Last Updated on February 9, 2026 by Arnav Sharma
If you’re running any part of the Microsoft Defender stack, the past month brought some genuinely useful improvements worth knowing about. I’ve been tracking these changes and wanted to break down what actually matters for security teams versus what’s just noise.
The Big Story: Security Copilot Gets Serious About Threat Hunting
Microsoft has been pushing hard on AI-assisted security operations, and January marked a turning point. Three new agents landed in Security Copilot that fundamentally change how SOC teams can approach threat detection.
- Dynamic Threat Detection Agent is now running in preview as an always-on background service. Think of it as having a junior analyst who never sleeps, constantly sifting through your Defender and Sentinel data looking for anomalies that might slip past rule-based detection. It’s not replacing your team, but it’s handling the tedious pattern-matching that burns people out.
- The Threat Intelligence Briefing Agent hit general availability this month. Instead of manually compiling intel reports from various feeds, this agent automatically generates customized briefings based on threat actor activity relevant to your environment. I’ve seen teams spend hours each week on this kind of synthesis work, so automation here is genuinely valuable.
- The Threat Hunting Agent (still in preview) might be the most interesting of the three. You can describe what you’re looking for in plain English, and it generates the KQL queries, interprets results, and guides your hunting session. For organizations struggling to find experienced threat hunters, this lowers the barrier significantly.
Advanced Hunting Gets More Capable
The Defender XDR portal received several hunting improvements that make investigation work more efficient.
Partial results handling is a quality-of-life fix that addresses a real frustration. Previously, if your query generated results exceeding the 64 MB limit, you’d hit a wall. Now the portal returns whatever records fit within that limit and tells you the results are partial. Not perfect, but at least you’re not flying blind.
The BehaviorInfo and BehaviorEntities tables expanded with new columns covering User and Entity Behavior Analytics data. This gives you deeper visibility into how UEBA findings correlate with alerts and entity relationships. If you’re doing insider threat work or investigating compromised accounts, these additions make correlation much easier.
Two new schema tables dropped as well:
- CampaignInfo pulls email campaign details from Defender for Office 365, letting you hunt across coordinated phishing operations
- FileMaliciousContentInfo covers files scanned in SharePoint, OneDrive, and Teams, filling a visibility gap for collaboration platform threats
The hunting graph feature also reached GA with two new predefined threat scenarios for visual investigation. And if you’re building reusable queries, advanced hunting now supports custom functions with tabular parameters, which makes modular query development much cleaner.
Defender for Office 365: Blocking Threats in Teams
Here’s a straightforward but important addition. Admins can now block malicious sender addresses and domains directly within Teams communications.
Previously, if attackers were using Teams as a delivery mechanism (increasingly common as email security tightens), your blocking options were limited. Now you’ve got parity with email-based blocking capabilities. Simple change, real impact for organizations heavily using Teams for external collaboration.
Defender for Cloud Gets Private Connectivity
For organizations with strict network requirements, the new Microsoft Security Private Link option (preview as of January 8th) enables private connectivity to Defender for Cloud services.
This matters if you’ve been hesitant about cloud security tools because of data path concerns. Your traffic to Defender for Cloud no longer needs to traverse the public internet, which addresses compliance requirements for heavily regulated industries.
Platform Updates
Defender for Endpoint on Linux received build 101.25102.0005 in January. It’s a routine engine and platform update, but if you’re running Linux servers with Defender, make sure you’re current. These updates often include detection improvements that don’t make the headline announcements.
On the antivirus side, intelligence updates continue their regular cadence through KB2267602. Nothing dramatic changed in January, though December brought some service startup optimizations that improved boot-time behavior.
Defender Experts Suite Launch
Microsoft announced the Defender Experts Suite on January 6th, bundling their expert-led services into an integrated package. This includes hunting support, incident response assistance, and ongoing guidance delivered through the Defender ecosystem.
This isn’t a product update per se, but it signals Microsoft’s push to offer managed detection and response capabilities for organizations that need expert support without building it all in-house.
What This Means for Your Security Operations
Looking at these changes collectively, a few themes emerge:
- AI assistance is becoming practical. The Security Copilot agents aren’t theoretical anymore. They’re handling real workflows that previously required dedicated analyst time. If you haven’t evaluated Copilot integration, these new agents make a stronger case.
- Hunting capabilities keep expanding. Microsoft clearly sees advanced hunting as a competitive differentiator. The schema additions, visualization improvements, and natural language hunting all lower the skill barrier while increasing what’s possible.
- Collaboration security is catching up. The Teams blocking capability and the new file scanning visibility tables reflect the reality that attackers follow users. As work happens across more platforms, detection and response need to follow.
If you’re planning your security roadmap, these updates suggest focusing on hunting capability development and AI tool integration. The infrastructure is maturing quickly, and organizations that adopt these capabilities early will have advantages in detection speed and analyst efficiency.
For detailed rollout status and build changelogs specific to your environment, the official documentation remains the authoritative source. But hopefully this gives you a sense of what’s actually worth your attention this month.