Library management for live response

New features in Microsoft Defender for Endpoint

February 2026

Type: Feature
Feature: What's new and release notes documentation updates
Preview/GA: GA
Description: The what's new and OS-specific release notes pages are now updated to provide better visibility and access to new features, improvements, and fixes:

• The what's new page (this page) is now named New features in Microsoft Defender for Endpoint and includes both features and links to latest release notes.
• The Release notes page now consolidates release details for all supported operating systems, including Windows Antivirus. The new page groups updates by platform and date, making it easier to find specific information.
• All previous release notes pages redirect to the consolidated release notes page.

Type: Feature
Feature: Library management for live response
Preview/GA: Preview
Description: You can now view and manage files and scripts used during live response sessions in the Microsoft Defender portal. With this enhancement, you get a centralized view of all uploaded files and their properties, and can upload, view, and delete files outside the live response session.

Type: Feature
Feature: Effective settings tab
Preview/GA: GA
Description: The Effective settings tab under the device inventory Configuration management tab is now generally available. In this tab, you can view the actual value and configuration source of each security setting on a device. This helps identify configuration attempts that didn't take effect and eliminates gaps where intended protections aren't enforced.

Type: Feature
Feature: Vulnerable components page renamed to Software components
Preview/GA: GA
Description: To reflect Defender Vulnerability Management's visibility into all software components identified in your organization, the Vulnerable components page is now named Software components.

Type: Feature
Feature: Improved Device Vulnerabilities report experience
Preview/GA: GA
Description: To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes the following changes and enhancements:

The Vulnerable devices by Windows 10/11 version over time section is now removed.
The report's filters only include the Device group filter.
The report's history is now limited to the last 30 days.

Note: These changes are now visible to government cloud customers, but aren't yet visible in air-gapped environments. This visibility will be added in the coming months.

Type: Release - macOS
Feature: Build 101.25122.0008
Preview/GA: GA
Description: Release version 20.125122.8.0 released: See enhancements and features for this release.

Type: Release - Linux
Feature: Build 101.25122.0004
Preview/GA: GA
Description: Release version 30.125122.0004.0 released: See enhancements and features for this release.

Type: Release - Windows
Feature: Windows Defender Antivirus: Platform 4.18.26010.5 / Engine 1.1.26010.1
Preview/GA: GA
Description: Release details for Windows Defender Antivirus platform and engine update.