Microsoft Purview: Use temporary permissions

Microsoft Purview - temporary permissions

Microsoft added a small but useful change to the August overview for Microsoft Purview: role group assignments can now be configured with an expiration date. When that date is reached, the assignment is removed automatically and access is revoked. For small and midsize organizations, this matters because Purview work is often temporary: an external specialist … Read more

MacSync Stealer: Defender XDR hunting pivots

MacSync Stealer - Defender hunting for macOS

Microsoft Defender Experts have published new details on MacSync Stealer. The macOS-focused information stealer uses changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. For companies that run Macs, the important point is that Microsoft does not only list domains. It describes recurring behavioral pivots that security teams can hunt for in … Read more

Defender for Cloud Apps: Migrate file policies to Purview

Defender for Cloud Apps - migrate file policies to Purview

Microsoft has set a clear date for Microsoft Defender for Cloud Apps: file policies retire on January 6, 2027. Organizations should recreate existing file policies as Microsoft Purview data loss prevention policies or auto-labeling policies before that date. For organizations with 10 to 250 users, this is not an abstract platform change. Many smaller IT … Read more

Purview auto-labeling: Review policies before enforcement

Microsoft Purview auto-labeling - simulation and Insights

Microsoft Purview is expanding the way teams evaluate auto-labeling policies. In August 2026, Microsoft highlighted two views: the simulation overview before enforcement and the new Insights tab for active policies. This matters to organizations with 10 to 250 users when confidential files and emails should receive sensitivity labels automatically. A rule that is too broad … Read more

Microsoft Sentinel: Defender portal required from March 2027

Microsoft Sentinel in the Defender portal - 2027 deadline

Microsoft is bringing Microsoft Sentinel and Defender XDR closer together in the Microsoft Defender portal. For existing Sentinel environments, this is more than a new interface: Microsoft documents a clear deadline. After March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Defender portal. … Read more