This cumulative update adds three new threat detections for Microsoft Entra ID, gives you visibility into threats involving AI agents, and makes it easier to see where your identities are signing in from.
Want the full details? Click the link below!
What’s New in This Update
New threat detections
Security Policy Weakening. Get alerted when someone changes an Entra ID security policy in a way that lowers your protection, so you can review and roll back risky changes before attackers take advantage of them.
Auth Methods Policy Weakening. Catch changes that weaken your Entra ID authentication methods policies, such as enabling less secure sign-in methods, which attackers often use to make account takeover easier.
First Time Location. Spot sign-ins from locations a user has never signed in from before, an early signal of compromised credentials.
Visibility into AI agent activity
Expanded AI Agent tagging. The AI Agent tag now applies to any threat where an involved object is an AI agent, not only when the agent is the perpetrator. You’ll see the full picture of how agents are involved in threats, including when they’re the target or are otherwise affected, so nothing slips past your triage.
Location insights for Entra ID objects
Locations list. Every Entra ID object now includes a list of the locations it’s associated with, giving you a quick baseline when you’re investigating unusual activity.
Improved Activity Traceability with Originating Agent Details
Originating Agent field. Investigations and SIEM output now include an Originating Agent field that shows which agent captured the activity.
Bug Fixes
- Updated third-party dependencies in the web interface and the Python components to current patched versions.
- Fixed the Impossible Travel map being too small and causing unnecessary scrolling of the evidence.
- Fixed abnormality charts breaking when the page is resized.
- Fixed the expiration date of new application credentials not being aligned.
- Updated the bundled .NET runtime to version 10.0.14.
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Threat Manager > Threat Manager Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Threat Manager > Threat Manager Ideas |
| If you have something cool to show… | Show everyone what you built: Threat Manager > Threat Manager Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!