Action required: Review re-enablement of your Microsoft 365 connector in Defender XDR

[What and Why:]

Microsoft is updating how Microsoft 365 activity data is made available in Microsoft Defender XDR. As part of this update, Microsoft plans to enable the Microsoft 365 connector by default for eligible organizations so that this data is available in Defender XDR. This change helps prepare your environment for future Integrated SOC experiences that use Microsoft 365 activity data in Defender XDR. Learn more about Integrated Security Operations Center (ISOC) in Microsoft Defender.

[Rollout Schedule:]

General Availability (Worldwide): We will begin rolling out in early November 2026 and expect to complete by late November 2026.

[Impact on Your Organization:]

Who is affected:

• Organizations with Microsoft 365 activity data eligible for the Microsoft 365 connector in Microsoft Defender XDR.

Platforms/Services:

• Microsoft Defender XDR
• Microsoft 365 connector

What will happen:

• After the connector is enabled, Microsoft 365 activity data will be available in Microsoft Defender XDR through CloudAppEvents.
• You may see additional Microsoft 365 activity and related security alerts in Defender XDR.
• You will continue to have control over the connector configuration after enablement.

[Action Required/Recommendations:]

• No action is required if you want Microsoft to enable the connector.
• If your organization has privacy, compliance, or regulatory requirements that require the Microsoft 365 connector to remain disabled, open a Microsoft Support case before November 1, 2026.
• If you opt out, some Integrated SOC security experiences that depend on Microsoft 365 activity data may not be available or may not provide equivalent protection.

[Compliance considerations:]