May 18 – May 25, 2026

What changed

Cloud security reporting in the Microsoft Defender portal entered public preview on 20 May, adding built-in and custom reports for Defender for Cloud data under a new Reporting > Cloud tab. Analysts get predefined views such as the CNAPP Executive Summary (threat detection, secure-score trends, vulnerability management, recommendations, investigation and response activity, and regulatory compliance) and Cloud Posture, and can duplicate and customize sections, export to PDF, and control access with Private, Tenant-level, or Public visibility. For a SOC, this puts cloud posture and CNAPP signals into shareable reports without pushing data into a separate BI tool. (Microsoft Learn)

Defender for Cloud vulnerability scanning now covers Docker Hardened container images in preview (19 May), using Microsoft Defender Vulnerability Management to identify vulnerabilities so teams can confirm they ship the most secure builds. The rollout is gradual and requires no user action, though scanning more image types may increase cost. For analysts triaging container findings, it closes a blind spot in registries that rely on hardened base images. (Microsoft Learn)

Microsoft Purview Data Security Posture Management (DSPM) reached general availability, per the 21 May Microsoft Security roundup, with a reworked experience that unifies discovery, protection, and remediation in one workflow. Goal-oriented flows, deeper remediation, expanded reporting, and third-party visibility (partner solutions and the Data Security Posture Agent stay in preview) let teams discover sensitive data, assess risk, and act at scale from the same place; the release also adds support for administrative units. For a SOC, DSPM is where data-exposure risk gets surfaced and triaged before it becomes an exfiltration incident. (Microsoft Security Blog)

Microsoft Purview Data Security Investigations added optical character recognition (OCR) and custom examinations. OCR extracts text from images, bringing previously unreadable visual content into scope for AI-powered deep content analysis, and custom examinations let investigators define their own analysis focus beyond the built-in credential, risk, and PII checks. This gives an analyst running a data-incident investigation broader coverage and more tailored scoping. (Microsoft Security Blog)

Microsoft Purview visibility extended to Anthropic's Claude through a new Claude Compliance API and an Anthropic Claude data connector (connector in preview). Purview surfaces Claude Enterprise interactions and audit-log signals so security and compliance teams can detect and investigate Claude usage alongside Copilot, Copilot Studio, ChatGPT Enterprise, and other AI apps — including who used Claude, when, and what kinds of content were involved, viewable in Activity Explorer. For analysts, it brings a widely used third-party AI tool into the same audit and investigation surface as the rest of the estate. (Microsoft Security Blog)

Microsoft Entra ID Account recovery provides an advanced recovery path for users who have lost access to all their registered authentication methods. Unlike a traditional password reset, it centers on identity verification and trust re-establishment before new authentication methods are issued. For a SOC, a verification-gated recovery flow narrows the help-desk social-engineering path attackers use to seize accounts and makes recovery after a confirmed compromise safer. (Microsoft Security Blog)

Entra Connect Sync configuration changes will require interactive admin authorization, announced in the May Entra recap. Going forward, changing sync settings — enabling or disabling features via the Connect wizard or PowerShell, and cloud-side changes during uninstall — will require a verified, interactive sign-in from an authorized cloud administrator, with the cloud treated as the source of truth for sync feature state. For a SOC defending hybrid identity, this raises the bar on a path an on-prem foothold could otherwise use to quietly flip sync behavior; end-user experience and sync functionality are unchanged. (Microsoft Entra: What's new)

Entra phishing-resistant sign-in got two upgrades this month. System-preferred authentication expanded to the first factor (GA) in Microsoft-managed configurations, so the system now picks the highest-ranked registered method at each step — users with passkeys can be signed in without a password. Separately, Microsoft registration campaigns now support passkeys (FIDO2) (GA), letting admins nudge users to register a passkey during sign-in to drive adoption at scale. For a SOC, both push the tenant toward credentials that resist the AiTM and password-replay attacks that dominate identity incidents. (Microsoft Entra: What's new)

Azure role assignments can now be governed through Entitlement Management (preview), announced in the May Entra recap. You can put eligible and active assignments to Azure roles at the Management Group, Subscription, and Resource Group levels into access packages, bringing them into the same request, approval, and lifecycle model — and just-in-time, least-privilege posture — already used for apps and groups. For analysts, standing Azure RBAC that once lived outside any review process becomes something with an owner, an expiry, and an audit trail. (Microsoft Entra: What's new)

Sensitivity labels for Entra security groups entered public preview, announced in the May Entra recap. Administrators can apply Microsoft Purview sensitivity labels to Entra cloud security groups to govern settings such as guest access, using the same labels and policies that already apply to Microsoft 365 groups, managed from Purview and applied through the Entra admin center, Azure portal, or Graph. For a SOC, this extends a consistent guest-access guardrail to the security groups that frequently gate sensitive resource access. (Microsoft Entra: What's new)

Windows 365 for Agents expanded in public preview as a governed place for AI agents to run: managed Cloud PCs that let an agent operate its own desktop and applications inside a fully managed, auditable environment, controlled through existing identity, policy, and management tools such as Entra ID and Intune. Paired with Microsoft Agent 365 (which governs what an agent is authorized to do) and Purview's runtime DLP for agent prompts, it's the "where it executes" half of the emerging agent-security model. For a SOC starting to see autonomous agents in the environment, it's the difference between an agent running loose on a user's box and one running somewhere you can scope, log, and investigate. (Microsoft Security Blog)

Worth knowing

This was a lighter week ahead of Microsoft Build 2026 (June 2–3, San Francisco), where the larger Sentinel, Defender, and identity announcements land — expect the next few briefs to carry the Build wave. The tell in this week's releases is that AI-agent security is becoming its own discipline: Microsoft Agent 365 went GA earlier in May, Windows 365 for Agents is previewing the runtime environment, Purview added runtime DLP for agent prompts and the Claude audit connector, and Defender's local-AI-agent discovery and runtime protection arrive right after Build. If your org is starting to run coding agents, MCP servers, and Copilot-Studio agents, that is the coverage area to watch fill over the coming weeks — and the reason so much of a "quiet" week is really about governing non-human identities. (Microsoft Security Blog)

On the patching cadence, there was no Patch Tuesday in this window — May's shipped on the 12th (covered two issues back, ~130 CVEs and, for the first time in nearly two years, no zero-days) and the next drops 9 June, so the near-term calendar item is Build, not a new CVE batch. Worth folding into hunting time instead: recent Microsoft threat research on a stealthy intrusion through a compromised third-party IT services provider (mid-May) walks a real chain of legitimate-tool abuse, credential theft, and persistence — a useful reference for anyone building detections around supply-chain and remote-management-tool misuse. (Microsoft Security Blog)

Context for interns on where these features live: cloud security reporting, the CNAPP views, and the Docker Hardened scanning all sit in the unified Defender portal, part of the ongoing consolidation of Microsoft's security tooling into one console at security.microsoft.com — Defender for Cloud finished integrating there on 5 May. That migration has a hard edge worth remembering: Microsoft Sentinel in the Azure portal sunsets 31 March 2027, after which the Defender portal is the only interface. If you're learning the ropes now, learn them in the unified portal rather than the older Azure-portal blades. (Microsoft Learn)