Microsoft Defender XDR: Email summary powered by Security Copilot on the email entity page

Microsoft Defender XDR will add an AI-powered Email summary via Security Copilot on the Email entity page, launching in public preview mid-April 2026 and generally available by mid-May 2026. It provides concise threat insights, timeline analysis, URL and attachment assessments, requiring Security Copilot access and SCUs. We’re introducing Email summary powered by Security Copilot on the Email Entity page in Microsoft Defender XDR. This AI-driven capability helps security teams quickly understand and respond to email threats by summarizing email detection data into clear, actionable insights. This feature is designed to reduce investigation time and improve analyst efficiency by presenting key signals and analysis in one place. When this will happen Public preview: Rollout begins in mid-April 2026 and is expected to complete by late April 2026. General availability (Worldwide): Rollout begins in early May 2026 and is expected to complete by mid-May 2026. How this affects your organization Who is affected Security teams and admins using Microsoft Defender XDR Microsoft 365 tenants with Security Copilot access and provisioned Security Compute Units (SCUs) What will happen A new Email summary section will appear on the Email entity page in Microsoft Defender XDR:  View image in new tab Security Copilot will generate AI-driven summaries that include: Email overview: A concise summary of detected threats, actions taken, overrides, and key indicators:  View image in new tab Timeline event analysis: A chronological view of actions and outcomes across the email lifecycle:  View image in new tab URL analysis: Assessment of URLs extracted from the email to identify known malicious behavior. Attachment analysis: Insights into attachments, highlighting suspicious or harmful files and associated risks. This feature requires Security Copilot access and SCUs and is not enabled by default. Existing security policies, permissions, and investigation workflows are respected; no policy changes are required. What you can do to prepare Ensure Security Copilot Security Compute Units (SCUs) are provisioned in your tenant. Verify that intended users have access to Security Copilot. Review and update internal investigation workflows or documentation, if applicable. Inform security analysts about the new Email summary experience so they can incorporate it into daily […]

The post Microsoft Defender XDR: Email summary powered by Security Copilot on the email entity page appeared first on M365 Admin.