July Security Partner Roundup: Updates and Incentives

**Microsoft Security Operational Update** Defender for Endpoint: Selective Response Actions are now Generally Available Microsoft announced Selective Response Actions for Microsoft Defender for Endpoint as Generally Available in the July 2026 Defender Monthly News, published on 1 July 2026. At first glance, this looks like another Defender feature. I think it’s actually a governance improvement. One conversation I regularly have during Defender for Endpoint deployments is around Tier-0 systems. Everyone agrees Domain Controllers, AD FS servers and PKI servers should be onboarded. The debate is usually around response actions. Should every analyst be able to isolate a Domain Controller? Should every automated response be available on every critical server? Until now, it was often an all-or-nothing decision. Selective Response Actions changes that. You can onboard your most critical systems while controlling which high-impact response actions are available. You keep the visibility while adding tighter operational control over sensitive infrastructure. Licensing Available with Microsoft Defender for Endpoint Plan 2 (P2), including: • Microsoft Defender for Endpoint Plan 2 • Microsoft 365 E5 • Microsoft 365 E5 Security Defender for Business continues to provide endpoint response capabilities, but Microsoft hasn’t announced Selective Response Actions as a Defender for Business feature. What I’d Review If I was reviewing an environment today, I’d ask: • Have we identified all Tier-0 assets? • Are we excluding critical systems because of response action concerns? • Should every response action be available on every server? • Do our incident response runbooks reflect those decisions? This isn’t about adding more security. It’s about applying the right operational control to the systems that matter most. Sometimes the best security improvement isn’t another detection. It’s better governance. Microsoft References • Microsoft Defender Monthly News – July 2026: https://lnkd.in/eBfDVcCk • Microsoft Learn – Restrict response actions on high-value assets: https://lnkd.in/ej6QMwRp #MicrosoftSecurity #MicrosoftDefender #DefenderForEndpoint #DefenderForBusiness #DefenderXDR #Microsoft365 #SecurityOperations #CyberSecurity #BlueTeam #SOC #IncidentResponse #ZeroTrust

This Microsoft Sentinel deep dive is a practical look at how SOC teams can combine network-derived telemetry with identity, endpoint, and cloud signals to investigate faster and with better context. What stood out to me is the focus on AI-driven workflows without losing operational clarity—exactly the balance security teams need as threats scale. https://lnkd.in/eQUhBfcq #MicrosoftSentinel #ThreatProtection #Cybersecurity #AIAdoption

Many organisations pay for premium Microsoft licenses but fail to leverage the powerful security tools included within them. If you hold a Microsoft 365 E5 license, you already have access to industry-leading solutions like Microsoft Defender XDR and Microsoft Sentinel. The capability is sitting right there in your environment. It just needs to be operationalised. At DataSense Analytics (Pty) LTD, we help businesses activate their existing Microsoft investments. We configure and integrate these tools so they actively protect your operational data, allowing you to consolidate legacy systems and reduce your overall security costs. You already have the foundation. Let us help you put it to work. Reach out to our team to explore how we can maximise your setup: https://lnkd.in/gGyv96HK #Microsoft365 #MicrosoftSecurity #DefenderXDR #MicrosoftSentinel #DataSenseAnalytics #DigitalCertainty

🚀 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐄𝐧𝐭𝐫𝐚 𝐁𝐚𝐜𝐤𝐮𝐩 𝐚𝐧𝐝 𝐑𝐞𝐜𝐨𝐯𝐞𝐫𝐲 𝐢𝐬 𝐧𝐨𝐰 𝐆𝐞𝐧𝐞𝐫𝐚𝐥𝐥𝐲 𝐀𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞! A valuable addition for organizations focused on 𝐢𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐫𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 and 𝐭𝐞𝐧𝐚𝐧𝐭 𝐫𝐞𝐜𝐨𝐯𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐲. Key highlights: ✅ Automatic daily backups of critical Microsoft Entra identity objects ✅ Recovery retention increased from 5 to 7 days ✅ Restore users, groups, applications, managed identities, and Conditional Access policies ✅ Difference reports to quickly identify and recover from unwanted changes The biggest takeaway: Backup alone isn't enough. A strong recovery strategy combines governance, least-privilege access, monitoring, and well-tested recovery processes. Looking forward to exploring this capability with customers and incorporating it into Azure security and identity best practices. https://lnkd.in/dnHGV2US #MicrosoftMVP #MVPBuzz #Microsoft #MicrosoftEntra #EntraID #IdentitySecurity #IdentityManagement #CyberSecurity #CloudSecurity #Azure #MicrosoftAzure #AzureSecurity #ZeroTrust #ConditionalAccess #PrivilegedIdentityManagement #PIM #BusinessContinuity #DisasterRecovery #TenantRecoverability #IdentityResilience #MicrosoftSecurity #MicrosoftLearn #AzureAdministrator #CloudComputing #TechCommunity #MCT #CommunityLearning #KnowledgeSharing

Honored to be featured in Microsoft's Behind the Build series, spotlighting how Gigamon and Microsoft Sentinel are teaming up to bring deep, network-derived intelligence into the SOC. The result? Enriched investigations, faster response, and agentic AI workflows that connect the dots across network, identity, endpoint, and cloud — all in one place. "The platform approach will win, especially in an AI-driven world. It's about ecosystems coming together." https://lnkd.in/gz5s7Ze9 #Gigamon #MicrosoftSentinel #DeepObservability #AgenticAI #CyberSecurity

The average organisation uses less than forty percent of the Microsoft 365 capabilities they pay for. That is not just waste — it is a competitive disadvantage. Here is how to close the gap.

🔐 Heads up for those using Microsoft Sentinel (especially in Gov) Just came across this update from Microsoft and thought it’s worth sharing for anyone running Sentinel. Microsoft is moving Sentinel from the Azure portal into the Defender portal — basically bringing SIEM + XDR into one place. From what I see, this is less about a simple portal change and more about how SOCs will operate going forward. Why this matters · You’ll start managing incidents, alerts, hunting etc. from the Defender portal instead of Sentinel portal · Better correlation across signals (especially if you’re already using MDE / M365 Defender) · A more unified SOC workflow, instead of jumping between tools For Local/State Gov Security teams: If you’re running Sentinel today, it’s worth starting to: · Look at onboarding your workspace into Defender · Review your analytics rules, connectors, playbooks · Get your analysts familiar with the Defender experience No cost change from what Microsoft mentions, but operationally there will be a shift in how teams work day-to-day. Good move overall — especially for teams already stretched. A single place for detection + response should help reduce noise and improve response times, but it’ll need some planning to transition smoothly. For more Info: https://lnkd.in/gQwHR2m2

Another Strong Metric of Success We are proud to report exceptionally high demo-to-close rates across our offerings and... ...Our Managed MDR/SIEM services, delivered in partnership with Panther (now part of Databricks) and LimaCharlie, continue to see outstanding conversion. Our services and these solutions also integrate seamlessly with most major EDR platforms. We are seeing equally strong demo performance for Soteria - Security Solutions & Advisory "Inspect for Microsoft 365", our proprietary assessment software. Available on the Microsoft Azure Marketplace and through our business development team, it delivers comprehensive AI and agent security visibility for State #CriticalInfrastructure organizations as well as clients across nearly every industry vertical. #MSP partners have also seen benefits for their clients. #microsoft365 #MDR #SIEM #innovation #privateequity

What's New in Microsoft Entra: July 2026. Welcome to the July edition of our monthly newsletter, summarizing the latest news and developments in the exciting, ever-evolving world of Microsoft Entra.   What went into General Availability (GA) since June 2026? Microsoft Entra Backup and Recovery - A capability that helps organizations restore a tenant after accidental or malicious changes. On by default, it automatically backs up critical directory objects, including users, groups, applications, Service Principals, managed identities, Conditional Access policies, named locations, agent IDs, and authentication and authorization policies, so admins can return to a known good state. The service takes daily backups of supported objects and retains them for 7 days with Microsoft Entra ID P1 or P2 licenses. Admins can view snapshots, compare changes, and run recovery jobs. This feature is a reliable safety net to minimize downtime and... #techcommunity #azure #microsoft https://lnkd.in/ec5UrAGY

Identity is the new security perimeter, and protecting it goes beyond MFA and Conditional Access. Microsoft has announced the general availability of Microsoft Entra Backup and Recovery, providing organizations with a native way to restore supported identity objects and configurations after accidental changes or administrative errors. As more organizations adopt Zero Trust, having built-in recovery capabilities for identity services is another important step toward improving operational resilience. Definitely a welcome addition to the Microsoft security ecosystem. Read more from Microsoft: https://lnkd.in/e83gZZ5Q #MicrosoftEntra #IdentitySecurity #IAM #ZeroTrust #CloudSecurity #Microsoft365 #CyberSecurity