Introducing the Microsoft Sentinel ASIM EmailEvent schema
Email remains one of the most common entry points for security threats. Yet email products often describe the same activity with different table names, fields, and values. This makes it harder to build detections and investigations that work consistently across data sources. The Microsoft Sentinel Advanced Security Information Model, or ASIM, EmailEvent schema is now available. It provides a common structure for email delivery and inspection events, helping customers and partners create security content that works across supported email data sources. A consistent view of email security activity EmailEvent standardizes the information analysts need to understand what happened to an email and why. It covers: Email delivery and inspection events Sender, source, and recipient information Message subject, size, direction, and delivery location URLs and file attachments SPF, DKIM, and DMARC authentication results Delivery actions such as delivered, blocked, quarantined, or deleted Threat, risk, confidence, tactic, technique, and remediation details Instead of learning a different data model for every product, analysts can query the normalized EmailEvent fields. Parser developers map each source's native data to the same schema. How it works Consider an email that contains a suspicious attachment. The email security product records the sender, recipients, attachment, authentication results, inspection verdict, and final action. A connector collects that event. A parser or Data Collection Rule maps the source fields to EmailEvent. Microsoft Sentinel can then query the normalized record using the same field names used for other supported email sources. This common structure separates security content from the details of a specific product. When another source adds an EmailEvent parser, existing source-independent queries and detections can work with that source without being rewritten around its native field names. Why it matters Simpler analytics: Write queries against one consistent set of email fields. Broader coverage: Apply source-independent security content across normalized email sources. Faster investigations: Compare delivery, authentication, attachment, URL, and threat details without translating different data models. Easier integration: Give connector and parser developers a defined contract for bringing new email telemetry into ASIM. EmailEvent does not replace the rich native data produced by email security products. It provides a consistent security layer that makes that data easier to use together. Build on EmailEvent The EmailEvent release includes the schema definition, source-independent parser framework, filtering parser, deployment templates, and validation support in the Azure-Sentinel repository. The schema version is 1.0.0. Customers can use normalized EmailEvent data to develop hunting queries, analytics rules, workbooks, and investigation experiences. Partners and community contributors can create source-specific parsers that map their email data to the schema. Get started Normalization Email Schema MS Learn Learn about normalization and ASIM Explore the EmailEvent implementation in Azure-Sentinel Deploy ASIM parsers Thank you to the ASIM engineering and partner teams who contributed to the schema, deployment path, validation, and release.What's new in Microsoft Planner | September 2026
Fall is officially here, and with it comes our first quarterly edition of What's New in Microsoft Planner! Each quarter, we'll bring the latest Planner updates together in one place. We're continuing to invest in Planner to help people work alongside AI to plan and get work done, whether you're tracking your own tasks or coordinating a shared plan across your team. This quarter's updates give you a clearer view of your work, new ways to save time keeping plans current, and more places to manage tasks where work already happens. Planner Agent is now built directly into basic plans, so you can ask questions about your plan, create and update tasks, and focus on your top priorities without leaving Planner. We're also making Planner Agent in Copilot more capable, with fuller answers on large, complex plans and faster, more reliable responses. You'll also find updates that bring Planner closer to where your team collaborates, from adding Planner as a tab in private and shared Teams channels to bringing your tasks and plans into Outlook. And the new Task Details Side Pane lets you update assignments, dates, and checklists without losing sight of the bigger picture. Read on to see everything that's new in Planner this quarter and share your feedback through the Planner Feedback Portal. Keep the details and bigger picture in view Task Details Side Pane Planner now offers a new way to view and edit task details without losing sight of the plan or task list. The Task Details Side Pane opens alongside Board, Grid, and My Tasks views. Assignees, dates, notes, and checklists can be updated without leaving that view. Seeing task details alongside the plan makes it easier to review assignments and dates without losing context. Planner now also remembers the preferred task details layout when the app is reopened. On smaller screens, task details automatically open in a dialog for a better fit. Save time planning and getting work done Chat with Planner Agent in Planner Planner Agent chat is available directly in basic plans. It allows teams to ask questions about the plan, create and update tasks, and filter the view to focus on the top priorities. With chat built into the plan, teams can now review tasks and make updates without leaving Planner to start a separate conversation in Copilot. Planner Agent in Microsoft Copilot More context for large plans: Planner Agent can now use more information from large and complex plans when answering questions. It leverages the latest frontier models for more in-depth reasoning and draws more effectively on work content. These improvements help find relevant tasks and include more supporting plan details in responses, giving teams a fuller picture of the work being reviewed. Create larger plans in Copilot: The previous 30-task limit when creating a plan has been removed, allowing Planner Agent to generate larger initial task lists without a limit. Teams can review the proposed tasks in Copilot before saving them to the plan. Improvements also extend beyond plan creation, with faster responses and fewer interruptions across the Planner Agent experience in Copilot. Assign tasks to team members: Users can set task owners by asking Planner Agent or using task cards in the agent's responses, without leaving the conversation in Copilot. Choose how Planner Agent responds: A new model selector offers Quick response, Think deeper, and Auto modes. Users can choose a quicker response, request more in-depth reasoning, or let Planner Agent select the mode automatically. Planner capabilities in Copilot Users can keep tasks current while handling other work in one conversation, without opening Planner or a separate Planner Agent chat. In Copilot Chat, users can now search for tasks and plans, get answers about their work, create or update tasks, and take action on plans. The same chat includes capabilities from Outlook, Excel, PowerPoint, and other apps. Users can access these alongside Planner capabilities without switching between agents. Manage work where it happens Planner in Outlook Planner is now available in Outlook, bringing tasks and plans, along with Planner Agent, into the inbox. This experience supports both personal task tracking and collaborative planning, so individual commitments and shared work can be managed in one place. With Planner in Outlook, people can track progress, coordinate responsibilities, and take action without leaving their inbox. To get started in Outlook on the web or the new Outlook for Windows, select Apps, search for Planner, then add and pin it for quick access. Planner tabs in Teams channels Planner can now be added as a tab in private and shared Team channels. Team members can create a new basic plan or select an existing plan shared with the group associated with the channel. Once added, the plan is easy to find in the channel where the team collaborates. Members can return to that dedicated space to review tasks and manage projects together.What’s new in Microsoft Sentinel: September 2026
Welcome back to What's new in Microsoft Sentinel. In September, Case Management brings investigation and collaboration together in Microsoft Defender, with a shared workspace to track work through resolution. Defender unified RBAC custom roles for granular delegated admin privileges (GDAP) give you finer control over what managed security service providers (MSSPs) and other partners can access. In Sentinel data lake, a single Codeless Connector Framework (CCF) connector can bring in data from many accounts, and our connector catalog has passed 500 data connectors. Read on for the details. Sentinel innovations: Sentinel SIEM Sentinel data lake Sentinel SIEM Case Management (Public Preview) Starting September 23, 2026, Case Management brings investigation and collaboration together in one experience in Defender. With Incident Cases, you can investigate, coordinate response, assign work, capture notes, and track progress through resolution, all from a shared workspace that holds investigation context alongside tasks and workflow tracking. Your existing Sentinel automation, playbooks, workbooks, and integrations carry over unchanged. This builds on the integrated security operations (ISOC) vision of bringing the context and workflows practitioners need to investigate and respond together in Defender. Read our Case Management blog, see the documentation, and watch the demo to learn more. Unified RBAC custom roles (Public Preview) If you work with a managed security service provider (MSSP) or manage multiple tenants, giving partners the right level of access is simpler. Granular delegated admin privileges (GDAP) sets which partner groups can be delegated access to your tenant, and Defender unified role-based access control (RBAC) sets what they can see and do once delegated. You can assign unified RBAC custom roles to GDAP remote tenant groups and scope each role down to specific security products, data sources, and data collections so partners receive only the access they need. GDAP previously only supported Microsoft Entra directory roles, which often meant handing partners more access than the job needed. Anyone who is a member of a remote tenant group receives its permissions. Your partner manages who belongs to the group, while you keep control of the role and its scope. Learn more. Sentinel data lake Multi-account support for codeless connectors (Public Preview) A single connector built on the Codeless Connector Framework (CCF) can bring data from many accounts, tenants, or environments into one Sentinel workspace. A unified connections list shows each account as its own row, labeled so you can tell them apart by account name, tenant ID, or environment. An “Add connection” experience walks you through setting up each one, and an independent lifecycle per connection means you can edit or remove any account without affecting the rest. Shared, efficient ingestion sends all of it to the same table, so you have one place to investigate instead of a separate connector for every account. This helps if you run separate production and development accounts, segment by region or business unit, or manage several customers in one workspace. Learn more. Sentinel data connectors pass the 500 mark Sentinel has reached an exciting milestone of more than 500 data connectors. Our connectors bring security signals from Microsoft services, non-Microsoft solutions, multicloud environments, applications, infrastructure, and custom sources into Sentinel, where they can be correlated and analyzed to help teams detect threats, investigate incidents, hunt across their digital estate, and automate response. With 500+ connectors and growing, Sentinel makes it easier for organizations to unify their security ecosystem and give the security operations center (SOC) broader visibility where it matters most. Find your connector. Additional resources Blogs and documentation: Integrated Security Operations Center in Microsoft Defender ISOC in Microsoft Defender (preview) Activate Microsoft Defender unified role-based access control (URBAC) Support multiple connections in a codeless connector Upcoming webinars: Oct 6: Security Immersion Event: Into the Breach Oct 14: Microsoft Security Immersion Event: Shadow Hunter Upcoming events: Oct 19: Microsoft Security Days Summit: Dallas Edition (In Person) ISOC: What's new with the Defenders Capture the Flag: Agent Wars (Hands-on) Nov 17–20: Microsoft Ignite at Moscone Center in San Francisco, CA, USA. See what's next in Microsoft Security. Register now. Stay connected Check back each month for the latest innovations, updates, and events to ensure you’re getting the most out of Microsoft Sentinel. We’ll see you in the next edition!What’s new in Microsoft Sentinel: August 2026
Welcome back to What's new in Microsoft Sentinel. This August, Sentinel innovation kicks off with the AI-powered playbook generator, generally available to all Sentinel customers in the Microsoft Defender portal. Meanwhile, User and Entity Behavior Analytics (UEBA) anomalies enter public preview on the Behaviors layer, with coverage across Fortinet, AWS GuardDuty, Check Point, and Zscaler. In Sentinel data lake, nested API support in the Codeless Connector Framework (CCF) enters public preview to connect data sources whose APIs span multiple calls, and multi-account data ingestion is now generally available for Auth0, CrowdStrike, and Salesforce. Finally, the free Microsoft Threat Intelligence connector for unified SecOps, marking the final phase of MDTI convergence, is now generally available in the Defender portal. Read on for the details, and explore our resources at the end to go deeper. Sentinel innovations: Sentinel SIEM Sentinel data lake Sentinel SIEM AI-powered playbook generator expanded to all Sentinel customers in the Defender portal [Generally Available] Go from intent to action faster with the AI-powered playbook generator. It is available to all Sentinel customers using the Defender portal with no Security Copilot enablement or additional cost required. Describe the response you want in natural language and generate an editable, code-based playbook complete with tests, documentation, and a visual flow. To get started, confirm you have Automation Playbooks Unified RBAC Read and Write permissions, then select Automation > + Create > Playbook Generator. Read our blog to learn more. UEBA Anomalies are now built on top of Behaviors, along with expanded coverage through new data sources [Public Preview] Understand what happened and why it matters in one place. Sentinel adds UEBA anomaly insights and explainable context directly to the Behaviors layer, while expanding coverage across Fortinet, AWS GuardDuty, Check Point, and Zscaler data. This helps you identify unusual activity across identity, network, and cloud environments, reduce investigation time, and focus on the highest-risk behaviors. Enable the Behaviors layer, connect supported data sources, and explore the Insights column in the BehaviorInfo table to get started. Read our blog to learn more and watch our training video for a guided walkthrough. Sentinel data lake Nested API support in Codeless Connector Framework [Public Preview] Nested API support in the Sentinel Codeless Connector Framework (CCF) handles the list-then-detail pattern common across ISV log sources, where a single polling cycle spans multiple dependent API calls. An initial call returns a list of records such as alert IDs or case references, and one or more follow-up calls fetch the full detail for each record in that list. This means you can connect data sources whose APIs are naturally paginated across multiple calls and ingest complete records into Sentinel without building custom middleware or restructuring your endpoints. The pattern is also available through the Visual Studio Code (VS Code) extension for Sentinel connectors, which gives you a guided way to build, test, and package connectors that orchestrate chained requests. Read our blog to learn more, or try it with mock data in our Nested API Lab. Multi-account ingestion for Auth0, CrowdStrike, and Salesforce [Generally Available] Sentinel data connectors for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud now support multi-account ingestion — powered by the Codeless Connector Framework (CCF). You can now connect and monitor multiple accounts or tenants from a single, unified connector configuration — no scripts, no hacks. 🔑 Auth0 — Multi-tenant identity monitoring Security teams managing multiple Auth0 tenants can now ingest logs from all of them into a single Sentinel workspace. Get complete visibility into authentication events, anomalous login patterns, and policy violations across every tenant without switching contexts. 🦅 CrowdStrike Falcon — Consolidated endpoint telemetry Organizations running multiple CrowdStrike tenants (e.g., across M&A entities or regional subsidiaries) can now stream detection alerts, threat intelligence, and endpoint telemetry from all tenants into Sentinel. One workspace. Full coverage. ☁️ Salesforce — Cross-org security insights Enterprises with multiple Salesforce orgs can now centralize audit logs, login history, and API activity across all orgs. Detect insider threats, unauthorized access, and compliance gaps without stitching data together manually. Get started with multi-account ingestion by finding your supported Sentinel data connector. Microsoft Threat Intelligence connector [Generally Available] The final phase of Microsoft Defender Threat Intelligence (MDTI) convergence is generally available in the Defender portal, giving you real-time Microsoft threat intelligence across detection, investigation, response, hunting, and automation at no additional cost. The result is a unified SecOps experience that reduces fragmented context and tool handoffs, and creates a clear path from threat signal to informed action. Microsoft Threat Intelligence data that previously required the Premium MDTI connector is available through the free Microsoft Threat Intelligence connector in Sentinel, enabling free and premium indicator feeds through one setup. MDTI APIs are also included for Sentinel customers without a separate license, and the API surface is unchanged, so no migration action is required. Read the blog to learn more. Additional resources Blogs and documentation: Investigate anomalies on UEBA behaviors in Microsoft Sentinel | Microsoft Learn UEBA behaviors layer pricing model in Microsoft Sentinel | Microsoft Learn Turn Complexity into Clarity: Introducing the New UEBA Behaviors Layer in Microsoft Sentinel | Microsoft Community Hub Microsoft Sentinel’s AI-driven UEBA ushers in the next era of behavioral analytics | Microsoft Community Hub Create pull codeless data connectors using nested API polling | Microsoft Learn View threat intelligence in entity pages in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn Microsoft Threat Intelligence in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn Upcoming webinars: Sep 2: Microsoft Security Immersion Event: Agent Hackathon Sep 8: Security Immersion Event: Into the Breach Sep 8–9: Microsoft Virtual Training Day: Predict and Defend Against Cybersecurity Threats Sep 22: Tech Brief: Modernize security operations with a unified platform Sep 23: Microsoft Security Immersion Event: Shadow Hunter Stay connected Check back each month for the latest innovations, updates, and events to ensure you’re getting the most out of Microsoft Sentinel. We’ll see you in the next edition!What's New in Microsoft EDU - Back to School 2026 webinar
Get ready for back to school (Northern Hemisphere) with the latest product updates from Microsoft Education. In this webinar, we’ll showcase new AI-powered tools, teaching resources, and product updates designed to help educators save time, personalize learning, and support every student. You’ll see what’s new across Microsoft 365 Copilot, Teams for Education, OneNote, and more, including: ✅ Teach module in Microsoft 365 Copilot ✅ Copilot Notebooks ✅ Study and Learn agent ✅ Learning Zone ✅ Teams for EDU updates ✅ The latest OneNote EDU updates And more! Join us for practical demonstrations, helpful tips, and new ideas you can put to work as you prepare for a successful school year. And don't worry if you can't make it live, we will be recorded and posting this on the Microsoft Education YouTube channel afterwards. 📅 When: Wednesday, August 26th @ 8am Pacific Time 🔗 Register here: https://df.events.teams.microsoft.com/event/df.8c4f06fc-399f-4603-8023-f5fd92601bd1@72f988bf-86f1-41af-91ab-2d7cd011db47?source=copyLinkOneEventsShareDialog Mike Tholfsen Group Product Manager Microsoft EducationICYMI: Partner Blog | From AI curiosity to Copilot adoption in 30 days
Thirty days. Twenty-five users. One clear path to AI. For small and medium-sized businesses, AI is no longer a someday conversation, it's a right-now decision. SMB customers aren't asking whether AI matters anymore; they're asking how to put it to work in ways that are practical, fast, and secure. The hard part isn't interest. It's the starting line. Customers are looking to identify relevant use cases, experience AI in their everyday work, and evaluate its value before making a broader commitment. This creates a significant opportunity for Cloud Solution Provider (CSP) partners to lead customers from initial interest to sustained adoption. The SMB segment represents a Microsoft-estimated $625 billion* market opportunity in FY27, yet most organizations remain early in their AI transformation journey. Continue reading here
