Microsoft Release Notes

Download x64 installerDownload x86 installer

Version number: 17.1.0.1 Released: March 2018

If you need to download the installer in a language other than the one detected for you, you can use these direct links. For the x64 driver: Chinese (Simplified) | Chinese (Traditional) | English (United States) | French | German | Italian | Japanese | Korean | Portuguese (Brazil) | Russian | Spanish For the x86 driver: Chinese (Simplified) | [Chinese (Traditional)](https://go.microsoft.com/fwlink/?linkid=21…

Download x64 installerDownload x86 installer

Version number: 17.0.1.1 Released: February 2018

If you need to download the installer in a language other than the one detected for you, you can use these direct links. For the x64 driver: Chinese (Simplified) | Chinese (Traditional) | English (United States) | French | German | Italian | Japanese | Korean | Portuguese (Brazil) | Russian | Spanish For the x86 driver: Chinese (Simplified) | [Chinese (Traditional)](https://go.microsoft.com/fwlink/?linkid…

| Feature | New Microsoft Secure Score recommendations for AI-Readiness | GA | Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry points, establish hardware-backed trust in device startup, isolate critical Windows security functions, protect kernel code integrity, and limit the reuse of local administrator credentials for lateral movement.In the Microsoft Defender portal, go to Exposure Management > Recommendations > Devices > Misconfigurations, and filter by the AI-Readiness tag to view the complete recommendation set, affected devices, exposed critical devices, points achieved, and potential impact on the Devices Secure Score. Use this view to prioritize remediation, assign ownership, track exceptions, and monitor adoption throughout the device estate.Four new recommendations are available for AI-Readiness:- Establish a hardware root of trust with TPM 2.0: Helps protect cryptographic keys, device identity, and boot measurements with hardware-backed security.- Isolate critical security functions with VBS: Helps protect critical security functions in an isolated environment that is separate from the operating system kernel.- Enforce kernel code integrity with HVCI: Helps validate kernel-mode code, block untrus…

| Feature | Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc) | Preview | Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping security teams investigate and respond to threats across both Windows and Linux workloads.Available in Public Preview. To enroll, complete the registration form. |

August 2026

| Feature | Local AI agent discovery — macOS support and new agents | Preview | Local AI agent discovery now supports macOS endpoints in addition to Windows. This update also adds discovery support for new agents including Junie CLI, Kiro CLI, Warp, Hermes Agent, Goose Desktop, Perplexity Desktop, Kiro IDE, Devin Desktop (formerly Windsurf), and QClaw. For more information, see Local AI agent discovery. | | Feature | Enhanced Defender deployment tool for Windows | GA | The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date for the package to reduce the risk of unauthorized use.In addition:- You have the option of downloading the package as either an .exe or a .zip file, whichever best suits your organization's needs.- A new Deployment packages page in the Defender portal facilitates management of downloaded packages by providing centralized visibility into all the packages and their current status. | …

| Feature | New Microsoft Secure Score recommendation | GA | Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface.Internet-facing devices are primary entry points for attackers and automated scanners, making them prime targets for credential brute-forcing, exploitation of unpatched vulnerabilities, and initial access for ransomware and hands-on-keyboard intrusions.This recommendation provides centralized visibility into internet-facing devices across the environment, enabling organizations to validate whether exposure is expected, prioritize remediation for unintended exposure, and reduce external attack surface at scale. | | Feature | Local AI agent discovery | Preview | Microsoft Defender for Endpoint now automatically discovers supported local AI agents running on onboarded Windows devices — including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization. For more information, see Discover local AI agents. | …

May 2026

April 2026

Sensor v2.x to v3.x migration is now generally available

Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x.

Migrate Windows Server 2025 domain controllers to sensor v3.x

You can now migrate domain controllers running Windows Server 2025 from sensor v2.x to sensor v3.x. For more information, see Migrate to Defender for Identity sensor v3.x.

Migration readiness reasons on the Sensors page

When a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see Troubleshoot "Not ready for migration" status.

Expanded SaaS app support in Password protection (Preview) …

| Release - Android | Build 1.0.8805.0103 | GA | Build 1.0.8805.0103 released: See enhancements and features for this release. |

March 2026

June 2026

Identity risk score is now generally available

The identity risk score is now generally available. The score ranges from 0 to 100 and reflects how likely an identity is to be compromised and how much damage a compromise could cause, based on the identity's criticality level and privileged role assignments. The Risk score tab on the Identity page provides a detailed breakdown of risk factors, percentile comparison, and risk trends.

New Defender for Identity security alerts

These new alerts were added to the Defender for Identity security alerts:

New alerts related to Entra ID:

• Anomalous activity following Global Administrator elevation
• Reciprocal Temporary Access Pass creation between users
• Suspicious service principal sign-in following credential addition
• Suspicious bulk user deletion via scripted activity
• Suspicious removal of privileged app role assignment through Graph API …

| Feature | New Microsoft Secure Score recommendations | GA | Microsoft Secure Score now includes new recommendations to help organizations reduce exposure to common attack techniques involving remote access and authentication relay attacks: - Block file transfer over RDP: Restricts file transfer capabilities in Remote Desktop Protocol (RDP) sessions. This helps prevent attackers from using RDP sessions to transfer malicious files into the environment or exfiltrate sensitive data. - SMB server security hardening against authentication relay attacks: Helps protect servers from credential relay attacks by strengthening Server Message Block (SMB) authentication protections, including enforcing Extended Protection for Authentication (EPA), SMB signing, and SMB encryption to ensure authentication integrity and protect SMB traffic from tampering or interception. |

April 2026

Identity Explorer (Preview)

The Identity page now includes the Identity Explorer tab for customers with a Microsoft Sentinel Data Lake license. This tab uses the hunting graph to visualize identity attack paths and exposure scenarios as interactive graphs. Use predefined identity scenarios to discover lateral movement paths, privilege escalation routes, and credential-access risks. For more information, see Investigate an identity.

Custom account correlation rules (Preview)

Custom account correlation rules let you link accounts that belong to the same identity, such as privileged accounts with unique naming conventions. You can correlate accounts that don't share strong identifiers such as account ID, SID, object ID, or UPN by defining rules based on UPN prefix, UPN suffix, or domain UPN. For more information, see Create custom account correlation rules.

Automatic Windows event auditing configuration for sensors v3.x is now generally available …

| Feature | Proactive user containment (contain user) | GA | The proactive user containment (contain user) action as part of the predictive shielding feature is now generally available. This action infuses activity data with exposure data to identify exposed credentials at risk of being compromised and reused to conduct malicious activity. |

February 2026