Microsoft Roadmap, messagecenter and blogs updates from 24-12-2025

Updated December 23, 2025: We have paused rollout of this feature. We will announce via Message center when we are ready to proceed. Thank you for your patience. 

As part of our ongoing convergence process for all Microsoft Defender workloads, we planned to retire SIEM (Security Information and Event Management) agents from Microsoft Defender for Cloud Apps in late December 2025 (previously mid-November) and ending early January 2026 (previously late November 2025). We have puased this release and will communicate via Message center when we are ready to proceed.

We recommend you transition to APIs that support the management of activities and alerts data from multiple workloads.

[How this will affect your organization:]

Existing Microsoft Defender for Cloud Apps SIEM agents will function as is until the SIEM agents retire, but no new SIEM agents can be configured starting June 19, 2025. Microsoft Sentinel agents will remain supported and can still be added.

Defender for Cloud Apps alerts and activities data currently supported in the SIEM agents are also available in the unified API and SIEM solutions that provide access to alerts and activity data for all Microsoft security products, for cross-workload visibility:

• For alerts and activities, Defender XDR streaming API: Stream Microsoft Defender XDR events – Microsoft Defender XDR | Microsoft Learn
• For Microsoft Entra ID Protection login events: IdentityLogonEvents table in the advanced hunting schema – Microsoft Defender XDR | Microsoft Learn
• For alerts, Microsoft Graph security alerts API (v2): List alerts_v2 – Microsoft Graph v1.0 | Microsoft Learn
• We also recommend viewing Defender for Cloud Apps alerts data in the Microsoft Defender XDR incidents API. Learn more: Microsoft Defender XDR incidents APIs and the incidents resource type – Microsoft Defender XDR | Microsoft Learn

These APIs enhance security monitoring and management and offer additional supported capabilities that utilize data from multiple Microsoft Defender workloads.

[What you need to do to prepare:]

To ensure continuity and access to the same data available before this retirement through Microsoft Defender for Cloud Apps SIEM agents, we recommend transitioning to the supported unified API and SIEM solutions. We encourage you to begin planning your migration to these solutions to take advantage of their enhanced capabilities.

Learn more: Generic SIEM integration – Microsoft Defender for Cloud Apps | Microsoft Learn

Updated December 23, 2025: We have updated the content and timeline. Thank you for your patience. 

[Introduction]
Starting in January, the Microsoft 365 Copilot app for Windows will introduce a new Update button. This button will not block the app UI; users will be able to continue interacting with the app when the button appears. This update encourages users to use the latest version of the app—ensuring access to new features, performance improvements, and security updates—without disrupting their workflow.

[When this will happen:]
General Availability: Rollout begins in January 2026 (previously early November 2025) and completes by end of January 2026 (previously end of November 2025).

[How this affects your organization:]

• Who is affected: All users of the Microsoft 365 Copilot app on Windows.
• What will happen:
  • A new Update button will appear in the top-right corner in the app when a newer version is available.



• The button is non-blocking; users can continue using the app without interruption.
• Clicking the button opens a prompt with two options:
  • Update now: The app will close, install the update in the background, and relaunch with the latest version.
  • Update later: The app remains open in its current version, and the update button stays visible for future use.



• Once updated, the button disappears until a new version becomes available.
• No changes to app functionality or user settings are introduced with this update mechanism.

[What you can do to prepare:]

• Communicate this change to your users to avoid confusion.
• No admin action is required.
• For internal documentation, you may wish to note the new update behavior.

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.