What changed in Microsoft 365 security: October 2026

This page summarises Microsoft 365 security changes for October 2026: the security-relevant updates Microsoft itself announced or documented on its own “what’s new” pages in recent weeks. It’s a summary of Microsoft’s announcements, not an assessment of them. Each item says what changed, who Microsoft says it affects, the month Microsoft gives, and where to read Microsoft’s own description.

How this summary works

The pages checked, all on 21 October 2026, were Microsoft Learn’s “what’s new” or release-notes pages for Defender for Office 365, Defender XDR, Defender for Endpoint, Defender for Cloud Apps, Purview, Intune, Teams (admin features) and Microsoft Entra. Only items found on those pages are included, with the date or month Microsoft gives. There are no ratings and no predictions.

Items are grouped by product. Most are from October 2026; a few late-September items are included because Microsoft published them close to this edition. This isn’t a complete list (see “What this edition doesn’t cover” below). Admins working through the basics rather than the latest changes can start with the Microsoft 365 security checklist.

Microsoft Defender for Office 365

Defender for Office 365 is Microsoft’s add-on protection for email and collaboration in Microsoft 365, covering things like phishing, malicious links and attachments, and user reports of suspicious messages. The guide to Microsoft Defender for Office 365, explained covers the basics. Microsoft’s “what’s new” page for the product was last updated on 15 October 2026 when checked.

Teams user reporting now includes meetings (October 2026)

What changed. Microsoft states: “Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting.” Microsoft also says users can mark a participant who was wrongly flagged as suspicious as “not a security concern”.

Who it affects. Teams users, and the admins and security teams who receive user reports. Microsoft says where reports go depends on the organisation’s Teams user reported settings.

Why it’s relevant. This extends user reporting beyond messages to meetings themselves. The guide to phishing, smishing and vishing explains voice and message-based phishing, and the guide to Teams external access covers who can contact users from outside the organisation.

Microsoft’s page: What’s new in Microsoft Defender for Office 365

New ApproverUpn field in Advanced Hunting (October 2026)

What changed. Microsoft added an ApproverUpn field to the EmailPostDeliveryEvents table in Advanced Hunting. Microsoft says the field “identifies the user or administrator who approved a remediation action, helping security teams investigate and audit post-delivery email actions more efficiently.”

Advanced Hunting is a query tool in the Microsoft Defender portal for searching security data. A post-delivery action is something done to an email after it has reached a mailbox, such as moving or deleting it once it’s found to be malicious.

Who it affects. Security teams and admins who use Advanced Hunting to investigate email. Microsoft doesn’t label this item as preview.

Microsoft’s page: What’s new in Microsoft Defender for Office 365

Teams user reporting settings separated from email settings (September 2026)

What changed. Microsoft says Teams user reporting settings now have their own page, and that “this separation lets you configure different reporting destinations for Teams and Outlook user reports.” Microsoft’s page refers to message center post MC1478463 for details.

Who it affects. Microsoft states this applies to admins in Worldwide (WW) environments with Defender for Office 365 Plan 1 or Plan 2, Microsoft 365 E5 or Office 365 E5. Organisations that send user reports to a particular mailbox or team may find that Teams and Outlook reports can now be routed differently.

Microsoft’s page: What’s new in Microsoft Defender for Office 365

Teams user reporting now includes group calls (September 2026)

What changed. Microsoft states: “Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam).”

Who it affects. Teams users, and the admins who receive their reports.

Microsoft’s page: What’s new in Microsoft Defender for Office 365

Microsoft Defender XDR (the Microsoft Defender portal)

Microsoft Defender XDR brings together alerts and investigation tools from Microsoft’s Defender products in one portal. The guide to Microsoft 365 audit logs and alerts explains the logging that sits underneath much of this.

Integrated Security Operations Center in preview (September 2026)

What changed. Microsoft describes the Integrated Security Operations Center (ISOC) as bringing “XDR, SIEM, threat intelligence, automation, and AI capabilities together in the Microsoft Defender portal.” Microsoft labels it as a preview.

Who it affects. Microsoft states: “Starting September 23, 2026, it’s available to eligible Microsoft 365 E5 and E7 customers without an active Microsoft Sentinel workspace.” That means it’s relevant mainly to organisations on those plans. The Microsoft 365 licensing and security features reference explains how Microsoft’s plans differ.

Microsoft’s page: What’s new in Microsoft Defender XDR

Identity Security dashboard and Coverage & Maturity (September 2026)

What changed. Microsoft lists these as generally available. Microsoft says the Identity Security dashboard “provides a centralized view of identity-related security risks and posture across the organization,” and that Coverage & Maturity helps security teams “identify coverage and deployment gaps, and prioritize the actions required to improve identity security posture.”

Who it affects. Security teams responsible for identity security. Microsoft’s entry doesn’t state licensing; its linked documentation has the details.

Microsoft’s page: What’s new in Microsoft Defender XDR

Microsoft Defender for Endpoint

Defender for Endpoint is Microsoft’s protection for devices such as Windows PCs, Macs and Linux machines. Microsoft’s “what’s new” page for it was last updated on 14 October 2026 when checked.

Vulnerability assessment for Microsoft Store apps (October 2026)

What changed. Microsoft says vulnerability assessment for applications installed from the Microsoft Store “is now generally available”. Defender Vulnerability Management detects supported Microsoft Store apps, adds them to the software inventory and assesses them for vulnerabilities. Microsoft notes that “coverage is currently limited to a select set of commonly used applications.”

Who it affects. Organisations using Defender Vulnerability Management in Defender for Endpoint. Microsoft’s entry doesn’t state licensing.

Microsoft’s page: What’s new in Microsoft Defender for Endpoint

New Secure Score recommendations for “AI-Readiness” (September 2026)

What changed. Microsoft lists, as generally available, six Microsoft Secure Score recommendations grouped as “AI-Readiness”, which it says help organisations “strengthen endpoint trust against AI-accelerated cyberattacks.” Four are new (covering TPM 2.0, virtualization-based security, hypervisor-protected code integrity and Windows LAPS) and two already existed (reducing internet exposure of internet-facing devices, and Secure Boot).

Who it affects. Admins who use Microsoft Secure Score in the Microsoft Defender portal. Microsoft Secure Score is a measurement of an organisation’s security posture based on the settings it has in place.

Microsoft’s page: What’s new in Microsoft Defender for Endpoint

Defender for Endpoint on Linux desktops in preview (September 2026)

What changed. Microsoft says Defender for Endpoint “now extends support to Linux desktops (Public Preview)”, and that all Linux distributions supported on servers are also supported on desktops.

Who it affects. Organisations with Linux desktop computers. This is a preview.

Microsoft’s page: What’s new in Microsoft Defender for Endpoint

Microsoft Defender for Cloud Apps

SaaS accounts integration with Identity inventory switched on automatically (from 15 October 2026)

What changed. Microsoft states that “starting October 15, 2026”, the integration between Defender for Cloud Apps SaaS accounts and Identity inventory moves from opt-in to automatic enablement for eligible tenants. Microsoft says eligible tenants “don’t need to take any action”.

Who it affects. Microsoft says the integration is enabled automatically for eligible tenants that don’t use the User group admin or App/instance admin roles in Defender for Cloud Apps.

Microsoft’s page: What’s new in Microsoft Defender for Cloud Apps

Microsoft Purview

Microsoft Purview covers data protection and compliance tools such as data loss prevention (DLP) and sensitivity labels. The guide to sensitivity labels and DLP explains the basics. Microsoft’s “what’s new” page was last updated on 16 October 2026 when checked.

Endpoint DLP covers FTP and SFTP transfers (October 2026)

What changed. Microsoft lists this as generally available: “Endpoint data loss prevention (DLP) can now monitor sensitive data transferred over FTP and SFTP and apply restrictive actions based on your organization’s requirements.” FTP and SFTP are older file-transfer methods often used to move files to servers.

Who it affects. Organisations that use Endpoint DLP on managed devices. Microsoft’s entry doesn’t state licensing.

Microsoft’s page: What’s new in Microsoft Purview

Purview Network Data Security (September 2026)

What changed. Microsoft lists this as generally available. Microsoft says it uses Microsoft Entra Global Secure Access with Purview to “protect text, files, and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management.”

Who it affects. Organisations using both Purview DLP and Microsoft Entra Global Secure Access. Microsoft’s entry doesn’t state licensing.

Microsoft’s page: What’s new in Microsoft Purview

Microsoft Intune

Intune is Microsoft’s device and app management service. The guide to Intune device security basics covers the basics. Microsoft’s “what’s new” page was last updated on 12 October 2026 when checked.

Security baseline for Windows 11, version 26H2 (week of 5 October 2026)

What changed. Microsoft states: “The Windows security baseline for Windows 11, version 26H2 is now available in Microsoft Intune.” A security baseline is a pre-configured group of Windows security settings published by Microsoft. Microsoft notes that existing baseline profiles don’t update automatically, and that the “Configure NetBIOS settings” policy isn’t included because it’s currently supported only on Windows Insider builds.

Who it affects. Admins who manage Windows 11 devices with Intune security baselines. Microsoft’s page suggests reviewing settings before moving profiles to the new version, especially customised ones.

Microsoft’s page: What’s new in Microsoft Intune

AI agent runtime protection settings for Windows (week of 28 September 2026)

What changed. Microsoft lists a new device security setting to configure Microsoft Defender for Endpoint “AI agent runtime protection” on Windows, with an Audit mode, which Microsoft says will “detect and alert on unsafe AI agent activity without blocking it”, and a Block mode to “stop threats before they execute”.

Who it affects. Admins who manage Windows devices with Intune and Defender for Endpoint. The guide to AI agents and permissions explains what AI agents are.

Microsoft’s page: What’s new in Microsoft Intune

Microsoft Teams

Automatically block identified external bots from meetings (23 September 2026)

What changed. Microsoft’s Teams admin release notes state: “Administrators can now automatically block identified external bots from joining meetings through Teams meeting policies.”

Who it affects. Teams admins who manage meeting policies. The guide to Teams external access covers related settings for people outside the organisation.

Microsoft’s page: Release notes for Microsoft Teams admin features

Microsoft Entra

Microsoft’s “What’s new in Microsoft Entra” page was checked for this edition. At the time of checking (21 October 2026), its newest listed entries were from June 2026, so no Entra items appear in this month’s summary. Microsoft’s page is the place to see identity changes as they’re added.

What this edition doesn’t cover

• The Microsoft 365 roadmap couldn’t be checked item by item for this edition.
• Tech Community blogs were searched, but no security-relevant October 2026 Microsoft 365 post with enough detail to summarise was found.
• Message center posts inside the Microsoft 365 admin center are visible only to each tenant’s admins, so they aren’t summarised here except where Microsoft’s public pages refer to them.
• Smaller entries on the pages checked, such as performance, government-cloud-only or non-security items, are left out.

Things to watch for

• Preview vs generally available. Microsoft marks preview features explicitly. Preview features can change or be withdrawn.
• Licensing conditions. Several items apply only to certain plans or environments, as Microsoft states in each entry.
• Dates can move. Microsoft’s “what’s new” pages are updated over time, and an entry’s wording may change after this summary was written.
• User reporting routes. Where Teams and Outlook reports can now go to different places, it’s worth knowing who in the organisation receives each.

Common questions

What changed in Microsoft 365 security in October 2026?

Microsoft’s own pages list several October 2026 items: Teams user reporting extended to meetings, a new ApproverUpn field in Advanced Hunting, generally available vulnerability assessment for Microsoft Store apps, Endpoint DLP coverage of FTP and SFTP transfers, and an Intune security baseline for Windows 11, version 26H2. Each section on this page groups the items by product, starting with Microsoft Defender for Office 365.

Where does Microsoft announce Microsoft 365 security changes?

Microsoft publishes “what’s new” pages on Microsoft Learn for products such as Defender for Office 365, Microsoft Defender XDR, Defender for Endpoint, Purview, Intune and Microsoft Entra, plus release notes for Teams admin features. Microsoft’s pages also refer to message center posts, such as MC1478463, which tenant admins see in the Microsoft 365 admin center. How this summary works lists the pages checked.

Can I report a Teams call or meeting as a scam?

Microsoft’s Defender for Office 365 page says users can report completed or missed group Teams calls from the call history as malicious (scam) or nonmalicious, and can report scheduled or Meet now meetings, or individual participants, as a security concern. Microsoft says where reports go depends on the organisation’s Teams user reported settings. See Teams user reporting now includes meetings.

Do I need to do anything about the new Windows 11 security baseline in Intune?

Microsoft notes that existing Intune baseline profiles don’t update automatically to the Windows 11, version 26H2 baseline. Microsoft’s page suggests reviewing settings before moving profiles to the new version, especially customised ones, and says the “Configure NetBIOS settings” policy isn’t included. Security baseline for Windows 11, version 26H2 has Microsoft’s wording and link.

Are these new features available on every Microsoft 365 plan?

No. Several items apply only to certain plans or environments, as Microsoft states in each entry. For example, Microsoft says the separate Teams reporting settings apply to Worldwide environments with Defender for Office 365 Plan 1 or Plan 2, Microsoft 365 E5 or Office 365 E5. Some entries are previews, which can change or be withdrawn. Things to watch for covers these points.

Is this list of Microsoft 365 changes complete?

No. It includes only items verified on Microsoft’s own “what’s new” and release-notes pages at the time of checking, 21 October 2026. The Microsoft 365 roadmap wasn’t checked item by item, and tenant-only message center posts aren’t summarised. What this edition doesn’t cover lists the gaps.

Where to get official help

Microsoft’s own pages are the authority for each change: What’s new in Microsoft Defender for Office 365, What’s new in Microsoft Defender XDR, What’s new in Microsoft Defender for Endpoint, What’s new in Microsoft Defender for Cloud Apps, What’s new in Microsoft Purview, What’s new in Microsoft Intune, Release notes for Microsoft Teams admin features and What’s new in Microsoft Entra. Tenant admins can also check message center in the Microsoft 365 admin center for posts that apply to their own organisation.