Message CenterMajor changeRetirement

MC1187397 — Microsoft Defender for Endpoint: Threat actor attribution information will be removed from alert page

MC1187397Microsoft Defender XDRplanForChangeUpdated: 17 November 2025

Threat actor attribution will be removed from Microsoft Defender for Endpoint alert pages on January 12, 2026, and moved to the Incident page and Threat Intelligence section. This change improves alert clarity without affecting detection or security. No admin action is needed, but update workflows accordingly.

Applies to: Microsoft Defender XDR
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).