How secure is your Microsoft 365 environment - and what should you fix first? Our new Identity Posture Assessment gives you a clear picture of where you stand and a prioritized path to stronger defenses.

This on-demand report evaluates your tenant against the Huntress Identity Security Framework, highlighting security gaps, misconfigurations, and opportunities to improve. It only scores controls you’re licensed for, so you’re never penalized for features you don’t own.

What’s inside:

Available on demand in the Huntress portal and via API. From the ISPM dashboard, select an organization in the Quick Assessment card and click Generate to download your PDF. You can also retrieve the report through the Huntress API to incorporate assessments into your existing workflows.

Whether you’re helping clients harden their tenants or securing your own organization, start with a clear baseline and generate fresh assessments to show your progress.

Learn more about the Posture Assessment in our new blog.

Your Microsoft 365 tenant has a history.

Now generally available, Lookback automatically runs Huntress Unwanted Access detections across up to 180 days of available Microsoft 365 login history when an eligible tenant onboards to Managed ITDR. It helps you uncover earlier compromises, understand what you’ve inherited, and address active threats without waiting for an attacker’s next move.

What this means for you:

There’s nothing extra to configure. Lookback is not available for GCC, GCC High, or CPV tenants.

Whether you’re onboarding a new client or bringing your own organization onto Managed ITDR, Lookback gives you historical context and SOC-backed action from day one.

Read more in our new blog and check out our KB article.

Partners can now list their SIEM log sources through the API, using the same data shown on the Source Management page: name, type, organization, agent, status, last activity, and 30-day data volume. This makes it easy to check coverage and catch a source that's gone silent, right from your own tools, without needing to open the portal. See the API docs to learn more.

As we continue to build out depth of controls to harden Microsoft 365 environments, we have added the following protections against Unwanted Access and Shadow Workflows:

These recommended controls may now be scheduled for deployment. Due to potential impact on end users, they will not be rolled out automatically as part of Managed Deployments.

You can now choose exactly which security controls roll out to your environment and when.

gives you full control over your rollout. Build your own set of controls from the complete Huntress policy library, pick low, medium, or high impact items, and set the days you want them deployed. When Huntress adds new controls to the library, you'll get notified, but nothing rolls out until you approve it.

This is an org-level setting, ideal for organizations under strict compliance or change control requirements.

remain the recommended default, where Huntress selects low-impact controls, schedules them for deployment, and deploys new low-impact controls automatically as they become available. You can preview or skip, but your identity security posture keeps improving without effort from you.

Learn more:

We've given Unsecured Credentials a complete overhaul, with a new dashboard, full visibility into what's being flagged, and the ability to allowlist files you don't want reported on.

What's new

As we continue to build out depth of controls to harden Microsoft 365 environments, we have added the following protections against Shadow Workflows:

These recommended controls may now be scheduled for deployment. Due to potential impact on end users, they won't be rolled out automatically as part of Managed Deployments.

The agent overview page now shows the last user to log into a macOS endpoint, so you can attribute a host to an individual user during triage and asset review. Previously, this field was only available on Windows.

The value reflects the most recent interactive (console/GUI) login, collected during the agent's routine survey. System-owned login windows and shutdown records are excluded, so you see the last real user rather than a service account. The field populates as endpoints check in on Agent v0.14.196 or later.

Remote graphical access over Screen Sharing used to be invisible to the agent. Huntress now reports each session as it starts, with the source address, session user, and authentication type. You can suppress any of those fields per host. This functionality requires Agent v0.14.196.

That visibility powers a new detection that fires when a session attaches to a root user session via a legacy authentication handshake that current clients no longer use. It's the signature of a pre-auth flaw in Apple's Screen Sharing service, disclosed in July 2026, that allows an unauthenticated remote party to read arbitrary files on an unpatched host. Cloud and VPS Macs lag behind Apple updates, so they carry the most risk.

The existing file-transfer detection stays in place for older agents and macOS below 13.0.

You can now turn Network File Scanning and Archive File Scanning on or off for Microsoft Defender in Managed Antivirus. These were previously fixed to Huntress defaults. Defaults are unchanged, so nothing changes on your endpoints unless you change it.

Find both in EDR → Managed Antivirus → Defender Configuration → Scans, alongside your other scan settings.