October 15, 2026 SaaS Alerts release notes

Ask AI - MSFT Agent

Enhancements

More complete investigations

Investigations now process large sign-in and audit logs in smaller, targeted segments, helping more investigations run to completion. Repeated log entries are consolidated with a count and the first and last occurrence times. If an investigation must stop before completing all checks, the report clearly identifies the checks that remain.

More targeted investigation checks

Investigations now begin with the alert and prioritize checks based on the most likely explanation and strongest alternative instead of running the same sequence of checks for every sign-in or account alert. Reports also identify checks that were intentionally omitted and explain why.

Clearer investigation conclusions

Investigations now use the information you provide as the starting point and state the cause supported by the available evidence rather than continuing to report a cause as unresolved when the evidence explains the issue. If a record contradicts the information provided, the report identifies the discrepancy.

Improved identification of suspicious account changes

When an investigation identifies a suspicious change, such as a forwarding rule or app consent, it now checks the account's sign-ins and Microsoft risk detections to help identify who made the change and where it originated. If this cannot be determined, the report states that clearly.

Improved recognition of Microsoft applications and activity

Investigations now recognize more Microsoft applications and background services, reducing cases where legitimate Microsoft activity is treated as suspicious or common applications such as Microsoft Office or OneDrive sync are reported as unidentified. Unrecognized applications can also be checked against Microsoft's application ownership records. Applications named to resemble Microsoft applications but owned by another party continue to be identified as third-party applications.

Clearer reporting when Defender indicators are unavailable

When Microsoft Defender for Endpoint indicators cannot be accessed, the assistant now identifies whether the connection requires the Ti.ReadWrite.All permission to be added by a Fortify administrator or Microsoft Defender for Endpoint is unavailable in the tenant.

Fixes

Improved handling of interrupted deep investigations

Resolved an issue where certain email or log content could cause a deep investigation to end with the message, "I'm sorry, but I cannot assist with that request," causing the investigation results to be lost. Investigations now report the information they were able to find and identify any checks they could not complete.

Correct date ranges for recent investigations

Investigations for recent periods, such as the last seven days, now include activity from the current day. Reported totals now cover the period requested.

Accurate security alert evidence counts

Microsoft security alert evidence totals now match the number of evidence items listed in the results.

Clearer audit log result counts

When an audit log search returns more events than can be displayed in a single response, the assistant now reports how many events are being shown and indicates that additional events may exist instead of presenting the search limit as the total number of matching events.

Improved Teams connection link validation

When requesting a Teams connection link for an organization that already has a Teams connection, the assistant now verifies the connected organization. If it matches the requested organization, the assistant provides the link. If another organization is connected, the assistant identifies the connected organization, explains that only one organization can be connected at a time, and describes what moving the connection involves.

Improved template name matching

Templates can now be found when the requested name differs only in dash type or spacing, preventing templates from being incorrectly reported as missing.