Host Microsoft Defender data locally in the United Arab Emirates
We are pleased to announce that local data residency support in the UAE is now generally available for Microsoft Defender for Endpoint and Microsoft Defender for Identity. This announcement reinforces our ongoing commitment to delivering secure, compliant services aligned with local data sovereignty requirements. Customers can now confidently onboard to Defender for Endpoint and Defender for Identity in the UAE, knowing that this Defender data will remain at rest within the UAE data boundary. This allows customers to meet their regulatory obligations and maintain control over their data. For more details on the Defender data storage and privacy policies, refer to Microsoft Defender for Endpoint data storage and privacy and Microsoft Defender for Identity data security and privacy. Note: Defender for Endpoint and Defender for Identity may potentially use other Microsoft services (i.e. Microsoft Intune for security settings management). Each Microsoft service is governed by its own data storage and privacy policies and may have varying regional availability. For more information, refer to our Online Product Terms. In addition to the UAE, Defender data residency capabilities are available in the United States, the European Union, the United Kingdom, Australia, Switzerland and India (see our recent announcement for local data hosting in India). Customers with Existing deployments for Defender for Endpoint and/or Defender for Identity Existing customers can check their deployment geo within the portal by going to Settings -> Microsoft Defender XDR-> Account; and see where the service is storing your data at rest. For example, in the image below, the service location for the Defender XDR tenant is UAE. ation information If you would like to update your service location, please reach out to Customer Service and Support for a tenant reset. Support can be accessed by clicking on the “?” icon in the top right corner of the portal when signed in as an Admin (see image below). If you are a Microsoft Unified support customer, please reach out to your Customer Success Account Manager for assistance with the migration process. More information: Ready to go local? Read our documentation for more information on how to get started. Microsoft Defender XDR data center location Not yet a customer? Take Defender XDR for a spin via a 90-day trial for Office 365 E5 or Defender for Endpoint via a 90-day trial for Defender for Endpoint Check out the Defender for Endpoint website to learn more about our industry leading Endpoint protection platform Check out the Defender for Identity website to learn how to keep your organization safe against rising identity threats
Preventing Data Leakage to AI: A Strategic Framework for the Global Enterprise
In an organization with thousands of users, "Shadow AI" isn't just an IT nuisance - it’s a fundamental shift in the risk surface. We’ve all seen it: a well-intentioned employee pastes proprietary code into a public LLM to "clean it up," or a team lead uploads a customer list to a "free" AI formatter. These aren't malicious acts; they are productivity shortcuts that create massive security gaps. To enable innovation without compromising safety, we need a Zero Trust–aligned framework that acts as a guardrail rather than a gate. This requires a layered model centered on Identity, Device Health, and Data Intelligence. The 7-Layer Defense Architecture In a complex tenant, we don't rely on a single gatekeeper. We implement a stack where each layer provides a fail-safe for the one before it. Layer Enterprise Objective Primary Technology 1. Identity Anchor Verified Access & Device Health Microsoft Entra ID + Intune 2. Global Radar Continuous Shadow AI Discovery Purview AI Hub + Defender for Cloud Apps 3. Session Guard Real-time Intervention & Input Filtering Conditional Access App Control (MCAS) 4. Data Core Auto-Labeling & Persistent DLP Microsoft Purview Information Protection 5. Agent Governance Lifecycle & Identity for AI Agents Agent 365 + Entra Agent ID 6. The Human Layer Secure Prompting & AI Skilling Approved Prompt Templates & Training 7. Continuous Ops Monitoring & Regulatory Auditability Microsoft Sentinel + Insider Risk Mgmt 1. Universal Discovery via the Purview AI Hub Visibility is the prerequisite for governance. In a complex environment, you need a "single pane of glass" to monitor AI usage across the tenant. The Insight: Use the Purview AI Hub to identify "high-risk" prompts and see exactly which sensitive data types (PII, IP, Code) are being shared. The Radar: Integration with Defender for Endpoint ensures we capture AI usage even when users are off-network or traveling, leaving no blind spots in the global telemetry. 2. Identity-Driven Access & Tenant Boundaries Access must be tied to the health of the device. If the device isn't managed, the AI shouldn't be reachable. Conditional Access: Enforce policies requiring a "Managed and Compliant" device for any AI service. The "Account Leak" Fix: Deploy Tenant Restrictions v2 (TRv2). This is the only way to effectively stop employees from using corporate assets to sign into personal Microsoft accounts, keeping data strictly within your managed boundary. 3. Real-Time Session Governance & Inbound Protection The biggest leak in the enterprise isn't a hack; it's the copy-paste. However, we must also guard against Prompt Injection. Granular Controls: Use Session Policies to allow an AI tool while blocking specific risky actions - like uploading a document with a "Highly Confidential" label. Inbound Sanitization: Implement filters to detect malicious external data that might attempt to "hijack" a session via Indirect Prompt Injection. Continuous Access Evaluation (CAE): This ensures that if a user’s risk level changes, their access to AI is revoked in near real-time. 4. Hardening the Data (Auto-Classification & DLP) If security is embedded in the data, the location of the data becomes secondary. Intelligent Labeling: Move beyond manual tagging. Use Auto-labeling at the service level to scan and encrypt sensitive data (e.g., credit card numbers or internal project names) before it can be processed by an LLM. Clipboard Guard: Use Endpoint DLP to stop the "Clipboard Leak." This prevents users from moving sensitive text from a protected document into a web-based AI interface. 5. The "Agentic" Era: Agent 365 As we move from chatbots to autonomous agents, governance must manage an ecosystem of AI agents. Agent 365: A centralized control plane to manage the registry and lifecycle of every AI agent (sanctioned or "shadow") active in your tenant. Entra Agent ID: Treat agents like enterprise identities. Assign unique IDs to manage permissions so an agent’s access doesn't outlive its business purpose. 6. The Human Layer: Skilling & Secure Prompting Technical guardrails are the safety net, but user intent is the driver. Context Minimization: Train users to provide AI with only the data it needs. Redacting proprietary names or PII before prompting should be a baseline habit. The "Safe Harbor": Move users away from risky public tools by providing a superior experience in Microsoft 365 Copilot. Security shouldn't be a "No," it should be a "Yes, use this instead." 7. Continuous Ops & Regulatory Compliance Security is not a "set and forget" project. For the global enterprise, this layer provides the Audit Trail required for the EU AI Act and GDPR. Shadow AI Migration: Track the % of users moving from "Shadow" to sanctioned tools. Sentinel Correlation: Correlate AI prompts and DLP alerts in Microsoft Sentinel to allow the SOC to automate responses to misuse. Compliance Reporting: Generate automated reports on data residency and AI interaction logs to satisfy global regulatory requirements. Technical & Licensing Baseline This framework focuses on identity-, data-, and app/session-level controls (e.g., Defender for Cloud Apps/CAAC). It does not include network-level controls such as Cloud Proxy or ZTNA, which can complement these measures. Most capabilities require Microsoft 365 E5 and Entra ID P2. Features like Purview AI Hub, Agent 365, and Entra Agent ID may be in preview or offered as add-ons - verify availability and licensing with your Microsoft account team. Conclusion Securing AI at scale is not about building a wall; it is about engineering a dynamic foundation. In a global enterprise, "No" is a temporary delay, not a sustainable policy. By anchoring our strategy in Identity, Auto-Classification, and Agentic Governance, we transform AI from a fragmented "shadow risk" into a governed, competitive advantage. This framework ensures that as our digital ecosystem evolves, the organization's "crown jewels" remain protected - not by restricting innovation, but by making security the adaptive, automated engine that powers it.New Blog | Vulnerability Management Dashboard: Microsoft Defender for Endpoint - Updated Release 240
By Nathan Hughes-Smith Introduction As Microsoft Cloud Solution Architects, we get asked by Businesses, IT Managers and Cybersecurity Experts to accurately report on the Vulnerabilities and CVEs in our environments. This could be as easy as just deploying Endpoint Protection updates or as advanced as deploying every category and 3rd Party Updates using Microsoft Defender for Endpoint. Vulnerability Management Dashboard: Microsoft Defender for Endpoint This Spring release involves implementing a cloud-based reporting and visualization solution that brings exposure to active threats into sharp focus. It is intended to provide value to IT Leaders, Stakeholders, Security & Compliance teams, and Operations Teams that are responsible for mitigating CVE documented risks. The reports provide rich drill throughs that enable full understanding of an organization's current data and trends. The data is sourced from Microsoft Defender for Endpoint using API calls, stored in a small serverless Azure SQL instance, and can be accessed from anywhere on any device. Outcomes Dashboard with a summary view that shows CVE vulnerability status for the current month, the previous month, and all prior. These views refresh daily on a desired scheduled time frame. Customization options to exclude specific CVEs and classes of vulnerabilities. Cloud installation that creates a small Azure serverless SQL instance, an Azure Automation Account, and an Azure Service Principal. The Report The report features 8 main pages to use as a starting point, with additional subpages and drill-ins to allow you to get the information the way you need to see it. Summary - View device compliance against CVEs, grouped by the last 3 monthly release cycles. Drill into devices with a specific status in a specific period to get a detailed list of devices and which CVEs have open vulnerabilities currently. Read the full post here: Vulnerability Management Dashboard: Microsoft Defender for Endpoint - Updated Release 2405
Entity playbook in XDR
Hello All! In my Logic Apps Sentinel automations I often use the entity trigger to run some workflows. Some time ago there was information, that Sentinel will be moved to the Microsoft XDR, some of the Sentinel elements are already there. In XDR I can run playbook from the incident level, but I can't do it from the entity level - for example in the XDR when I clicked in the IP or when I open IP address page I can't find the Run playbook button or something like that. Do you know if the Run playbook on entity feature will be moved to XDR also? Best, Piotr K.
Defender Entity Page w/ Sentinel Events Tab
One device is displaying the Sentinel Events Tab, while the other is not. The only difference observed is that one device is Azure AD (AAD) joined and the other is Domain Joined. Could this difference account for the missing Sentinel events data? Any insight would be appreciated!New blog | Analyze IoT/OT device firmware with Microsoft Defender for IoT
Consider an organization that has thousands of endpoints on their network that are running 10-year old, unpatched SSH servers. Or when a critical vulnerability like log4shell is discovered, having no easy way to know which of those endpoints are exploitable. This is the situation organizations find themselves in when it comes to IoT and OT devices. This problem is so important that the US National Cybersecurity Strategy released a report in March 2023 indicating the IoT security threat as a strategic objective. Read the blog: Analyze IoT/OT device firmware with Microsoft Defender for IoT
