Every Friday
Cloud Life Security Radar
Review application exposure, the DFI opt-out deadline and Exchange mail-flow risk
Preserve tenant evidence if you authorized the applications named in Microsoft's Storm-0940 report. Defender for Identity introduces a 30-day decision on automatic activation and auditing. Purview adds FTP and SFTP controls, while a Windows update can disrupt on-premises Exchange. Linux MDE gets security fixes and macOS adds AI-agent runtime configuration support. Defender for Office 365 has announced a Move to quarantine action for later this autumn. Each item states the change, the limits of the evidence and what to validate.
This needs attention now
- 01Review named application exposure and preserve tenant evidence before remediation.
- 02Record the DFI banner decision and plan sensor and auditing changes before the 30-day deadline.
- 03Pilot FTP and SFTP DLP in Audit only before scoping enforcement and full file evidence.
- 04Review or export the local-agent baseline in Defender, reconcile newly visible agents and MCP endpoints with an owner and purpose, and compare the result with software inventory.
- 05Check that your Copilot DLP policies cover Cowork, then test label exclusion, sensitive prompts and web-search blocking in a pilot scope.
Tenant actions
Open actionsThe Radar contains 52 concrete tenant actions. Sign in with your organization account to track progress together.
Plan this edition
Add the Friday edition and its tenant actions to Outlook, or download the full edition as a readable document to share internally.
Microsoft 365 Security
Changes in Microsoft 365, Entra, Defender, Purview and the exposure landscape that need a decision in your tenant.
Compromised application credentials gave attackers rapid access to Microsoft 365 tenants
Microsoft attributes the activity to Storm-0940. A compromised multi-tenant application authenticated to Microsoft 365 customer tenants through applications already granted access, without interactive user sign-in. Microsoft observed subsequent Graph reconnaissance, application credential changes and attempted privilege changes. In some attacks, privileged cloud access was reached in under three hours. The article provides affected app IDs, indicators, Defender detections and official Defender XDR and Sentinel queries. This week, investigate the compromised multi-tenant application access path and the activity that followed in your tenant.
1 tenant action
Defender for Identity introduces a 30-day decision on automatic sensor activation and auditing
For existing licensed Defender for Identity organizations with an active workspace, eligible tenants receive a 30-day banner. Unless they select Opt out, Automatic sensor v3.x activation and Automatic Windows auditing configuration become enabled by default, even if currently Off. Activation targets eligible Windows Server 2019+ servers already onboarded to Defender for Endpoint, excluding servers with an existing DFI sensor. Auditing changes local audit policy and SACLs and checks every 24 hours. October also adds malicious or suspicious MFA-registration and Temporary Access Pass sign-in alerts, diamond-ticket, CVE-2025-33073, DPAPI, DNS-exfiltration and AD CS abuse alerts, and supported Okta alert types.
2 tenant actions
Purview Endpoint DLP can audit or block FTP and SFTP file transfers
Microsoft has made FTP and SFTP transfer controls generally available in Endpoint DLP. On managed Windows devices onboarded to Purview, policies can apply Audit only, Block, Block with override or Allow. Activity explorer records the user, device, file, policy and action. Full file evidence is supported. Microsoft recommends starting with a small pilot in Audit only.
1 tenant action
October Windows updates can disrupt on-premises Exchange mail flow and OWA
After the October Windows security update, including KB5126646, some on-premises Exchange 2016, 2019 and Subscription Edition environments can experience OWA sign-in failures, mail stuck in Outbox, mailbox replication errors, Event ID 1006/MapiExceptionMdbOffline and growing queues. Microsoft's issue was opened after the previous edition cutoff and last updated on 16 October at 21:48 PT. The new default Endpoint Mapper memory limit of 512 simultaneous Endpoint Lookup calls may be insufficient under load. Windows Server 2016, 2019, 2022 and 2025 are affected; October Exchange security updates are not required for the problem to occur.
1 tenant action
Agentic & AI Security
AI agents, Copilot and autonomous defense: what is verified today and what your organization can already control.
Defender expands local agent discovery to 60 supported agent types
Microsoft announced support for 35 additional local agent types, bringing the documented total to 60. Defender for Endpoint detects a supported local agent and its MCP configuration only after it observes agent activity on an onboarded endpoint. The support matrix lists discovery and runtime protection separately. Support applies only to the combinations listed there. This expands the local-agent discovery covered on 25 September; it is not a new product.
1 tenant action
Purview DLP for Microsoft 365 Copilot now extends to Cowork
On 19 October 2026 Microsoft set roadmap item 570845, Purview Data Loss Prevention for Microsoft Cowork, to Rolling out. Message Center post MC1477182 first announced the change on 22 September 2026 and planned worldwide general availability from mid-October to late October 2026. Existing and new DLP policies on the Microsoft 365 Copilot and Copilot Chat location apply to Cowork without separate configuration. Three protections are in scope: excluding files and emails with chosen sensitivity labels from responses, blocking prompts that contain sensitive information types (SITs), and keeping such prompts out of external web search.
1 tenant action
On the radar
Early signals that do not require action yet, but that we are following for the next editions.
- A permanent Microsoft fix for the Exchange Endpoint Mapper issue and instructions to reverse temporary changes.
- Tenant rollout and operational documentation for AI-agent runtime protection on macOS.
- DFI automatic enablement timing and which new alerts are available in your tenant.
- When Move to quarantine reaches your tenant (planned early November to mid-December 2026): test it with the chosen quarantine policy and Search and Purge approval.
- Technical documentation and availability for Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access, announced on 19 October. Do not enable these controls until Microsoft documents their status and prerequisites.
- Changes to the support matrix, especially runtime-protection coverage compared with discovery coverage.
Receive the Friday edition
One edition per week, with sources. Written for security leads, IT managers, Microsoft 365 administrators, architects and privacy officers.