Microsoft continues to move quickly across security, governance, and AI, and keeping up matters when you’re designing, defending, or governing at scale. This update captures the most relevant developments across Microsoft Sentinel, Defender, Purview, and Copilot for Security, with a strong focus on operational impact, cost control, and real‑world security outcomes.
You’ll see meaningful progress in SIEM and XDR operations, including new data lake capabilities, expanded integrations, and clearer guidance on managing cost and access in complex environments. There’s also continued momentum in AI‑assisted security operations and governance, reflecting how Copilot and policy-driven controls are becoming foundational for modern SOCs and public-sector security teams. Automation of incident management is no longer a luxury, every Security Team should be implementing not just automations, but utilizing AI to make decisions where we can!
For organizations operating across hybrid, multi-cloud, or regulated environments, these updates highlight where Microsoft is investing to help teams scale visibility, enforce governance, and respond faster, without compromising control. Whether you’re shaping architecture, running a SOC, or supporting mission‑critical government operations, these changes are worth your attention.
You can always tell when Microsoft Ignite is just around the corner….all the updates slow down considerably for a couple of months! Stay tuned!
Microsoft Sentinel
| September 2026 Enable the data lake tier using Table management Once you’ve onboarded to Microsoft Sentinel in Defender portal, you can use the Table Management page to enable the data lake tier. Select a table, and then select Retention to view data-retention settings . From here, you can mirror data in the Analytics tier to the Data Lake tier, and also enable lake only retention settings for retaining historical data…. |
| September 2026 Integrated Microsoft Sentinel SIEM and data lake onboarding The data lake comes integrated with Microsoft Sentinel and continues as the low-cost ingestion and storage tier for long-term retention inside Sentinel. |
| September 2026 Mirror the data lake tier to Microsoft Fabric OneLake Using the Azure Monitor mirroring feature, you can select the Microsoft Sentinel workspace tables you want to expose in Microsoft Fabric. The mirroring feature doesn’t create a copy of the data and incurs no additional charge. The data remains in the Sentinel Log Analytics workspace, enabling Fabric analytics to reference the tables and analyze the data in p… |
| September 2026 Run interactive KQL queries in advanced hunting Interactive Kusto Query Language (KQL) queries on the data lake are now available using Advanced Hunting under Investigation & Response in the Defender portal. Use the Advanced Hunting page to investigate data from both Microsoft Sentinel and Microsoft Defender XDR without switching contexts. For more information, see Advanced hunting with Microsoft Sentinel… |
| September 2026 Use Microsoft Fabric for custom security analytics Microsoft Fabric enables custom analytics across data lake tables and external data tables. You can use KQL , notebooks , scheduled jobs , and custom graphs within Microsoft Fabric to analyze and enrich data at scale and then store results in Microsoft Fabric or publish selected findings back to Microsoft Sentinel via DCR for hunting, detections, and investi… |
| September 2026 Use Microsoft Fabric for data federation When cost, governance, or compliance requirements prevent data movement, customers can query the data where it resides using data federation. Using Data federation, you can enrich investigations with context from data stored outside the data lake. |
Defender for Cloud
| September 29, 2026 Enhanced agent for Defender for SQL Servers on Machines is fully available in Azure Government cloud GA |
| Sep 30, 2026 Upcoming billing updates for Defender for Servers Upcoming update |
| September 23, 2026 Upcoming deprecation of the Machines should have a vulnerability assessment solution recommendation Upcoming deprecation |
Defender for Endpoint
| September 23, 2026 Integrated Security Operations Center in Microsoft Defender AI is transforming the attacker’s operating model, accelerating threats to unprecedented speed and scale. Yet many security operations centers still depend on fragmented data, tools, intelligence, and workflows. Analysts spend valuable time rebuilding context and coordinating action across systems, while the economics of operating the SOC become increasingly… |
Azure Infrastructure
| September 23, 2026 Designing agent-first platforms: What changes when agents do the work The organizations pulling ahead are not simply adding AI to what they already have. They are designing for a different kind of software. |
| September 28, 2026 Enhancing Microsoft Azure Virtual Machine lifecycle Our Virtual Machine Lifecycle policy guides how we manage these transitions, giving Azure customers transparency, predictability, and guidance. |
| September 29, 2026 FabCon and SQLCon 2026 in Barcelona: Building the data foundation for Microsoft Copilot and agents Microsoft Fabric and SQL innovations announced at FabCon and SQLCon Barcelona 2026 help organizations build trusted data foundations for AI. |
| September 29, 2026 SQL Server on Azure Local is now generally available With SQL Server on Azure Local, customers can modernize where their data resides while maintaining control over infrastructure, connectivity, and data placement. |
Purview
| September 2026 Data Loss Prevention – General availability Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, and a… |
| September 2026 Information Barriers – New Create an Information Barriers policy compliance report to identify SharePoint sites, OneDrive accounts, and user-owned SharePoint Embedded containers that no longer comply after Information Barriers policy changes. |
Purview Copilot
| September 2026 Data Loss Prevention – General availability Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, and a… |
Copilot for Security
| Last update: August 10, 2026 MCP safety & evaluation with the Agent 365 CLI & Agent Governance Toolkit Co Author: JiteshThakur AI agents are useful because they can act. They call tools, query databases, send messages, and hand work to other agents. That same freedom creates a problem: access control can tell you which service an agent may reach, but it does not always tell you whether a particular action is sensible, safe, or permitted. MCP is how most agen… |