What's new in Defender for Cloud features
This article summarizes what's new in Microsoft Defender for Cloud. It includes information about new features in preview or in general availability (GA), feature updates, upcoming feature plans, and deprecated functionality.
This page is updated frequently with the latest updates in Defender for Cloud.
Find the latest information about security recommendations and alerts in What's new in recommendations and alerts.
Tip
Get notified when this page is updated by copying and pasting the following URL into your feed reader:
https://aka.ms/mdc/rss
November 2024
| Date | Category | Update |
|---|---|---|
| November 19 | Preview | Updated versions of CIS standards for managed Kubernetes environments and new recommendations |
| November 7 | GA | Enhanced Kubernetes (K8s) Alert Documentation and Simulation Tool |
Updated versions of CIS standards for managed Kubernetes environments and new recommendations
November 19, 2024
Defender for Cloud's regulatory compliance dashboard now offers updated versions of the Center for Internet Security (CIS) standards for assessing the security posture of managed Kubernetes environments.
From the dashboard, you can assign the following standards to your Azure Kubernetes resources:
- CIS Azure Kubernetes Service (AKS) v1.5.0
To ensure the best possible depth of coverage for these standards, we've enriched our coverage by also releasing 79 new Kubernetes-centric recommendations.
To use these new recommendations, either assign the standards listed above or create a custom standard and include one or more of the new assessments in it.
Enhanced Kubernetes (K8s) Alert Documentation and Simulation Tool
November 7, 2024
Key features
- Scenario-based alert documentation: K8s alerts are now documented based on real-world scenarios, providing clearer guidance on potential threats and recommended actions.
- New Simulation Tool: A powerful simulation tool is available to test your security posture by simulating various attack scenarios and generating corresponding alerts.
Benefits
- Improved alert understanding: Scenario-based documentation provides a more intuitive understanding of K8s alerts.
- Enhanced threat response: Alerts are enriched with valuable context, enabling faster and more accurate responses.
- Proactive security testing: The new simulation tool allows you to test your security defenses and identify potential vulnerabilities before they're exploited.
October 2024
| Date | Category | Update |
|---|---|---|
| October 6 | Preview | Kubernetes Identity and Access information in the security graph |
Kubernetes Identity and Access information in the security graph (preview)
October 6, 2024
Kubernetes Identity and Access information is added to the security graph, including nodes that represent all Kubernetes Role Based Access Control (RBAC) related entitles (service accounts, roles, role bindings, etc.), and edges that represent the permissions between Kubernetes objects. Customers can now query the security graph for their Kubernetes RBAC, and related relationships between Kubernetes entities (Can Authenticate As, Can Impersonate As, Grants Role, Access Defined By, Grants Access To, Has Permission To, etc.)
Full discovery of container images in supported registries
October 6, 2024
Defender for Cloud now collects inventory data for all container images in supported registries, providing full visibility within the security graph to all images in your cloud environments, including images that currently don't have any posture recommendations.
Querying capabilities through the Cloud Security Explorer are improved so users can now search for container images based on their metadata (digest, repository, OS, tag, and etc.)
September 2024
| Date | Category | Update |
|---|---|---|
| September 22 | Upcoming change | Cloud security explorer experience improvements |
| September 18 | Deprecation | Deprecation of MMA auto-provisioning capability |
| September 15 | GA | Integration with Power BI |
| September 9 | Deprecation | Defender for Servers feature deprecation |
Cloud security explorer experience improvements
September 22, 2024
Estimated date for change: October 2024
The Cloud Security Explorer is set to improve performance and grid functionality, provide more data enrichment on each cloud asset, improve search categories, and improve CSV export report with more insights on the exported cloud assets.
Deprecation of MMA auto-provisioning capability
September 18, 2024 As part of the MMA agent retirement, the auto provisioning capability that provides the installation and configuration of the agent for MDC customers, will be deprecated as well in two stages:
By the end of September 2024- auto provisioning of MMA will be disabled for customers that are no longer using the capability, as well as for newly created subscriptions. After end of September, the capability will no longer be able to be re-enabled on those subscriptions.
End of November 2024- auto provisioning of MMA will be disabled on subscriptions that haven't yet switched it off. From that point forward, it can no longer be possible to enable the capability on existing subscriptions.
Integration with Power BI
September 15, 2024
Defender for Cloud can now integrate with Power BI. This integration allows you to create custom reports and dashboards using the data from Defender for Cloud. You can use Power BI to visualize and analyze your security posture, compliance, and security recommendations.
Learn more about the new integration with Power BI.
Defender for Servers feature deprecation
September 9, 2024
Both Adaptive application controls, and Adaptive network hardening are now deprecated.
August 2024
| Date | Category | Update |
|---|---|---|
| August 1 | GA | Enable Microsoft Defender for SQL servers on machines at scale |
Enable Microsoft Defender for SQL servers on machines at scale
August 1, 2024
You can now enable Microsoft Defender for SQL servers on machines at scale. This feature allows you to enable Microsoft Defender for SQL on multiple servers at once, saving time and effort.
Learn how to enable Microsoft Defender for SQL servers on machines at scale.
July 2024
| Date | Category | Update |
|---|---|---|
| July 18 | Upcoming update | Deprecation of MMA-related features as part of agent retirement |
| July 15 | Preview | Binary Drift Public Preview in Defender for Containers |
| July 11 | Upcoming update | GitHub application permissions update |
| July 10 | GA | Compliance standards are now GA |
| July 9 | Upcoming update | Inventory experience improvement |
| July 8 | Upcoming update | Container mapping tool to run by default in GitHub |
Deprecation of MMA-related features as part of agent retirement
July 18, 2024
Estimated date for change: August 2024
As part of the deprecation of the Microsoft Monitoring Agent (MMA) and the updated Defender for Servers deployment strategy, all security features for Defender for Servers will now be provided through a single agent, or via agentless scanning capabilities. This won't require dependence on either the MMA or Azure Monitoring Agent (AMA).
As we approach the agent's retirement in August 2024, the following MMA-related features will be removed from the Defender for Cloud portal:
- Display of MMA installation status on the Inventory and Resource Health blades.
- The capability to onboard new non-Azure servers to Defender for Servers via Log Analytics workspaces will be removed from both the Inventory and Getting Started blades.
Note
We recommend that current customers, who have onboarded on-premises servers using the legacy approach, should now connect these machines via Azure Arc-enabled servers. We also recommend enabling the Defender for Servers Plan 2 on the Azure subscriptions to which these servers are connected.
These steps will ensure there is no loss of security coverage due to the retirement of the Log Analytics agent.
You can use this custom workbook to keep track of your Log Analytics Agent (MMA) estate and monitor the deployment status of Defender for Servers across Azure VMs and Azure Arc machines.
Binary Drift public preview now available in Defender for Containers
We're introducing the public preview of Binary Drift for Defender for Containers. This feature aids in identifying and mitigating potential security risks associated with unauthorized binaries in your containers. Binary Drift autonomously identifies and sends alerts about potentially harmful binary processes within your containers. Furthermore, it allows the implementation of a new Binary Drift Policy to control alert preferences, offering the ability to tailor notifications to specific security needs.
GitHub application permissions update
July 11, 2024
Estimated date for change: July 18, 2024
DevOps security in Defender for Cloud is constantly making updates that require customers with GitHub connectors in Defender for Cloud to update the permissions for the Microsoft Security DevOps application in GitHub.
As part of this update, the GitHub application will require GitHub Copilot Business read permissions. This permission will be used to help customers better secure their GitHub Copilot deployments. We suggest updating the application as soon as possible.
Permissions can be granted in two different ways:
In your GitHub organization, navigate to the Microsoft Security DevOps application within Settings > GitHub Apps and accept the permissions request.
In an automated email from GitHub Support, select Review permission request to accept or reject this change.
Inventory experience improvement
July 9, 2024
Estimated date for change: July 11, 2024
The inventory experience will be updated to improve performance, including improvements to the pane's 'Open query' query logic in Azure Resource Graph. Updates to the logic behind Azure resource calculation might result in other resources counted and presented.
Container mapping tool to run by default in GitHub
July 8, 2024
Estimated date for change: August 12, 2024
With DevOps security capabilities in Microsoft Defender Cloud Security Posture Management (CSPM), you can map your cloud-native applications from code to cloud to easily kick off developer remediation workflows and reduce the time to remediation of vulnerabilities in your container images. Currently, you must manually configure the container image mapping tool to run in the Microsoft Security DevOps action in GitHub. With this change, container mapping will run by default as part of the Microsoft Security DevOps action. Learn more about the Microsoft Security DevOps action.
June 2024
| Date | Category | Update |
|---|---|---|
| June 10 | Upcoming update | SQL vulnerability assessment automatic enablement using express configuration on unconfigured servers. Estimated update: July 10, 2024. |
| June 3 | Upcoming update | Changes in identity recommendations behavior Estimated update: July 10 2024. |
Update: SQL vulnerability assessment automatic enablement
June 10, 2024
Estimated date for change: July 10, 2024
Originally, SQL Vulnerability Assessment (VA) with Express Configuration was only automatically enabled on servers where Microsoft Defender for SQL was activated after the introduction of Express Configuration in December 2022.
We'll be updating all Azure SQL Servers that had Microsoft Defender for SQL activated before December 2022 and had no existing SQL VA policy in place, to have SQL Vulnerability Assessment (SQL VA) automatically enabled with Express Configuration.
- The implementation of this change will be gradual, spanning several weeks, and doesn't require any action on the user's part.
- This change applies to Azure SQL Servers where Microsoft Defender for SQL was activated at the Azure subscription level.
- Servers with an existing classic configuration (whether valid or invalid) won't be affected by this change.
- Upon activation, the recommendation 'SQL databases should have vulnerability findings resolved' might appear and could potentially impact your secure score.
Update: Changes in identity recommendations behavior
June 3, 2024
Estimated date for change: July 2024
These changes:
- The assessed resource will become the identity instead of the subscription
- The recommendations won't have 'subrecommendations' anymore
- The value of the 'assessmentKey' field in the API will be changed for those recommendations
Will be applied to the following recommendations:
- Accounts with owner permissions on Azure resources should be MFA enabled
- Accounts with write permissions on Azure resources should be MFA enabled
- Accounts with read permissions on Azure resources should be MFA enabled
- Guest accounts with owner permissions on Azure resources should be removed
- Guest accounts with write permissions on Azure resources should be removed
- Guest accounts with read permissions on Azure resources should be removed
- Blocked accounts with owner permissions on Azure resources should be removed
- Blocked accounts with read and write permissions on Azure resources should be removed
- A maximum of three owners should be designated for your subscription
- There should be more than one owner assigned to your subscription
May 2024
| Date | Category | Update |
|---|---|---|
| May 22 | Update | Configure email notifications for attack paths |
| May 21 | Update | Advanced hunting in Microsoft Defender XDR includes Defender for Cloud alerts and incidents |
| May 2 | Update | Security policy management. |
Update: Configure email notifications for attack paths
May 22, 2024
You can now configure email notifications when an attack path is detected with a specified risk level or higher. Learn how to configure email notifications.
Update: Advanced hunting in Microsoft Defender XDR includes Defender for Cloud alerts and incidents
May 21, 2024
Defender for Cloud's alerts and incidents are now integrated with Microsoft Defender XDR and can be accessed in the Microsoft Defender Portal. This integration provides richer context to investigations that span cloud resources, devices, and identities. Learn about advanced hunting in XDR integration.
GA: Security policy management
May 2, 2024
Security policy management is now generally available. This enables security teams to manage their security policies in a consistent way and with new features
Learn more about security policies in Microsoft Defender for Cloud.
For details on the new API version, see Microsoft Defender for Cloud REST APIs.