Microsoft security · what's new
EnterpriseEnrollment DNS CNAME. Intune support ends on 15 Jan 2027.It was a thin week, so this roundup covers 22 October to 5 November 2026, including items in Microsoft's monthly posts from that window. The nearest deadline is 10 November, when Windows 11 23H2 Enterprise and Education reach end of updates. The biggest new control is Conditional Access policy plans, now in public preview.
A note on coverage: we could not read Microsoft's product what's-new pages on Microsoft Learn for this edition, so it relies on Tech Community posts and Windows release health. Defender for Endpoint, Defender for Office 365 and Purview have no entries here, which does not mean nothing changed.
Policy plans let you group related Conditional Access policies and define users, apps and conditions once for every rule in the plan. They need Entra ID P1 or P2. A Conditional Access Administrator finds them under Entra ID > Conditional Access > Policy plans (preview).
Migration is gradual: your original policies are not changed and keep enforcing, while the new rules start Off. Validate in report-only mode, check the built-in impact metrics, then turn off the originals when you are ready. Microsoft Entra blog
Our take: start with the policies you understand best, not your admin protections, and keep a preview feature away from break-glass logic. A tenant with dozens of near-identical policies should benefit most. Measure against our Entra ID hardening checklist so consolidation does not quietly drop a control.
The first three items come from Microsoft's October post, which gives no GA or preview label and no licence details, so confirm both before you plan around them. Intune blog
The approval and scheduling process used for driver updates now covers quality updates. Monthly security, monthly non-security and out-of-band updates of both kinds can each be managed independently. It also covers .NET Framework updates and quick machine recovery controls.
Our take: a recorded approval step is easier to show an auditor than an informal one. Keep out-of-band security updates on the fastest path, though, so approval does not become the delay.
Intune's STIG baseline, previously limited to government clouds, is now available to commercial customers. You can audit Windows configuration against DISA recommendations without changing device settings. A new security baseline also covers Windows 365 for Agents Cloud PCs, with recommended settings for Windows 11, Edge and Defender for Endpoint.
Through Company Portal, standard users can change approved IPv4, IPv6 and DNS values without broad admin rights. Rules can be automatic or user confirmed, and confirmed rules can require a business justification, Windows authentication or both. Review who gets this: DNS settings are a security control too.
From 15 January 2027, Intune ends support for CNAME-based auto-discovery in Windows MDM-only enrollment. Check your DNS for an EnterpriseEnrollment record and read Microsoft's notice before changing anything. Windows IT Pro blog
The November 2026 Windows security update is the last for these editions. Microsoft recommends updating eligible devices to a supported version of Windows 11. Windows message center
Microsoft blocked certificate authorities affected by compromised eMudhra intermediate CA keys and removed seven associated certificates from the Windows and Edge trust lists. Keep automatic certificate trust and Edge component updates flowing, check disconnected devices, and replace certificates that depend on the removed ones. Windows IT Pro blog
Our take: isolated segments are the likely gap. If a network cannot reach Microsoft's update services, assume the change has not arrived until you have confirmed it there.
The certificates used for trusted connections to Windows Update expire in May and June 2027. Replacements reach most devices through monthly updates, but some may need IT action, so review unsupported or outdated devices first. Windows IT Pro blog
The October 2026 security update added auditing, on by default, and optional policy controls for ReFS volumes on externally attached storage. Enforcement controls stay off by default until January 2027. Use the audit period to find what depends on these volumes. Windows IT Pro blog
The January 2027 security update is the last for Windows Server 2016 and Windows 10 Enterprise LTSC 2021. Microsoft suggests Windows Server 2025 and Windows 11 Enterprise LTSC 2024. Extended Security Updates exist for both, and for Server 2016 only on Standard and Datacenter. Windows message center
Cross-tenant delegated access: GA. Analysts sign in with their home-tenant account instead of local admin or B2B guest accounts. Each governed tenant approves the relationship and chooses which roles and resource scopes to grant, and you keep access current through your own security groups. Sentinel permissions are assigned through Defender unified RBAC. If you run several tenants or work with an MSSP, review your guest accounts against this model.
ASIM EmailEvent schema: GA. Detections written against the schema keep working when another source adds a parser, with no rewrite. Deploy the ASIM parsers to start. Microsoft Sentinel blog
Want a second pair of eyes? Start with our free assessment or the Microsoft 365 identity check, or see our Entra ID hardening and Microsoft 365 security audit services.
Windows 11 23H2 Enterprise and Education reach end of updates on 10 November 2026, and the November 2026 security update is their last. Microsoft recommends moving eligible devices to a supported version of Windows 11.
Policy plans group related Conditional Access policies so users, apps and conditions are defined once for every rule in the plan. They are in public preview and need Entra ID P1 or P2. Existing policies keep enforcing until you turn them off.
Microsoft removed seven associated certificates from the Windows and Edge trust lists. Keep automatic certificate trust and Edge component updates flowing, check disconnected devices, and replace certificates that depend on the removed ones.
We review Entra ID, Intune and Defender configurations against a hardened baseline and give you a prioritized fix list, with the evidence your NIS2 or PCI DSS auditor will ask for.
Get in touch →