Microsoft Defender for Office 365 Updates & Release Notes

Localized default Mark as and notify email templates

When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more information, see Admin review for user reported messages.

Unified RBAC is the default permission model for new Defender for Office 365 Plan 2 organizations

Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model by default. For more information, see Configure Unified RBAC for Microsoft Defender for Office 365 and MC1246006.

Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3

Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet.

Prompt injection protection: Microsoft Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Microsoft Defender for Office 365.

Promotions folder for bulk email (preview)

You can configure anti-spam policies to deliver bulk mail below the BCL threshold to the Promotions folder in supported versions of Outlook. For more information, see Deliver bulk mail below the BCL threshold to the Promotions folder.

Security Copilot email summary on the Email entity page

If you have a Microsoft Security Copilot subscription, you can generate an AI summary of email entity data directly from the Email entity page by selecting the Copilot action.

Remove users from Teams chats is generally available

The ability to remove internal users from Teams chats in the Teams message entity panel is now generally available.

New RBAC permission for email content associated with alerts

A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more information, see Email entity page actions.