Security

Microsoft Security July 2026: AI Defense Updates

3 min read

Summary

Microsoft’s July 2026 security updates focus on protecting AI environments, embedding AI into security operations, and strengthening identity, cloud, and data protection foundations. Key additions include Project Perception, new Defender protections for prompt injection and cloud agents, Entra passkeys by default, and expanded Purview controls for Copilot and shadow AI apps.

Need help with Security?Talk to an Expert

Introduction

Microsoft’s July 2026 security announcements show how quickly security operations are shifting toward AI-assisted and autonomous protection. For IT and security teams, these updates matter because they expand Microsoft’s coverage across AI apps, identities, endpoints, cloud workloads, and data movement.

What’s new in Microsoft Security for July 2026

Project Perception introduces agentic defense

Microsoft announced Project Perception, a coordinated system of specialized security agents and cybersecurity-focused models. It uses red team agents to find weaknesses, blue team agents to investigate threats, and green agents to harden environments in continuous workflows.

Defender expands AI security coverage

Microsoft Defender added several AI-focused protections:

  • Prompt injection protection for email, now in preview, to detect and isolate malicious AI instructions before they reach users.
  • Unified posture and runtime protection for cloud agents in Microsoft Agent 365, including Microsoft Foundry, Copilot Studio, and third-party managed agents.
  • Threat intelligence enhancements to improve detection, prioritization, and response inside SecOps workflows.

Stronger cloud and identity foundations

Defender Cloud Security Posture Management now extends to serverless containers, including Azure Container Apps, Azure Container Instances, and AWS ECS on Fargate. Microsoft also added tighter Defender and Entra integration so SOC teams can disable compromised identities directly with least-privilege controls.

On the identity side, Microsoft Entra ID is making passkeys the default authentication experience, reducing reliance on SMS and voice-based authentication ahead of Microsoft-provided telecom delivery retirement in 2027. Entra also added tenant governance for centralized cross-tenant administration and policy management.

Purview adds more AI and data protection controls

Microsoft Purview now integrates with Microsoft Entra Internet Access to detect and block sensitive data uploads to unmanaged SaaS and AI apps. Purview also introduced DLP for Microsoft 365 Copilot in preview, allowing admins to exclude external email content from being used as Copilot grounding data.

Purview Insider Risk Management also received a centralized alert experience and the Data Security Triage Agent is now generally available for deeper AI-assisted investigation.

Advanced endpoint management included in Microsoft 365

As of July 1, 2026, Microsoft Intune Suite capabilities are included in Microsoft 365 E5, with select features in E3. This broadens access to advanced endpoint management without added licensing cost.

Impact on IT administrators

Security and IT admins should pay close attention to the new AI-focused controls, especially around prompt injection, Copilot data governance, and unmanaged AI app usage. Identity teams should also prepare for passkeys becoming the default and review cross-team workflows between Entra and Defender.

Next steps

  • Review Defender preview features for AI threat protection.
  • Assess how Purview DLP for Copilot fits your data governance policies.
  • Plan passkey adoption and reduce dependence on SMS or voice authentication.
  • Evaluate newly included Intune Suite capabilities in Microsoft 365 E5.
  • Update SecOps processes to take advantage of new Defender and Entra integrations.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Alym Rayani
Microsoft SecurityMicrosoft DefenderMicrosoft EntraMicrosoft PurviewAI security

Related Posts

Security

Microsoft Security: Better Questions for AI Risk

Microsoft is urging security leaders to treat AI security as a systems challenge that requires better questions, clearer objectives, and stronger governance across data, identities, and processes. The message matters for IT and security teams adopting AI because success depends not just on more signals or tools, but on layered controls, human oversight, and decision-making designed for resilience.

Security

Project Perception: Microsoft AI Security Preview

Microsoft has introduced Project Perception, a new agentic security system designed to help organizations defend against AI-driven threats at machine speed. Entering public preview on August 3, it combines specialized agents, security context, and a multi-model architecture to improve vulnerability management and automate protection while keeping human defenders in control.

Security

Microsoft AI Red Teaming: Global EXTRA Alliance

Microsoft has launched the External Red Team Alliance (EXTRA), a global expansion of its AI Red Team to improve AI safety and security testing with outside experts. The initiative funds 18 university labs across six continents and builds an external network of specialists to assess emerging AI risks that internal teams alone may miss.

Security

Email Threat Landscape Q2 2026: Key Security Trends

Microsoft’s Q2 2026 email threat report shows a major 92% drop in Tycoon2FA-linked phishing following disruption efforts, alongside declines in QR code and CAPTCHA-gated phishing. However, defenders should note that attackers are shifting tactics, with Teams-based social engineering, credential phishing, and fast-moving business email compromise campaigns continuing to pose significant risk.

Security

Microsoft and AXA XL Expand Cyber Incident Response

Microsoft has partnered with AXA XL to bring Microsoft Defender Experts Cybersecurity Incident Response directly to cyber insurance policyholders. The move aims to speed up containment and recovery by aligning security, legal, executive, and insurance workflows before an incident occurs.

Security

Microsoft Black Hat 2026: AI and Supply Chain Defense

Microsoft used Black Hat USA 2026 to spotlight how attackers are abusing trusted software, identities, cloud services, and AI systems to scale attacks. The company also highlighted ongoing npm supply chain investigations, new Microsoft Defender Experts capabilities, and research sessions that give security teams practical guidance for defending trust paths.