This morning, a large number of our Intune-managed Windows 11 devices displayed a toast notification saying Defender signatures were out of date. However, the Defender portal shows those devices as up to date and healthy.

We’re expecting some user concern given the conflicting information.

We had an issue in August, resolved in September, where Defender was incorrectly reported as disabled. That turned out to be a Windows Security Center (WSC) signal issue. This feels potentially similar, although we haven’t confirmed the cause yet.

Has anyone else seen this today?

Hoping that someone from Microsoft Defender team sees this.

Running both MDE Client Analyzer tool and MDE Client Analyzer tool (preview) are giving the same error.

https://learn.microsoft.com/en-us/defender-endpoint/run-analyzer-windows

Script starts and then fails due to C:\windows\system32\dsregcmd.exe being signed by a newer CA at Microsoft (CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US) that is only valid starting 8/6/2026. Issuerinfo.txt has logged this.

In MDEClientAnalyzer.ps1, line 2639 has a list of allowed issuers, but the newer CA isn't listed. Please update the signed PS1 to include Microsoft's newest CAs.

$allowedIssuers = @(
  "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Development PCA 2014, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Development PCA 2024, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA 2024, O=Microsoft Corporation, C=US",
  "CN=Windows Production PCA 2023, O=Microsoft Corporation, C=US",
)

Error after running:

2026-10-14 12:29:34Z [Informational] EDRCloud AutoIR 130019: Test connection to the Microsoft Defender for Endpoint (AutoIR) cloud service URLs completed successfully. N/A
2026-10-14 12:29:34Z [Informational] AVCloud SampleUpload 130020: Test connection to the Microsoft Defender for Endpoint (SampleUpload) cloud service URLs completed successfully. N/A
2026-10-14 12:29:34Z [Informational] EDRCloud MdeConfigMgr 130021: Test connection to the Microsoft Defender for Endpoint (MdeConfigMgr) cloud service URLs completed successfully. N/A
Checking latest AV versions from cloud:  OK
Test-AuthenticodeSignature : Script execution terminated because a process or script that is not Microsoft signed was detected
At C:\Support\Utils\MDEClientAnalyzerPreview\MDEClientAnalyzer.ps1:2733 char:3
+         Test-AuthenticodeSignature $command.path
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Test-AuthenticodeSignature

I'm seeing on my SIEM server that MsSense is using a constant 8-15% CPU. My understanding is that exclusions defined for Defender (MsMpEng.exe) do not apply to the MsSense EDR.

I used wpr to analyze performance for a few seconds which resulted in a 200 MB etl file. Using WPA (windows performance analyzer) I could only see that MsSense was accessing tens of thousands of files, but it doesn't allow you to see what those files are. My best guess is that it is scanning every log write and every file streamed in across the network.

the get-mpperformance cmdlets work well for identifying msmpeng scanned files, but there doesn't appear to be a way to identify why MsSense is using so much CPU.

I even tried putting the server into troubleshooting mode, disabling tamper protection, and disabling every defender feature I could via powershell, which didn't make a dent.

Googling this issue and talking to LLMs haven't been any help - has anyone found a solution, or is complete offboarding the only option?

I've been able to keep up but I am looking for strategies to help with dealing on this

Does anyone else find themselves putting in MS Tickets literally weekly about XDR features not working, buggy, etc.

At this point I'm submitting 3 a week...

I have a client (I work at an MSP) who operates several sites with OT equipment, and are interested in Defender for OT.

Does anyone here have much experience with deploying it, running it on a day-to-day basis, and any feelings about how effective it is as a platform.

We're currently comparing it with other OT tools such as CrowdStrike and Tenable OT.

Thanks in advance!

Microsoft has introduced a dedicated Microsoft Defender AI agent runtime protection setting in Intune.
Microsoft Intune → Endpoint security → Antivirus

Administrators can now centrally configure and deploy AI agent runtime protection to supported Windows devices using
◈ Audit mode – Detect and report prompt injection attempts.
◈  Block mode – Detect and block supported malicious agent actions.

Important to know: Protection is disabled by default.

The Intune profile currently supports agent-native event inspection.

Network inspection still requires separate configuration using PowerShell.

Title:
Hi everyone,
I’m trying to create a custom detection in Microsoft Defender XDR that triggers an alert when Windows Event ID 7040 occurs with specific text in the event message.
I’ve tried several KQL queries against DeviceEvents, but I can’t find the event at all, let alone filter on its message. Am I looking in the wrong table, or is this event simply not collected by Defender for Endpoint?
Has anyone managed to do this, either with a working KQL query or another practical monitoring solution?
I’ve seen suggestions to deploy an event-triggered scheduled task through GPO, but that feels like quite a bit of overhead for a relatively simple requirement. Ideally, I’d like to handle it centrally through Defender.
Any advice or examples would be appreciated. Thanks for your help, sharing makes this community better.

P.S. To clarify, Event ID 7040 records changes to a service’s startup type, for example, from Automatic to Manual, or vice versa. My goal is to get an alert whenever the startup type of a specific service is changed.

We are evaluating Microsoft Defender Vulnerability Management for a mixed Windows and macOS environment. I’m looking to speak with administrators who use it day to day—not just people who have completed a trial.

I’m particularly interested in vulnerability accuracy, macOS coverage, third-party application visibility, remediation workflows, monthly reporting, email notifications, licensing and the amount of administrative work required.

If you currently manage MDVM and would be willing to share your experience through messages or a short call, I would appreciate it. No vendor or sales responses, please.

Hello,

MS 365 Defender produces way too many FPs even on Windows, but there I can at least submit file samples through WDSI portal. Then MS analysis lab either removes the detection right away or says they cannot reproduce alert and submit MPSupportFilesCAB diagnostic result if I want an investigation conducted. I do so, they check the debug logs and fix the FP. Not an ideal situation, but it works.

However, for Linux and MacOS false positive sample submissions, the lab ALWAYS responds with "cannot reproduce detection" and submit mpsupportfiles CAB diagnostic result if I want an investigation. Of course, CAB archives are a Windows-only format, so I can't do that!

Instead, I pull Apple ZIP or Linux TAR-GZ diagnostics via the Live Response "collect" command. Regrettably MS lab always responds to those submissions with "cannot reproduce detection" or "submitted archive doesn't contain the detected objects" or other non-sensical excuse.

MS lab apparently lacks non-Windows analysts or my submissions never reach the higher band analysts who know what to do with Linux and MacOS cases? What can I do to get those FPs fixed as well? Thanks in advance!

Anyone ran into this? I am GA on the tenant so unsure if it's a backend issue or otherwise. (Pic attached)

I'm looking for some advice regarding Microsoft Defender for Endpoint (MDE) telemetry coverage.

As part of our Threat Hunting programme, we've been testing a number of KQL queries to better understand MDE's telemetry coverage and identify areas where detections may need further tuning.

Using Atomic Red Team tests and other scripts within a dedicated testing environment, we've identified what appears to be a gap in telemetry collection for certain interactively executed PowerShell commands.

For example, when PowerShell or PowerShell ISE is launched and commands are executed interactively, we do not always receive the full cmdlet or script content within MDE telemetry. This makes it difficult to accurately detect, investigate and hunt for the activity using Advanced Hunting.

During our research, we came across the following Microsoft discussion:

🔗 Microsoft Defender ATP - Advanced Hunting Query PowerShell Command Line

The recommendation in that thread is to enable PowerShell Script Block Logging. However, in our testing, enabling Script Block Logging does not appear to resolve the issue. The PowerShell activity is visible locally within Event Viewer, but the corresponding telemetry does not seem to be forwarded into MDE.

Has anyone else encountered this limitation?

I'm particularly interested in understanding:

• Whether this is expected behaviour within MDE
• If there are additional configuration requirements beyond Script Block Logging
• Whether others have found alternative telemetry sources or hunting approaches to capture this activity more reliably

Any insights, experiences or recommendations would be greatly appreciated.

Bonjour à tous,

Je suis actuellement en Bac+3 Cybersécurité à Guardia Cybersecurity School, après avoir obtenu un BTS CRSA orienté automatisme et systèmes industriels.

Mon objectif est de me diriger vers la cybersécurité industrielle / OT, notamment autour des réseaux industriels, automates, systèmes de supervision et sécurité des environnements industriels.

Je cherche actuellement une alternance en Île-de-France pour ma première expérience professionnelle dans ce domaine.

Je travaille déjà de mon côté sur Linux, les réseaux, le routing, les pare-feu, les CTF, Root-Me, TryHackMe et Fortinet.

Pour ceux qui travaillent dans l'industrie, l'automatisme ou la cybersécurité industrielle : comment avez-vous trouvé votre première opportunité dans ce domaine ? Est-ce qu'il y a des entreprises ou types de postes que vous me conseilleriez de cibler ?

Merci d'avance pour vos conseils.

I’m the IT lead for a 120-person company on Microsoft 365. We recently found a sales rep who had been downloading our customer database to a personal OneDrive.

We had Purview turned on for months. It generated plenty of alerts about external Word doc shares, but nothing on this case. The rep had been with us four years. His OneDrive sync stayed active for 11 days after the termination date. From the Microsoft side the activity looked like normal use of his own account. The signal that stood out was a terminated identity in the IdP still making high-volume API calls.

I’m trying to build a more reliable way to catch this kind of post-termination activity. What does your actual workflow look like for spotting terminated users who still have live OneDrive or similar syncs running? Looking for practical detection and response steps.

Instead of building a full Logic App or playbook, you can select a trigger and attach a predefined action directly in Defender.

Some of the available capabilities include:
◈ Trigger automation when a case is created or updated
◈ Send case creation / update email notifications
◈ Automatically update case properties
◈ Create investigation tasks
◈ Update alerts directly from the automation workflow

Docs: Create basic automation rules with Simple Flows in the Microsoft Defender portal (preview) | Microsoft Learn

We're replacing our MDR and I'd like to hear from people who've lived with theirs, not from sales decks.

Where we are

- About 1,000 users across 15 sites globally, in manufacturing
- The stack decision is made: Defender XDR, MDE on everything that takes an agent, Defender for Servers covering on-prem and AWS Linux, and Sentinel for longer retention and some third-party logs
- Firewall refresh coming, probably Palo or Fortinet
- Small internal team, no in-house 24/7 SOC

Why we're leaving

Our current provider mostly relays alerts. They can't act on our EDR, and "response" means an email telling us to go do something. I want a provider that will isolate a host, disable an account, or revoke sessions at 3am under runbooks we've approved ahead of time.

What I'm weighing

Microsoft's own Defender Experts is on the list, but the licensing gets complicated at our size. Plan 2 has a 1,500-seat minimum, and servers are a separate SKU. So I'm also looking at third-party MDRs that work natively in Defender. I haven't settled on either path, and I'm open to being talked out of my assumptions.

What I'd really like to know

1. Who's your MDR, and would you renew? Why or why not?
2. Do they actually take response actions in your tenant, or do they mostly escalate?
3. How's their coverage outside US hours? Real follow-the-sun, or a thin overnight crew?
4. Do their detections live in your Sentinel or in their own platform? Has that made switching providers painful?
5. If you've used Defender Experts, how did it compare to a third party?
6. Anyone you'd tell me to stay away from?

Vendors, feel free to DM me. I'm more interested in hearing from customers in the thread.

Our Sentinel Logic App playbooks post enrichment comments to incidents using basic HTML (bold tags, line breaks). Up until roughly Sept 23 these rendered fine in the Defender portal incident page. Now they show as flat text: no bold, no line breaks, everything on one line.
Same comments still render correctly in Sentinel in the Azure portal, and the playbook runs are succeeding, so this looks like a portal rendering change rather than anything on our side.

Timing lines up with the Incident Cases preview (MC1477993). The docs for the legacy incident page were updated the same day and still say the comment field supports formatting, but I can't find anything that mentions a change to how comments render.

Tested manually as well: a hand-typed comment containing HTML tags and markdown bold shows the tags and asterisks literally, so neither renders.

Anyone else seeing this, or found a format that still renders in the new incident page?

We installed Defender for Identity v2 on 4 Domain controllers over 3 weeks ago.

For some reason i still don't see any single alert triggered in Defender console that is from Defender for Identity. The Thresholds are all set to High (default).

It this quite normal?

I'm having an issue with Defender for Identity and cannot submit a support request through the Defender portal as the AI auto closes the ticket, tells me it's an Azure issue, and directs me to the Azure support portal.

You would think a product with "Defender For..." in the title should be covered by Defender support? I also cannot submit an Azure support request as it forces me to choose an Azure subscription, which they don't have and is completely unrelated to DFI.

How can I get the Defender support team to take this request?

(The specific issue I have is Global health issues across all sensors for incorrect auditing set up, which I have set up correctly, and the DFI PowerShell module even tells me it is correctly configured on each server)

So i'm playing fc 27 and then a message pops up from defender that it has blocked a threat (as you can see in the picture its in german) for non germans it says that the programm is dangerous and It executes an attacker's commands. I already had it in fc 26 but because its also in fc 27 i'm a little concerned. Thanks in advance!