May 4 – May 11, 2026

Act by

• 31 Jul 2026 — Legacy grouped recommendations are removed from the Azure portal. They now show as "Set for deprecation"; the individual recommendations that replace them are GA. Re-point any automation, exemptions, or workbooks that key off the old grouped recommendation IDs before the cutoff. (Microsoft Learn)

What changed

Microsoft Defender for Cloud is now generally available inside the Microsoft Defender portal (5 May). Cloud posture management and threat protection sit alongside XDR in one console, with a unified cloud dashboard, a centralized cloud asset inventory enriched with risk and coverage data, and posture management (secure score, recommendations, attack paths, vulnerabilities) surfaced through Microsoft Security Exposure Management across Azure, AWS, and GCP. A risk-based Cloud secure score is available only in the Defender portal. For an analyst on shift this means cloud alerts and attack paths correlate against endpoint and identity signals in the same incident view instead of a separate Azure blade. (Microsoft Learn)

Individual recommendations for Defender for Cloud reached GA in the Azure portal (5 May), replacing the older grouped recommendation types with one finding per issue. Classic secure score is designed to stay functionally stable through the switch since each individual recommendation replaces its grouped equivalent, but in the Defender portal these granular findings now contribute to the risk-based Cloud secure score on their own context-aware merits. When you triage a posture gap, expect finer-grained, per-resource recommendations rather than a single rolled-up item. (Microsoft Learn)

Daily Cloud secure score is now an end-of-day snapshot rather than an average across the day (5 May), so a score value lines up with the posture at that point in time and is easier to correlate with a specific change. Microsoft recalculated historical values to match the new definition, so expect small differences when comparing trends across the transition. If you track secure score over time for reporting, this is a calculation change, not a real posture shift. (Microsoft Learn)

Conditional Access enforcement on Privileged Identity Management role activation reached general availability in Entra ID. Administrators can now require MFA or other Conditional Access controls at the moment a user activates a privileged role, so elevation is gated on fresh authentication signals instead of the session the user already holds. This closes a common gap where an eligible admin could activate a role from a stale or lower-assurance session. (Microsoft Entra Blog)

Scoped identity-response actions for SOC analysts entered public preview via an extended Entra Security Operator role. From the Microsoft Defender RBAC experience, an analyst can disable users, revoke sessions, mark users compromised, force password resets (including cloud-only accounts), and delete individual authentication methods — without holding broad Entra admin roles or escalating IAM during an incident. Permissions are scoped to non-admin users and a limited set of admin roles, which shortens containment while keeping least-privilege boundaries and an audit trail. (Microsoft Entra Blog)

Predictive shielding took proactive user containment to general availability, per the May Defender XDR roundup. The "contain user" action infuses activity data with exposure data to spot credentials that are exposed and at risk of being stolen and reused, then pre-emptively contains that user before the account is confirmed compromised — the identity equivalent of getting ahead of the attacker rather than reacting to a fired alert. Alongside it, the incident page's Activities tab now shows the live status of automatic attack disruption and predictive shielding actions for that incident, so an analyst can see exactly what the platform contained and when. For a SOC, this makes the automated containment auditable at a glance and gives you a clear place to review or reverse an action. (Microsoft Defender XDR — Monthly news May 2026)

AI-agent visibility in advanced hunting expanded. The AIAgentsInfo table gained more columns and now reaches beyond Copilot Studio to agents from Microsoft Foundry, third-party marketplace solutions, and custom line-of-business agents, and a new unified AgentsInfo table entered preview to cover agent inventory and governance across Copilot Studio, Foundry, Microsoft 365 Copilot, third-party, and endpoint-discovered agents in one schema (AIAgentsInfo stays available until 1 July 2026). As organizations start running coding agents and MCP-connected tools, this is the hunting surface for asking which agents exist, who owns them, and what they can touch — a blind spot most SOCs don't yet have coverage for. (Microsoft Defender XDR — Monthly news May 2026)

The Defender for Containers sensor now installs via a direct Helm chart instead of the previous installation scripts (6 May), with environment-specific Helm commands for AKS, EKS, and GKE. It is a deployment-mechanics change rather than a detection change, but teams standing up or re-onboarding container sensors should use the updated commands. (Microsoft Learn)

Entra pushed phishing-resistant sign-in further into the default path. In the May updates, system-preferred authentication extended to the first factor in Microsoft-managed configurations (GA): the system now picks the highest-ranked registered method at each step, so a user with a passkey can be signed in without a password at all. In the same wave, passkey (FIDO2) support went GA in the Entra registration campaign, letting admins nudge users to enroll passkeys during sign-in, and the passkey policy got a dedicated 20-KB allocation with the per-tenant passkey-profile limit raised from 3 to 10. For a SOC, wider passkey coverage is the durable fix for the credential-theft and MFA-fatigue cases that fill the queue — worth tracking adoption as a leading indicator of fewer identity incidents. (Microsoft Entra — What's new)

Worth knowing

Microsoft's May Entra roundup reiterated the move from Entra Connect Sync to the cloud-native Entra Cloud Sync as the primary hybrid identity synchronization solution. Starting July 2026, tenants will be notified of their assigned transition window through the Microsoft 365 Message Center, Entra Connect Health, and targeted email, with hybrid authentication experiences unchanged. In the same May updates, Entra Connect Sync also gained interactive admin authorization for configuration changes — enabling or disabling a sync feature, via the wizard or PowerShell, will now require a fresh authorized cloud-admin sign-in, closing a path where sync settings could be altered without a strong, attributable approval. Identity and SOC teams that depend on on-premises sync should watch the Message Center for their window and plan a readiness check. (Microsoft Entra Blog)

Two small navigation and consolidation notes worth knowing for interns learning the portal. Defender Experts for XDR customers now get Defender Experts as its own entry in the Defender portal navigation rather than only a home-page status card — a minor change, but it makes the managed-service surface easier to find during an escalation. More broadly, the Defender for Cloud GA above is another step in the ongoing consolidation of Microsoft's security tooling into one console at security.microsoft.com; that migration has a hard edge worth remembering, since Microsoft Sentinel in the Azure portal sunsets 31 March 2027, after which the Defender portal is the only interface. If you're learning the ropes now, learn them in the unified portal. (Microsoft Defender XDR — Monthly news May 2026)

On the patch cadence, there was no Patch Tuesday in this window — May's release lands 12 May (covered in the next issue), and no out-of-band Microsoft advisory shipped between 5 and 11 May. The through-line across this week's releases is AI-agent security moving from concept to tooling: the AgentsInfo hunting schema, predictive shielding acting on exposed credentials, and the Sentinel data-lake work landing later in the month all point at the same gap. If your org is beginning to run coding agents and MCP servers on endpoints and in M365, that is the coverage area to watch fill over the coming weeks. (Microsoft Defender XDR — Monthly news May 2026)