Microsoft Defender for Office 365 Updates & Release Notes

New ApproverUpn field in the EmailPostDeliveryEvents table

The EmailPostDeliveryEvents table in Microsoft Defender XDR Advanced Hunting now includes the ApproverUpn field. This field identifies the user or administrator who approved a remediation action, helping security teams investigate and audit post-delivery email actions more efficiently.

Expanding user reporting in Teams to include meetings

Users can report scheduled or Meet now Microsoft Teams meetings or individual meeting participants as a security concern during or after the meeting. Users can also report a meeting participant that was incorrectly identified as suspicious as not a security concern. Depending on Teams user reported settings, reported meeting and participant metadata is sent to the specified reporting mailbox, to Microsoft, or both.

Separating Teams user reporting settings from email settings

Customers in Worldwide (WW) environments with Defender for Office 365 Plan 1, Defender for Office 365 Plan 2, Microsoft 365 E5, or Office 365 E5 can now manage Teams user reporting settings on a separate page at https://security.microsoft.com/securitysettings/teamsUserSubmission. This separation lets you configure different reporting destinations for Teams and Outlook user reports. For more information, see MC1478463.

Expanding user reporting in Teams to include group calls

Users can report completed or missed group Microsoft Teams calls from the call history as malicious (scam) or nonmalicious (non-scam). Depending on user reported settings, reported calls are sent to the specified reporting mailbox, to Microsoft, or both.

When automatic notifications use the default template, users receive notification emails in their preferred language based on their Outlook language settings. Custom notification templates configured by admins aren't affected. For more information, see Admin review for user reported messages.

Starting July 2026, new Microsoft Defender for Office 365 Plan 2 organizations use the Microsoft Defender unified role-based access control (Unified RBAC) model by default. For more information, see Configure Unified RBAC for Microsoft Defender for Office 365 and MC1246006.

Microsoft Defender for Office 365 Plan 1 included in Microsoft 365 E3

Microsoft 365 E3 now includes Microsoft Defender for Office 365 Plan 1. For more information about what's included in each plan, see Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet.

Prompt injection protection: Microsoft Defender for Office 365 now detects prompt injection attacks hidden in inbound email. For more information, see Prompt injection protection in Microsoft Defender for Office 365.

Promotions folder for bulk email (preview)

You can configure anti-spam policies to deliver bulk mail below the BCL threshold to the Promotions folder in supported versions of Outlook. For more information, see Deliver bulk mail below the BCL threshold to the Promotions folder.

Security Copilot email summary on the Email entity page

If you have a Microsoft Security Copilot subscription, you can generate an AI summary of email entity data directly from the Email entity page by selecting the Copilot action.

Remove users from Teams chats is generally available

The ability to remove internal users from Teams chats in the Teams message entity panel is now generally available.

New RBAC permission for email content associated with alerts

A new granular Unified RBAC permission Email & collaboration content: Emails associated with alerts (read) allows analysts to preview or download email messages associated with specific security alerts. For more information, see Email entity page actions.