THE PROMPT for Microsoft Security - Issue #62
Because every great journey starts with clicking the wrong link
Things from Me
Newsletter Update: A Short Hiatus While Life Gets Wonderfully Busy
Before we dive in, a quick heads‑up: the newsletter will take a brief hiatus while I’m on the road for the next few weeks. But for very good reasons.
Next week, my wife and I are heading to Paris to celebrate our 36th wedding anniversary. From there, we jump straight into Experts Live Denmark, which marks my third year in a row participating. This conference has grown astonishingly fast. From its first small year just three years ago to over 1,000 attendees this year. I’m incredibly proud to be part of its journey. Even better, my wife and my youngest daughter will be there too, both volunteering to help keep the event running smoothly.
After Denmark, I’ll be home for… roughly the length of a laundry cycle… before catching a flight to Redmond for a week. Then I’ll get a couple of weeks back home in March before heading once again to Redmond for the MVP Summit. And speaking of MVPs - I’m excited to share that I’ve recently stepped into an expanded role as the Security MVP Lead, guiding the Security area moving forward. It’s a big step, but one I’m genuinely thrilled about.
Thank you all for your continued enthusiasm for this newsletter and for the Microsoft security community. Your encouragement and engagement mean the world. I’ll be back with fresh updates once I return and catch my breath.
If you want to follow along with the travel, events, and all the behind-the-scenes moments, you can keep tabs on me here:
Substack: https://rodtrent.com
X: @RodTrent
LinkedIn: linkedin.com/in/rodtrent
I’ll be sharing photos, thoughts, and stories along the way.
…
Lastly…
Hey, I built a thing. Well, I’ve built a bunch of things recently. I caught the bug and I’ve jumped back into development recently. I felt that the best way to understand all the AI nonsense was to dive headlong into it and figure out the backend of everything. The best way to accomplish that, in my opinion, is to build things that take advantage of the depth of the AI stack.
I have many, many projects on the simmer. You can find them all here in my JunkDrawer repo: https://github.com/rod-trent/JunkDrawer
But one thing stood out recently and got enough interest that I’ve turned the project into an actual thing.
The Garmin Chat Desktop app is an application has taken on a life of its own. Who knew that Garmin ecosystem users wanted more from their fitness data than just manually sifting through Garmin Connect screens?
The Garmin Chat Desktop app connects to your own Garmin data and then uses your GenAI API of choice to reason over the data. The result has been phenomenal and really makes the Garmin data workable and meaningful. I currently have over 1,000 people testing the app and many of the updates have come from the feedback. If you’re also a Garmin user and want to get on the tester train, I’m happy to welcome any and all.
I fully expect to officially release the app sometime in the next couple months, with mobile versions on the way.
Read about it all about it here:
And, for those Peloton subscribers who are also part of the Garmin community, there’s: Peloton 2 Garmin Sync
…
Alright folks. That’s it for me for this week. We’ll talk soon—and thanks again for being the heart of this community.
-Rod
Things to Attend
Live AMA: Defining AI boundaries with data sensitivity - Tuesday, Feb 17, 2026, 9:00 AM PST Online - As AI becomes embedded in everyday work, traditional data security models break down. Copilots and agents can search, summarize, and recombine information at machine speed, creating new exposure paths for sensitive data — even when nothing is formally shared or exfiltrated.
In this session, we’ll explain why data sensitivity, not data location, is now the true security boundary, and what that shift means for protecting information in the age of AI. We’ll walk through how organizations can establish a shared understanding of what data is sensitive, use sensitivity labels to consistently define how that data should be handled, and automatically enforce protections wherever data is created or used — including in AI experiences.
We’ll close with a live Ask Me Anything (AMA), where you can bring real-world questions about securing Copilot and agents, scaling classification and labeling, and turning sensitivity into consistent, enforceable controls with Microsoft Purview.
Things that are Related
🛠️ Kql Toolbox #7: From Detection Coverage To Response Reality - So now comes the unavoidable next question: Are our detections actually aligned to how attackers operate — and are we getting faster at shutting them down? This is where many SOCs stall out… They collect alerts, map techniques, and celebrate coverage — but never stop to ask whether all that visibility is translating into better response outcomes.
Analysis of active exploitation of SolarWinds Web Help Desk - The Microsoft Defender Research Team observed a multi‑stage intrusion where threat actors exploited internet‑exposed SolarWinds Web Help Desk (WHD) instances to get an initial foothold and then laterally moved towards other high-value assets within the organization.
A one-prompt attack that breaks LLM safety alignment - Large language models (LLMs) and diffusion models now power a wide range of applications, from document assistance to text-to-image generation, and users increasingly expect these systems to be safety-aligned by default. Yet safety alignment is only as robust as its weakest failure mode. Despite extensive work on safety post-training, it has been shown that models can be readily unaligned through post-deployment fine-tuning.
Azure Monitor Agent Deployment Report - I have been using Power Bi more and more recently to create solutions to visuals and gather insights on data and a recent ask for help was to help understand the Azure Monitor Agent coverage, including identifying images that are not supported via the built in Azure policies.
Manipulating AI memory for profit: The rise of AI Recommendation Poisoning - Microsoft security researchers have discovered a growing trend of AI memory poisoning attacks used for promotional purposes, a technique we call AI Recommendation Poisoning.
Strengthen your cloud security expertise with new AI security training - As organizations accelerate their adoption of AI, the need for rigorous, cloud‑ready security skills has never been greater. To help meet that need, we’re releasing a wave of new and updated Microsoft Learn offerings this month, designed to help you secure AI workloads, modernize incident response, strengthen identity governance, optimize security operations across the Microsoft Cloud, and more.
Things to Watch/Listen To
Things to Have
Automated security investigation tool using Microsoft MCP Servers, GitHub Copilot, Python Modules and custom copilot-instructions - An investigation automation framework that combines GitHub Copilot, VS Code Agent Skills, and Model Context Protocol (MCP) servers to enable natural language security investigations. Ask questions like "Investigate this user for the last 7 days" or "Is this IP malicious?" and get comprehensive analysis with KQL queries, threat intelligence correlation, and professional reports.
Your complete guide to Microsoft experiences at RSAC™ 2026 Conference - In the agentic era, security must be ambient and autonomous, just like the AI it protects. This is our vision for security as the core primitive, woven into and around everything we build and throughout everything we do. At RSAC 2026, we’ll share how we are delivering on that vision through our AI-first, end-to-end, security platform that helps you protect every layer of the AI stack and secure with agentic AI.
Microsoft Sentinel Things
Update: Changing the Account Name Entity Mapping in Microsoft Sentinel - The upcoming update introduces more consistent and predictable entity data across analytics, incidents, and automation by standardizing how the Account Name property is populated when using UPN‑based mappings in analytic rules. Going forward, Account Name property will consistently contain only the UPN prefix, with new dedicated fields added for the full UPN and UPN suffix.
Lake-Only Ingestion for Microsoft Defender Advanced Hunting Tables is Now Generally Available - Today, we’re excited to announce the general availability (GA) of lake‑only ingestion for Microsoft XDR Advanced Hunting tables into Microsoft Sentinel data lake.
What’s new in Microsoft Sentinel: February 2026 - This month’s updates focus on how security teams ingest, manage, and operationalize content, with new connectors, multi-tenant content distribution capabilities, and an enhanced UEBA Essentials solution to surface high‑risk behavior faster across cloud and identity environments. We’re also introducing new partner-built agentic experiences available through Microsoft Security Store, enabling customers to extend Sentinel with specialized expertise directly inside their existing workflows.
The strategic SIEM buyer’s guide: Choosing an AI-ready platform for the agentic era - Organizations can choose to spend the next year tuning and integrating their SIEM stack—or simplify the architecture and let a unified platform do the heavy lifting. If they choose a platform, it should make it inexpensive to ingest and retain more telemetry, automatically shape that data into analysis‑ready form, and enrich it with graph‑driven intelligence so both analysts and AI can quickly understand what matters and why. The strategic SIEM buyer’s guide outlines what decision‑makers should look for as they build a future‑ready security operations center (SOC). Read on for a preview of key concepts covered in the guide.
All in Sentinel data lake - Microsoft just made data lake tier ingestion generally available for XDR Advanced Hunting tables in Microsoft Sentinel. If you’re running Sentinel today, this changes how you should think about your data strategy. Here’s the bottom line.
Public Preview Announcement: Empower Real-Time Security with Microsoft Sentinel’s CCF Push Feature - Today, we are excited to announce the public preview of our latest innovation, the Sentinel Codeless Connector Framework (CCF) Push feature. CCF Push addresses a critical need: enabling seamless, automated, and immediate delivery of security data to Sentinel, so teams can respond to threats as they happen.
Defender for Endpoint Things
Running KQL queries on Microsoft Defender for Endpoint through Azure Automation - In this post we will see how to run KQL queries on a Microsoft Defender for Endpoint through Azure Automation, PowerShell. and Graph API
Defender for IoT Things
Preview and edit the devices list during the site set up process - Before completing the site association process, preview the list of devices you have chosen to associate with the site, and remove any devices that aren’t to be included in this site. For more information, see preview devices.
Manually update the site association of a device - Manually assign or modify the site location for a specific device or set of devices. For more information, see manually update device site association.
Entra Things
Microsoft Entra Agent ID explained - Control AI agents as they are created across your environment by treating them like real identities with Microsoft Entra Agent ID.
Defender XDR Things
New built‑in Alert Tuning rules in Defender - We’ve often talked about alert fatigue here on the socautomators blog and how too many alerts create noise which can be the enemy of speed. The new built‑in alert tuning rules in Defender XDR improve how alerts are processed. These rules are meant to help analysts focus on the alerts most likely to require action, while automated triage runs behind the scenes. Starting in late January 2026, the alert tuning experience became available. On February 5, 2026 the functionality became active.
From signal to strategy: Closing attack paths with identity intelligence - Today we are excited to share more about how Microsoft Defender can help security professionals proactively understand how identity-related risks, like leaked credentials, relate back to critical assets, helping security professionals proactively close potential entry points before they can be exploited.
Manipulating AI memory for profit: The rise of AI Recommendation Poisoning - Microsoft security researchers have discovered a growing trend of AI memory poisoning attacks used for promotional purposes, a technique we call AI Recommendation Poisoning.
Microsoft Purview Things
Bringing AI-Powered Data Classification for Microsoft Fabric assets in Microsoft Purview Unified… - Microsoft Purview Unified Catalog offers automatic classification for Azure SQL databases and storage accounts. Run a scan with Scan rule sets (classification rules enabled), and the system detects patterns. Email addresses get email classifications, credit card numbers get credit card classifications. It works out of the box. For Microsoft Fabric lakehouse tables? No automatic classification. Microsoft Purview catalogs the assets and schemas, but classifications remain empty.