploring, but this article focuses on the numbers and trends most relevant to security leaders. This year’s edition shows that AI is lowering the time, expertise and cost required to discover and exploit weaknesses, enabling attackers to operate with greater speed, scale and autonomy. The report describes this as AI “changing the physics of cybersecurity”: attack timelines are compressing and agentic systems are beginning to automate more of the attack lifecycle. Trend 1: Time has collapsed The clearest finding is about speed. Vulnerability discovery is increasingly running ahead of remediation, while the time from discovery to weaponisation is shrinking. In the AI era, weaponisation can follow in hours. Vulnerability discovery and weaponisation now often needs only a well-written prompt. The median time from discovery in the wild to weaponisation is below 24 hours. Vulnerabilities were on track for a record estimated 72,000 CVEs in 2026. The report expects a multi-year period in which the number of known but unpatched vulnerabilities rises sharply before eventually declining. The median time from container start to first exploit attempt is 5.3 hours. The ransomware actor Storm-1175 moved from web-facing exploitation to deploying Medusa ransomware in as little as 24 hours. CISA added over 110 CVEs to its Known Exploited Vulnerabilities catalogue between November 2025 and May 2026, most within a week of disclosure. The mismatch with enterprise reality is the uncomfortable part. The report says the disclosure-to-exploitation window has shrunk to single-digit days. Between November 2025 and May 2026, CISA added more than 110 vulnerabilities to its Known Exploited Vulnerabilities catalogue, most within a week of disclosure. In one example, Storm-1175 moved from exploiting a web-facing vulnerability to deploying Medusa ransomware in as little as 24 hours. Microsoft’s Red Team makes an important point: a patch is also a disclosure. Every fix points attackers towards the flaw it closes. As AI-assisted analysis makes reversing patches faster and more reliable, the report argues that patch velocity, not simply patch availability, becomes the control that matters. Trend 2: Attack chains are gaining autonomy The report charts a clear progression: September–November 2025: AI assists in orchestrating a campaign, as in the Anthropic-reported espionage case. April–June 2026: Full-chain autonomy is demonstrated in labs. July 2026: Real-world autonomous attacks of increasing complexity appear. Two frontier models, Mythos and GPT-5.5, completed a 32-step attack chain against an emulated enterprise with no human help. The test environment had no defenders. The UK AI Security Institute reached a similar finding independently. GPT-5.5 was the second model to solve its end-to-end corporate network attack simulation, a task AISI estimates would take a human about 20 hours. Open-weight models lag closed models at orchestrating attacks by about seven months. In the wild, early July 2026 saw the first documented automated ransomware extortion attack, named JADEPUFFER by Sysdig. Microsoft has seen AI-orchestrated intrusions that share elements with it. Initial access consistently came from internet-exposed services running known-vulnerable software. The report is measured on this point. Volumes of AI-orchestrated activity remain low. In most observed real-world operations, complex end-to-end intrusions still retain meaningful human direction. The Red Team's framing is the most useful one: AI doesn't create a new class of attack, it collapses the effort needed to find and exploit existing attack paths. Trend 3: AI has become an attack surface The report's second takeaway is that attackers are already targeting AI itself. The adoption numbers explain why. 88% of enterprises are experimenting with agents, and 82% of leaders plan broader rollouts within 12–18 months. The report cites industry projections of roughly 1.3 billion agents in production by 2028. What attackers are doing to AI systems: Four techniques accounted for roughly 90% of observed attack activity in telemetry from Azure AI workloads: malicious link injection (52%), jailbreaks (16%), tool and agent abuse (12%), and identity and credential abuse (10%). Memory poisoning: An attacker who can place content anywhere an agent reads can often place it where the agent remembers. Email is the dominant pathway the Red Team has observed. Human-in-the-loop isn't a complete control: Red team testing saw approval prompts ignored, or bypassed by a policy stored in poisoned memory. Developer tools turned against their owners: The "s1ngularity" malware hijacked locally installed AI command-line tools to hunt for secrets. It leaked about 2,000 secrets and 20,000 files across 225 victims. AI browsers: In daily use at more than 40% of organisations in Microsoft's dataset, they were the initial infection vector in incidents involving 57 malware families in a May 2026 analysis. Chat histories as a target: Malicious AI-assistant extensions reached nearly 900,000 installs and more than 20,000 enterprise tenants, harvesting AI chat histories that often contain code, architecture and credentials. The identity implications are direct. Each agent needs its own identity, not one borrowed from an employee, and a named human sponsor. The report also treats revocation latency, the time to cut off a compromised agent, as a measured outcome. Trend 4: The front door is still identity AI changes the speed and personalisation of social engineering. It hasn't changed where attacks start. Initial access in Defender Experts data: User execution: 30% Valid accounts: 20% Malicious copy-and-paste: 13% Phishing: 11% Together, user execution and valid accounts account for over half of observed activity. In incident response engagements, phishing as an initial access vector jumped from 7% to 23% year on year. The standout numbers: ClickFix: Defender saw user-pasted malicious commands on more than 1.1 million unique devices between February and early May 2026, roughly an 8x increase. AiTM: URLs accounted for 45% of the identified phishing techniques in the report’s breakdown. Separately, the share of AiTM phishing and token-theft attacks more than doubled during the first six months of 2026, although the report notes that their overall share remained comparatively small. Teams vishing: Weekly confirmed malicious volume increased 502% year on year. Per attempt, 48% of vishing calls kept the victim engaged for more than 20 seconds, and 30% lasted more than one minute. When a call succeeds, attackers can persuade the victim to install a remote-management tool and complete reconnaissance in two minutes or less. Business contact impersonation (BCI): The report introduces this term for conversations that start with a trusted-looking contact. Microsoft detected more than 46 million attacks in 12 months, with a 121% spike in April 2026. The share of first-contact messages that explicitly asked for money or documents fell from 17% to 3%. The first message is deliberately bland, like "Are you at your desk?" Password attacks declined 26% year on year, which the report describes as strong evidence that MFA and passkeys are forcing attackers to pivot. That pivot includes techniques such as fatigue attacks, AiTM phishing and token theft designed to circumvent conventional MFA. Trend 5: Attackers are inheriting trust rather than breaking in The report's headline theme is that risk is increasingly interconnected. Threats travel through the trusted relationships between identities, software supply chains, partners and cloud platforms. The numbers: Supply chain: Major open-source ecosystems saw attacks roughly every ten days, accelerating through Q2 2026. Shai-Hulud 2.0 affected 25,000 repositories. Megalodon backdoored 5,561 GitHub repositories in under six hours. Trusted signing: In May 2026, Microsoft disrupted Fox Tempest, a "malware-signing-as-a-service" operation that obtained genuine certificates for ransomware loaders and infostealers. Microsoft revoked over a thousand fraudulent code-signing certificates. Legitimate access: An unsanctioned remote monitoring tool is now one of the most reliable mid-stage indicators of a human-operated intrusion. Cloud identity: Cloud identity abuse was the most observed technique against critical infrastructure, representing 78% of the technique mix in Microsoft’s data for March to June 2026. Hybrid intrusions: The Storm-2885 case showed an attacker using a privileged cloud identity to close and downgrade security alerts. The report says identity governance and alert-handling workflows deserve Tier 0 treatment. Dwell time: DART data shows a statistically significant increase in dwell time year on year, meaning organisations took longer to detect intrusions. Ransomware shows the same ecosystem pattern. Qilin led leak-site data with 16.4% of victims, up 386%. Defender detections tell a different story, with Akira at 22%. Trend 6: Defence works best when it's connected The report is not only a catalogue of threats. The strongest defensive evidence: Disruption works. Following the March 2026 disruption, Tycoon2FA activity had fallen 95% from its November 2025 peak by June. Its share of CAPTCHA-gated phishing declined from 76% in December 2025 to 12% in June 2026. Correlation is the highest-leverage variable. The report argues that how well defenders share and correlate signals across endpoint, identity, cloud, email and network is one of the highest-leverage strategic variables under their control. AI is also changing defensive operations. The report describes AI-assisted triage, incident summarisation, hunting-query generation and detection engineering as ways to accelerate investigations and allow analysts to concentrate on higher-value work. Automated disruption can compress response time. The report says that when a correlated incident reaches a defined confidence threshold, defensive systems can automatically isolate devices, disable compromised accounts, revoke sessions or quarantine affected cloud resources. It also stresses the importance of appropriate governance and human oversight for high-risk AI actions. The report also recommends changing what leaders measure. It suggests moving from patches deployed to exposure reduced, detection coverage increased and time-to-mitigate compressed. What the MDDR recommends: ten security priorities The report starts its recommendations with the foundations: Secure by Design, Secure by Default and Secure Operations, applied through identity-centric Zero Trust. Microsoft says these keep the priorities below durable as AI adds more identities, applications, agents and dependencies to govern. Govern cyber risk at leadership level. Report identity exposure, patch latency, agent permissions, critical dependencies, dwell time and recovery readiness to the board. Defend identity as the primary control plane. Deploy passkeys and phishing-resistant MFA, reduce privilege and govern human and non-human identities. Invalidate and rotate tokens and session credentials quickly. Establish governance, visibility and data controls for AI. Keep visibility of approved AI tools, services and agents, and monitor for unauthorised or unmanaged use. Apply sensitivity-aware access and data protection to the data those systems can reach. Reduce exposure and edge risk. Continuously discover internet-facing assets and patch edge devices quickly. Centralise high-fidelity logging, enforce strong authentication and combine network visibility with threat intelligence. Focus on cross-signal correlation. Correlate endpoint, identity, cloud, application, email and network signals to detect intrusions earlier. Correlation also helps defenders anticipate attack paths and likely targets. Enact a continuous threat and vulnerability management model. Combine asset visibility, vulnerability identification, threat detection and AI-accelerated insight into a single continuous programme. Validate exposure through proactive testing. Run assume-breach exercises on cloud services, SaaS platforms, APIs and workflow automation. Prioritise them by where your highest-value data is stored, accessed or aggregated. Secure software dependencies. Harden software installation, keep a software inventory and validate provenance. Monitor packages and prepare for rapid containment. Participate in collective defence. Share actionable threat indicators and victim-informed intelligence with trusted partners and law enforcement. This supports coordinated tracking, investigation and disruption. Prepare for long-horizon technology transitions. Build a cryptographic inventory and advance post-quantum planning alongside AI governance. Read together, the numbers tell one story: the attacker’s workflow is becoming faster and less expensive. AI can shorten vulnerability discovery, exploitation, secret discovery and lateral movement, while organisations still face the slower operational work of testing, coordinating and deploying safe changes across complex environments. At the same time, agent identities can proliferate faster than organisations can inventory, govern and revoke them The defining question for boards today is not whether disruption will occur, but whether the organization can continue operating, contain harm, recover quickly, and maintain trust when it does. Source: Microsoft Digital Defense Report 2026, Version 1.1. Reporting period: July 2025–June 2026.
Defending Linux in the age of AI-operated attacks
Linux supports cloud services, containers, developer environments, business-critical applications, and a growing share of AI infrastructure. That makes Linux both essential to modern enterprises and increasingly attractive to attackers. AI is compressing the time required to research targets, vary payloads, and adapt when an attempt fails. Customers need protection that can recognize modern attacker behavior at runtime, continuously test effectiveness against realistic attacks, and learn and evolve with the threat landscape. That’s why Microsoft Defender is focused on three priorities for Linux: stronger runtime protection for fileless and in-memory attacks, continuous validation that proves protection remains effective, and AI-powered defense that can help security teams simulate attacks, investigate threats, close protection gaps, and reduce exploitable paths before compromise. A new Linux threat model The threat landscape has evolved from AI-assisted attacks, where people use AI to accelerate individual tasks, to AI-operated attacks, where AI coordinates more of the attack chain, and now it is moving to autonomous AI attacks that can adapt and act with limited human direction. Modern Linux attacks rarely depend on one file; they combine exposed services, stolen credentials, legitimate administration tools, scripts, containers, and cloud-native attack paths. As AI helps attackers generate and modify payloads at scale, adapt when an attempt fails, and move through the attack chain faster, defenders can no longer assume that every payload, script, or binary will resemble something they have seen before. Microsoft Security Research recently observed compromises involving a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment. The intrusion paths differed, but the objectives converged around credential theft, persistence, downstream access, and compute monetization. The broader lesson is that AI gateways, retrieval platforms, and orchestration services are becoming high-value control points where data, credentials, model connectivity, and workload execution meet. These examples also highlight a broader shift: attackers increasingly abuse legitimate services, tools, and workflows rather than relying solely on overtly malicious binaries. Viewed one event at a time, Bash, Python, curl, SSH, and network connections can appear legitimate. The security challenge is to understand their sequence, process relationships, destinations, and runtime context. That is why Linux protection in Defender is grounded in recognizing attacker behavior, not just known files. Behavior-based runtime protection for modern attacks Defender brings together next-generation protection, endpoint detection and response (EDR), vulnerability management, advanced hunting, investigation, and response to provide protection and visibility across the attack lifecycle. Behavioral protection evaluates process relationships, command lines, scripts, and runtime activity to identify malicious execution based on what is happening on the device. This is particularly valuable when attackers use legitimate tools or changing payloads that may not appear suspicious in isolation. Targeted memory inspection, now in public preview, extends protection to supported threats that operate in memory and may leave limited evidence on disk. Defender uses runtime behavior to focus inspection on relevant processes and execution activity. By concentrating inspection where suspicious behavior is observed, Defender delivers in-memory protection while minimizing unnecessary scanning and associated performance overhead. Consider an attacker who gains access through an exposed Linux application, executes commands, moves malicious activity into memory, launches additional processes, and connects to attacker-controlled infrastructure. Defender creates opportunities to block the attack, detect suspicious runtime activity, correlate related signals, and disrupt further impact. These are not isolated protection points. Different layers of Defender work together to build one complete picture as an attack progresses. Changing a payload or technique does not remove the behavioral, process, memory, and network signals that can expose malicious activity. From malicious activity to an actionable incident Defender protection on Linux executes a four-step process: block malicious behavior, detect suspicious runtime activity, correlate related signals into an incident, and disrupt the attack before it causes further impact. 1. BLOCK Malicious behaviour stopped. 2. DETECT Suspicious runtime activity surfaced. 3. CORRELATE Related evidence connected into an attack graph. 4. DISRUPT Malicious activity contained to limit impact. In these sample screenshots, you can see how Defender turns runtime activity into a connected incident that security teams can investigate and respond to. Connecting DNS activity to Active Incidents Microsoft Defender now provides DNS visibility on Linux. Network connections are enriched with the domain being contacted, and DNS activity is attributed to the process that requested it. When these domains are correlated with Microsoft Threat Intelligence, Defender can identify Linux servers reaching out to known malicious infrastructure and connect that activity to the process chain behind it. This gives security teams earlier detection and clearer context when investigating a potentially compromised Linux server. In an attack, a compromised Linux server could execute malicious commands, download payloads, and connect to attacker-controlled infrastructure. The example below shows how DNS activity can appear within the incident, helping investigators trace the connection back to the process behind it. Continuous validation and coordinated defense Protection is only meaningful when it performs against real attacks. Customers continuously validate Linux protection across leading breach-and-attack simulation and penetration-testing platforms, including AttackIQ, SafeBreach, Cymulate, Metasploit, and Picus. Repeatable testing helps expose coverage gaps, identify regressions earlier, strengthen behavioral detections, and verify resilience as payloads and attack paths change. Deterministic scenarios remain the foundation because they provide repeatability and measurable coverage. Over time, specialized security models can complement them by helping teams develop controlled tests for their environment, explore alternative attack paths, and continuously validate that protections are effective. Project Perception outlines Microsoft’s direction for connecting signals, context, security models, and specialized agents into a coordinated defense system that continuously learns while keeping people in control of high-impact decisions. Microsoft’s differentiated advantage is the breadth of its security vantage point: more than 100 trillion security signals processed each day provide the threat intelligence and context to continuously improve detection and defense. For Linux, this direction connects attack simulation, investigation, vulnerability context, and protection improvement into a continuous loop—reducing exploitable paths before compromise, limiting attacker movement during incidents, and extending runtime protection to emerging AI workloads. Looking ahead Linux will remain central to cloud services, developer platforms, and AI infrastructure. Our commitment is to help customers identify critical gaps, test protection against changing attack paths, reduce opportunities for exploitation, and strengthen Linux defense continuously as attackers and defenders operate at AI speed.
Prompted to sign in to Microsoft Defender Platform on W11/W2025 using Entra
Hi Microsoft Defender XDR community, Since around May 18th, our users on devices that are onboarded to Microsoft Defender for Endpoint are being prompted to sign-in to the following application using Entra on login to Windows. Application Microsoft Defender Platform Application ID cab96880-db5b-4e15-90a7-f3f1d62ffe39 Is anyone aware of a change that requires user sign-in to Entra as a requirement for Microsoft Defender for Endpoint? I have tried raising a support topic on this topic. Regards ChrisNow generally available: Discover local AI agents with Microsoft Defender
As local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough. Unlike static software, local agents such as coding assistants, command-line agents, desktop applications, and agentic development environments can operate on endpoints with access to a user's data, credentials, tools, and services. They can also connect to Model Context Protocol (MCP) servers that extend their access to additional tools and data. This change requires security teams to look beyond. They need to understand which local agents are running and where, which users and devices these agents are associated with, and which MCP servers these agents are configured to use. To address this challenge, at Microsoft Build 2026, we introduced new Microsoft Defender capabilities to help security teams discover and protect more than 20 types of local AI agents. Today, discovery of AI agents and their configured MCP servers on Windows and macOS is generally available, with discovery coverage expanded to more than 50 supported agents and MCP servers. On eligible, onboarded devices, Defender discovers supported agents by observing their activity and brings the agent, device, account, and configured MCP context together to give security teams visibility for their local agent environment. Beyond discovery, runtime protection for local agents for Windows continues to be available in preview, helping protect discovered agents as they operate. Teams can deploy runtime protection at scale from either the Microsoft Defender portal or the Microsoft Intune portal, with Intune-based deployment available in preview. Both discovery and runtime protection for local agents will be available for Microsoft Defender for Endpoint P2 and higher customers. See the local agents and associated MCPs operating in your environment In the Defender portal, security teams can see the discovered agents under Assets. The inventory associates each agent with the device and user account where it runs and includes details such as agent name, version, vendor, related process, and discovery history. Examples of supported local AI agents include: CLI agents: Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI Desktop applications: ChatGPT Desktop, Claude Desktop, Codex Desktop, GitHub Copilot app, Microsoft Copilot app, Ollama Desktop, Perplexity Desktop Agentic IDEs: Cursor, Devin Desktop, Kiro IDE, Antigravity IDE VS Code extensions: Claude Code, Cline, Codex, Gemini Code Assist, GitHub Copilot, Roo Code Claw-based agents: OpenClaw, Clawpilot, QClaw We will continue expanding support for agents across both discovery and runtime protection. The supported agent list continues to evolve; see AI agent support matrix for the current list. In addition, security teams can see supported local and remote MCP server configurations associated with discovered agents. Depending on the configuration, details such as the MCP server name, type, endpoint, or the command used to start a local server are visible, helping teams understand not only which agents are present, but also the tools and services those agents can access. Assess exposure and investigate local agents After discovering agents, security teams need to understand what those agents are connected to and what risk they may introduce. The exposure graph in Defender provides a clear visual of the agent’s blast radius including the agent associated devices, identities, and MCP context. These data sources can be used to investigate agent activity in advanced hunting, alongside the data from endpoints, identities, email, and cloud. Risk indicators and security recommendations are also available to help teams prioritize risks. For ready-to-use queries, see Discover local AI agents with Microsoft Defender. Secure local agents while they operate AI agents are good for productivity, but they also undeniably introduce new security risks to organizations. For example, prompt injection can be hidden in a file, web page, repository, or tool response that an agent reads. If the agent follows an attacker’s instructions, the attacker could attempt to misuse the user's access, run unwanted commands, modify code, or expose sensitive information. Defender inspects supported points in the agent loop and stops malicious instruction before an agent acts on them. When Defender detects prompt injection, it raises a suspicious AI prompt injection alert with agent and session context. Administrators can view detections and validate accuracy in audit mode, then move selected device groups to block mode for enforcement. In block mode, Defender can stop the action before it continues and notify the user in the agent experience and through Windows. In preview, Defender currently supports runtime protection via agent-native event inspection and network inspection for discovered agents for Windows; coverage varies by agent and inspection approach. Agent-native event inspection (Hooks) uses vendor-supported event interfaces to inspect user prompts, tool requests before execution, and tool responses after execution. Network inspection extends protection to supported agents that don't expose an agent-native event interface by inspecting supported agent-to-model network flows. Security teams can investigate agent-related threats in Defender with the rich context of existing endpoint protection, alerting, incident correlation, and investigation workflows. Deploy runtime protection at scale As local AI agent adoption grows, security teams need a scalable way to deploy runtime protection consistently across managed devices in the organization. In Defender, security teams can create a Windows policy, select the Microsoft Defender AI agent runtime protection profile and configure AI Agent protection settings with one of three values: Default: Runtime protection is disabled. Audit: Defender detects and reports prompt injection while allowing the supported agent action to continue. Block: Defender detects prompt injection and blocks supported agent actions before they run. We recommend beginning with a limited group in Audit mode, reviewing detections for one to two weeks, and then moving to Block mode when your organization is ready to enforce protection. nshot 4: Deploy AI agent runtime protection with Microsoft Defender] In public preview, Microsoft Intune also provides a native AI agent runtime protection for Microsoft Defender endpoint security policies. Security teams can configure agent-native event inspection on enrolled Windows devices without relying on a custom deployment script. Now, security teams can choose either Microsoft Defender portal or Microsoft Intune portal to deploy runtime protection at scale. For configuration requirements and deployment steps, see Set up AI agent runtime protection with Microsoft Defender for Endpoint. To safely validate your configuration on a test device, see AI agent runtime protection demonstration. Learn more: Microsoft Learn: Local AI agent discovery overview Microsoft Learn: Discover local AI agents with Microsoft Defender for Endpoint Microsoft Learn: Local AI agent runtime protection Microsoft Learn: Set up local AI agent runtime protection Microsoft Learn: Local AI agent support matrix
Microsoft Defender AMSI false positive — private evidence submission guidance
We're seeking guidance on the official private review process for a suspected Microsoft Defender Antivirus AMSI false-positive detection. Detection: HackTool:PowerShell/ApexToolkit.A The detection occurred during an authorized PowerShell-based .NET development/testing workflow. The original AMSI payload is unavailable. We've collected the official Microsoft Defender diagnostic CAB, but it contains personal and internal system information, along with unrelated security history. Microsoft Support referred us to Tech Community because the consumer support channel could not escalate the investigation directly. Our question: Is there an official private channel for submitting sanitized incident records for initial classification review, or obtaining guidance about secure handling of the full diagnostic CAB? We want to maintain Defender protections and avoid posting sensitive diagnostic evidence publicly. Thank you for any guidance on the appropriate Microsoft review process.
How to get alerted on pending items in the Action Center
Good morning all! Part of my daily duties is to ensure that items in the Action Center are acted upon in a timely manner. I have been trying to find ways to be able to be alerted on new items, but there is nothing in Microsoft documentation, or anything that is obvious. I have scoured the internet, where I stumbled upon an old post about having to use a PS script, but there has to be some sort of notification Microsoft can send out on these items?! Since these items are time sensitive, I am having to check constantly for any new soft/hard delete emails.Secure Linux desktops with Microsoft Defender
As more developers begin to use Linux desktops, they become more attractive to attackers: high-privilege, high-value, and easy for admins to overlook. A developer using Linux for day-to-day development may interact with source code repositories, continuous integration and continuous delivery (CI/CD) pipelines, cloud infrastructure, container environments and internal development platforms. If their workstation is compromised, an attacker doesn’t just gain access to a laptop, but a foothold in the pipelines that build and ship the organization’s software. As Linux adoption expands beyond the data center, organizations need a consistent approach to protecting Linux wherever it is used. That’s why we’ve extended our industry-leading endpoint protection in Microsoft Defender, bringing enterprise-grade protection, detection, vulnerability management and response capabilities to Linux workstations. Enterprise-grade protection for Linux desktops Defender support for Linux workstations spans all three key areas of endpoint security: Protect and detect Endpoint detection and response (EDR) Microsoft Defender next-gen antivirus Threat analytics Exposure management Microsoft Defender Vulnerability Management Device inventory Security settings management Investigate and respond Advanced hunting Live response Device isolation The result is broader Linux protection, delivered through the tools and processes security teams already trust. Give security teams a consistent and simplified view across the endpoint estate With Defender on Linux desktops, organizations can: Onboard quickly using the deployment methods already validated for Linux servers Reduce operational complexity by protecting Linux desktops and servers with one agent and one security operations experience Improve visibility across heterogeneous endpoint environments Strengthen developer workstation security where users interact with source code, cloud infrastructure and other critical resources Accelerate investigation and response through a consistent security operations experience Defender protects Linux desktops with the same deployment organizations already use to protect Linux servers. There is no separate desktop-specific agent to deploy or maintain, and existing deployment packages, deployment methods and security capabilities on Linux servers extend directly to Linux workstations. Defender automatically identifies whether a Linux device is a server or a workstation, so devices appear correctly within inventory and security workflows without any additional administrative effort. With Microsoft Defender, security operations teams can gain visibility into Linux workstations alongside the rest of their enterprise endpoint estate. They can respond through a single portal, whether Linux is running in the data centre, in the cloud, or on an engineer’s desk. Get started Defender support is based on the underlying Linux distribution and kernel version, regardless of the desktop environment running on top of the distribution. Every distribution currently supported by Microsoft Defender on Linux servers is supported on Linux desktops as well — including RHEL, CentOS, Ubuntu, Debian, SLES, Fedora and Oracle Linux, running GNOME, KDE or other desktop environments. Defender on Linux desktops requires the standalone Microsoft Defender for Endpoint Plan 2 or Microsoft 365 E5 and E7. If your organization runs Linux on developer, engineering or security desktops, now is the time to close that visibility gap. To join the public preview, onboard eligible Linux workstations using any of the existing deployment methods. Before you begin, review what’s new in Defender and complete the pre-requisites. This is another step towards our vision of helping organizations secure every endpoint, no matter which operating system or platform. To learn more about endpoint protection with Microsoft Defender, check out our website. To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.
Microsoft Defender XDR / Defender for Endpoint data connectors inconsistent failures
Hello, We are deploying our SOC (Sentinel) environments via Bicep. Now the Defender XDR ( MicrosoftThreatProtection) and Defender for Endpoint ( MicrosoftDefenderAdvancedThreatProtection) data connectors are failing to deploy inconsistantly. It seems to be a known issue due to the following posts: - https://github.com/Azure/SimuLand/issues/23 - https://techcommunity.microsoft.com/t5/microsoft-sentinel/quot-missing-consent-invalid-license-quot-defender-for-endpoint/m-p/3027212 - https://github.com/Azure/Azure-Sentinel/issues/5007 Next to this issue I see almost no development on the data connectors API, is there some news to be spread how to enable data connectors automated in the future, since it seems to be moving to Content Hub. It is hard to find any docs about how to deploy this for example via Bicep!? Also I have a question regarding 'Tenant-based Microsoft Defender for Cloud (Preview)' data connector. We deploy this now via GenericUI data connector kind, but this has no option to enable it via automation. Same as the question in the previous paragraph, how would this be made possible?
From “No” to “Now”: A 7-Layer Strategy for Enterprise AI Safety
The “block” posture on Generative AI has failed. In a global enterprise, banning these tools doesn't stop usage; it simply pushes intellectual property into unmanaged channels and creates a massive visibility gap in corporate telemetry. The priority has now shifted from stopping AI to hardening the environment so that innovation can run at velocity without compromising data sovereignty. Traditional security perimeters are ineffective against the “slow bleed” of AI leakage - where data moves through prompts, clipboards, and autonomous agents rather than bulk file transfers. To secure this environment, a 7-layer defense-in-depth model is required to treat the conversation itself as the new perimeter. 1. Identity: The Only Verifiable Perimeter Identity is the primary control plane. Access to AI services must be treated with the same rigor as administrative access to core infrastructure. The strategy centers on enforcing device-bound Conditional Access, where access is strictly contingent on device health. To solve the "Account Leak" problem, the deployment of Tenant Restrictions v2 (TRv2) is essential to prevent users from signing into personal tenants using corporate-managed devices. For enhanced coverage, Universal Tenant Restrictions (UTR) via Global Secure Access (GSA) allows for consistent enforcement at the cloud edge. While TRv2 authentication-plane is GA, data-plane protection is GA for the Microsoft 365 admin center and remains in preview for other workloads such as SharePoint and Teams. 2. Eliminating the Visibility Gap (Shadow AI) You can’t secure what you can't see. Microsoft Defender for Cloud Apps (MDCA) serves to discover and govern the enterprise AI footprint, while Purview DSPM for AI (formerly AI Hub) monitors Copilot and third-party interactions. By categorizing tools using MDCA risk scores and compliance attributes, organizations can apply automated sanctioning decisions and enforce session controls for high-risk endpoints. 3. Data Hygiene: Hardening the “Work IQ” AI acts as a mirror of internal permissions. In a "flat" environment, AI acts like a search engine for your over-shared data. Hardening the foundation requires automated sensitivity labeling in Purview Information Protection. Identifying PII and proprietary code before assigning AI licenses ensures that labels travel with the data, preventing labeled content from being exfiltrated via prompts or unauthorized sharing. 4. Session Governance: Solving the “Clipboard Leak” The most common leak in 2025 is not a file upload; it’s a simple copy-paste action or a USB transfer. Deploying Conditional Access App Control (CAAC) via MDCA session policies allows sanctioned apps to function while specifically blocking cut/copy/paste. This is complemented by Endpoint DLP, which extends governance to the physical device level, preventing sensitive data from being moved to unmanaged USB storage or printers during an AI-assisted workflow. Purview Information Protection with IRM rounds this out by enforcing encryption and usage rights on the files themselves. When a user tries to print a "Do Not Print" document, Purview triggers an alert that flows into Microsoft Sentinel. This gives the SOC visibility into actual policy violations instead of them having to hunt through generic activity logs. 5. The “Agentic” Era: Agent 365 & Sharing Controls Now that we're moving from "Chat" to "Agents", Agent 365 and Entra Agent ID provide the necessary identity and control plane for autonomous entities. A quick tip: in large-scale tenants, default settings often present a governance risk. A critical first step is navigating to the Microsoft 365 admin center (Copilot > Agents) to disable the default “Anyone in organization” sharing option. Restricting agent creation and sharing to a validated security group is essential to prevent unvetted agent sprawl and ensure that only compliant agents are discoverable. 6. The Human Layer: “Safe Harbors” over Bans Security fails when it creates more friction than the risk it seeks to mitigate. Instead of an outright ban, investment in AI skilling-teaching users context minimization (redacting specifics before interacting with a model) - is the better path. Providing a sanctioned, enterprise-grade "Safe Harbor" like M365 Copilot offers a superior tool that naturally cuts down the use of Shadow AI. 7. Continuous Ops: Monitoring & Regulatory Audit Security is not a “set and forget” project, particularly with the EU AI Act on the horizon. Correlating AI interactions and DLP alerts in Microsoft Sentinel using Purview Audit (specifically the CopilotInteraction logs) data allows for real-time responses. Automated SOAR playbooks can then trigger protective actions - such as revoking an Agent ID - if an entity attempts to access sensitive HR or financial data. Final Thoughts Securing AI at scale is an architectural shift. By layering Identity, Session Governance, and Agentic Identity, AI moves from being a fragmented risk to a governed tool that actually works for the modern workplace.
RESYNC MICROSOFT DEFENDER FOR ENDPOINT
hey guys im a junior IT officer and i have been tasked with finding a way to get microsoft defender for enpoint to get fresh data without waiting 24hrs or the 4 hours that microsoft insists the resync will happen,I tried advanced hunting running queries directly there,i tried runnning an anti virus scan but nothing happened and APIs i tried looking for APIs that can initiate a restart but nothing...any ideas ? i read on here there was github repo for using powerBI with defender to get new data https://github.com/microsoft/MicrosoftDefenderForEndpoint-PowerBI but its not clear how that work...any intel would be helpful
