> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ​​​​​​​​What’s new in Microsoft Security: September 2026​​ - URL: https://f4n6.co.uk/security-feed/whats-new-in-microsoft-security-september-2026/ - Published: 2026-09-24T18:30:03.000Z - Updated: 2026-09-24T18:30:03.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Microsoft published its monthly security portfolio update on 24 September 2026\. The post describes product capabilities, not vulnerabilities: no CVE is named, no security update is released, and no exploitation is reported, so no CVSS score, severity rating or CISA KEV state applies to this item. The entries most relevant to EMEA financial services clients are network-layer enforcement of Microsoft Purview data policy against on-behalf-of (OBO) agentic traffic through Entra Global Secure Access, expanded Purview auto-labeling scale, eDiscovery coverage for user-owned SharePoint embedded containers, and new archive and permanent-deletion controls in Purview Data Lifecycle Management. There is no patch deadline and no containment action to take today. The work this item implies is governance: establishing which AI agents act on your users' behalf, where those agents can send data, and whether the destinations sit inside your third-party risk register. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | Microsoft now enforces Purview classification at the network layer for on-behalf-of agentic traffic, which makes agent uploads to unsanctioned AI tools visible as a third-party ICT dependency that most registers of information do not list | Add unsanctioned AI destinations and the agent identities that reach them to the register of information and the third-party risk assessment before enforcement is switched on, so blocked traffic has a named owner and a recorded risk decision | | NIS2 Art. 21(2)(d): supply chain security measures | The same agentic egress path carries labelled content to third-party AI services that sit outside any contractual security arrangement | Extend supply chain security measures to agent-mediated egress: define approved AI destinations, log exceptions, and record who accepted the residual risk | No incident is described in this item, so the DORA incident management and reporting articles (Art. 17, Art. 18, Art. 19) and the NIS2 Art. 23 reporting obligation are not engaged. Nothing here triggers DORA Art. 24, Art. 29 or Art. 30, or the UK NIS 2018 OES/RDSP duties. ## 3\. Technical analysis & attack chain There is no attack chain to describe. This is a vendor capability announcement covering Microsoft Defender, Microsoft Security Copilot, Microsoft Purview, Microsoft Entra, and Microsoft Intune. No vulnerability, exploited component, malware family, threat actor or campaign appears in the source. The technical content below is what the new and changed capabilities do, because that determines what a defender can and cannot see. Email detonation summary, available to organisations running both Microsoft Defender and Microsoft Security Copilot, produces AI-generated explanations of URL and file sandboxing results. The stated purpose is to reduce the manual correlation work a SOC analyst does between detonation evidence and contextual signals. It requires both products; organisations running Defender alone do not get it. Purview and Entra Global Secure Access is now generally available and moves data security enforcement to the network layer. Purview classification and policies are enforced by Entra, and the coverage explicitly includes human actions and on-behalf-of agentic traffic. Sensitive files and text are discovered in real time and blocked from being shared to risky destinations. The vendor's example is an employee or an OBO agent attempting to upload a sensitive document to an unsanctioned AI tool, with the transfer stopped before the data leaves. The enforcement point matters: it is the network path, not the endpoint or the application, so it applies to agent traffic that never passes through an interactive user session. Purview auto-labeling gains scale and administration changes. Policy simulations now support up to 20 million items and up to 50,000 sites through adaptive scopes. Administrators can edit a policy without re-running the simulation. New audit insights and reporting show policy coverage and processing activity. The previous published ceiling, from the August 2026 post, was 500,000 SharePoint and OneDrive files processed per day, up from 100,000; the September post does not restate a daily processing limit, so treat the two figures as describing different constraints rather than a single number. Purview eDiscovery now supports search, hold, review and export of content in user-owned SharePoint embedded containers. Investigators can reach content from Microsoft Loop, Copilot Pages, Copilot Notebooks, and applications such as Outlook newsletters, mapped to a user, without requesting the container URL from a SharePoint administrator. An optional HTML conversion produces a more readable version for downstream legal review tools. Purview Data Lifecycle Management adds two controls. Administrators can archive inactive SharePoint content without archiving the entire site; archived content remains subject to retention and legal hold policies and remains discoverable for eDiscovery, while dropping out of Microsoft 365 Copilot indexing until it is reactivated. Priority Cleanup permanently deletes approved content, including stale Teams recordings and transcripts, so it is no longer discoverable in eDiscovery, SharePoint search, or Microsoft 365 Copilot. Microsoft Intune Enterprise Application Management, Microsoft Cloud PKI, and Intune Remote Help are coming to Government Community Cloud High (GCC High), with Enterprise Application Management also offered to Department of Defense organisations. These are accreditation-bound cloud environments and have no bearing on EMEA commercial tenants. One gap is worth flagging. The post's introduction says this month's updates help organisations "discover and control local AI agents", but no listed item delivers local AI agent discovery or control. The equivalent capability, discovery of more than 25 types of local AI agents and Model Context Protocol (MCP) servers across managed Windows and macOS devices, plus runtime blocking of prompt injection against GitHub Copilot CLI and Claude Code, was described in the June 2026 post and marked preview at that time. That description is single-sourced to Microsoft and its current general availability status is not stated in any source we hold; verify in your own tenant before relying on it. JPCERT/CC published a separate alert for the September 2026 Microsoft security updates. That is the patch-cycle document and is not the same publication as this post. No content was retrievable from that alert in our sources, so we make no claim about which CVEs it covers. ## 4\. Mitigation & containment P1, within 24 hours - Confirm whether Purview and Entra Global Secure Access network-layer enforcement is enabled in your tenant, and whether the policy scope covers agent identities and OBO tokens rather than interactive users only. Test it with a controlled upload of a labelled document to an unsanctioned AI destination and confirm the block fires before egress. - Inventory AI agents and MCP servers on managed Windows and macOS endpoints through Defender advanced hunting. This capability was described as preview in the June 2026 post; confirm its current state in your tenant. Any agent with reach into labelled content belongs in the review below. - Do not enable Priority Cleanup before the retention and legal hold checks in P3 are complete. It is irreversible and removes content from eDiscovery. P2, within 72 hours - Extend the third-party ICT register to cover unsanctioned AI destinations observed in egress and DLP logs, with a named owner and a recorded risk decision per destination. - Review auto-labeling configuration against the new limits: adaptive scopes, simulation of up to 20 million items and 50,000 sites, and the ability to edit a policy without re-running simulation. Re-run the simulation before any broad rollout, since editing without simulation is a convenience, not a validation step. - For legal and compliance teams, confirm eDiscovery can reach user-owned SharePoint embedded containers holding Loop, Copilot Pages, Copilot Notebooks and Outlook newsletter content. Test search, hold and export, and the optional HTML conversion path into your downstream review tooling. P3, within 7 days - Pilot item-level archiving of inactive SharePoint content rather than site-level archiving, and confirm archived content still satisfies retention and legal hold obligations and remains discoverable for eDiscovery. - Treat Priority Cleanup as a records-management decision, not a hygiene task. Require documented approval, a retention check, and a record of what was deleted, including Teams recordings and transcripts, because deletion removes the content from eDiscovery, SharePoint search and Copilot indexing. - GCC High and DoD capabilities require no action for EMEA commercial tenants unless you operate in those accredited clouds. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The item contains no hashes, domains, IP addresses, file paths, registry keys or command lines. The sources describe observable behaviours associated with the new controls, but no atomic indicators and no observed adversary activity. The table below lists monitoring targets derived from the vendor's description of its own capabilities, not from incident data. | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------- | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | OBO agent uploads of labelled content to unsanctioned AI destinations | Entra Global Secure Access and Purview network enforcement logs, DLP alerts | Low: derived from the vendor's description of the control, not from observed adversary activity | | Agent identities authenticating and acting without interactive user approval | Entra sign-in and audit logs for agent service principals | Low, same basis | | Local AI agent and MCP server processes on managed endpoints | Defender advanced hunting on Windows and macOS | Low: capability described in the June 2026 post, preview status at that time, single-sourced to Microsoft | ## 6\. Detection Insufficient indicators to author detection rules. ## 7\. Sources - Microsoft Security Blog, "What's new in Microsoft Security: September 2026", https://www.microsoft.com/en-us/security/blog/2026/09/24/whats-new-in-microsoft-security-september-2026/, 2026-09-24 - Microsoft Security Blog, "What's new in Microsoft Security: August 2026", https://www.microsoft.com/en-us/security/blog/2026/08/27/whats-new-in-microsoft-security-august-2026/, 2026-08-27 - Microsoft Security Blog, "What's new in Microsoft Security: July 2026", https://www.microsoft.com/en-us/security/blog/2026/07/30/whats-new-in-microsoft-security-july-2026/, 2026-07-30 - Microsoft Security Blog, "What's new in Microsoft Security: June 2026", https://www.microsoft.com/en-us/security/blog/2026/06/30/whats-new-in-microsoft-security-june-2026/, 2026-06-30 - JPCERT/CC, "Security Alert: Microsoft Releases September 2026 Security Updates", https://www.jpcert.or.jp/english/at/2026/at260025.html, no content retrievable - JPCERT/CC, "Security Alert: Microsoft Releases August 2026 Security Updates", https://www.jpcert.or.jp/english/at/2026/at260022.html, no content retrievable ## 8\. Adverse Trace position No severity assessment applies. This item carries no CVE, no CVSS score, no CISA KEV entry and no exploitation state, and we will not manufacture one for a product announcement. The client impact is governance rather than incident response: organisations that adopt network-layer enforcement for OBO agentic traffic without first registering the unsanctioned AI destinations and agent identities involved will have a control they cannot evidence under DORA Art. 28 or NIS2 Art. 21(2)(d). Our assessment of the local AI agent discovery claim rests on a single vendor source and a preview designation from June 2026; we treat it as unconfirmed until a client tenant confirms it. Adverse Trace will track whether Microsoft publishes general availability and EMEA tenant availability for the OBO agentic enforcement and the local agent discovery capability, and will issue a follow-up if either changes the third-party risk picture. Clients who want the agent inventory and register-of-information work scoped against their own tenant should contact their Adverse Trace analyst. --- [Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/09/24/whats-new-in-microsoft-security-september-2026/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*