Monthly news - February 2026

Microsoft Defender's February 2026 update includes new features and improvements across various products. Public previews introduce Entra Agent IDs and enhancements to advanced hunting, including AI-powered incident prioritization. Incident management is streamlined with new alert tuning rules, while hunting query results over the size limit are indicated. The Sentinel is moving to the Defender portal, with the Azure portal retirement set for March 2027. Multi-tenant management now supports content distribution. UEBA is being improved and offers new behaviors. Generally Available is the option to disable incident correlation for analytics rules and some Microsoft Secure Score recommendations. Defender for Office 365 can now block specific domains and senders in Teams and extending ZAP/quarantine to Plan 1. Defender for Cloud Apps Workday connector requires only "View" permissions. Several enhancements for Identity Inventory are generally available. Finally, enhanced RPC auditing and automatic Windows event-auditing configuration are being rolled out.