Microsoft Defender & Security Baselines: The Complete Guide (2026)

Endpoint security in a Microsoft-managed environment comes down to two things working together: Microsoft Defender catching and responding to threats in real time, and security baselines making sure devices are configured defensively in the first place. Both have moved fast through 2026. Here’s a current, practical guide to both.

Microsoft Defender for Endpoint: What’s New

Defender for Endpoint has had a genuinely significant delivery-mechanism change in 2026: EDR sensor and detection updates are moving off the monthly Windows cumulative update cycle and onto Microsoft Update instead. Practically, that means security improvements can ship the moment they’re ready rather than waiting for the next Patch Tuesday — a real gain for response speed, though it also means EDR behaviour can now change between OS patch cycles, so change-management processes that assumed EDR only moved in lockstep with OS updates need a small rethink.

On the detection and response side, automatic attack disruption has been extended with automatic device isolation — when Defender identifies a compromised device with high confidence, it can now isolate it automatically, cutting most network traffic while keeping the management/security channel alive. Pair this with Selective Response Actions, which lets you define different automated-response behaviour for Tier-0 systems (domain controllers, PKI servers, etc.) versus general endpoints, so you’re not auto-isolating a domain controller with the same aggressiveness as a user laptop.

Defender for Cloud: Posture and Workload Protection

Defender for Cloud extends the same posture-management and threat-detection philosophy to Azure, hybrid, and multi-cloud workloads — covering VMs, containers, databases, and storage. The core value is the same as it’s always been: continuous configuration assessment (Secure Score) plus workload-specific threat detection layered on top. If you’re running any Azure infrastructure alongside on-prem, enabling Defender for Cloud’s free foundational CSPM tier costs nothing and gives you baseline visibility even before you decide whether to pay for the workload-specific plans.

Security Baselines: Intune and Group Policy

Security baselines are pre-built groups of Windows configuration settings that reflect Microsoft’s recommended, tested defensive posture — covering things like credential protection, device lockdown, and network security settings. They’re available two ways: as Group Policy Objects via the Security Compliance Toolkit (for on-prem/hybrid environments) or as Intune security baseline profiles (for cloud-managed devices).

Baseline coverage in 2026 includes profiles for Windows 10/11, Windows Server 2025, Defender for Endpoint itself, Microsoft 365 Apps for Enterprise, Microsoft Edge, and Windows 365. Microsoft revises these periodically — the Windows Server 2025 baseline saw a February 2026 revision (v2602), and in June 2026 Microsoft pushed an out-of-cycle baseline update specifically to address CVE-2026-45585 ahead of its normal disclosure timeline, which is a useful reminder that baselines aren’t “set once and forget” — they need the same patch-cadence attention as any other security control.

Don’t deploy a baseline blind. Apply it to a pilot group first, run it for at least one full patch cycle, and check for application compatibility issues before rolling out tenant-wide — baselines are deliberately strict and will occasionally break something in a way that’s easier to catch on 20 devices than 2,000.

Windows Baseline Security Mode

Windows Baseline Security Mode is a newer platform-level protection rolling out through 2026 that enforces code integrity more strictly — only properly signed applications, drivers, and services are allowed to run, which is designed to close off a class of tampering and unauthorised-modification attacks at the OS level rather than relying purely on endpoint detection to catch them after the fact. Treat it as a complement to Defender and baselines, not a replacement for either.

Conditional Access as a Security Control

Conditional Access ties identity, device compliance, and endpoint signals together — it’s the layer that decides whether a sign-in attempt is even allowed to proceed based on all the above. If you haven’t yet, see our guides on Intune compliance policies and Conditional Access and the wider Entra ID picture, including the 2026 credential-registration enforcement changes.

Getting Started Checklist

• Confirm your Defender for Endpoint onboarding covers all device types (Windows, macOS, Linux, mobile) — coverage gaps are the most common real-world security hole
• Review your automatic attack disruption and Selective Response Actions settings, especially for Tier-0 systems
• Deploy the current Intune or GPO security baseline to a pilot group and monitor for a full patch cycle before wider rollout
• If running Azure workloads, enable Defender for Cloud’s free CSPM tier as a minimum
• Layer Conditional Access on top so device and identity signals actually gate access, not just report on it