Summary
- Microsoft Defender XDR is adding detection source selection to alert tuning rules for more granular scoping.
- Alert tuning rules can now be limited to specific detection sources instead of applying broadly across a service source.
- Existing rules that are not updated will continue to apply to all detection sources under their selected service sources, including custom detections.
- Organizations using alert tuning rules should review current rules and decide whether to narrow detection source coverage.
- No compliance issues were identified for this change.
Primary Service: Defender XDR
Admin Impact: Medium
User Impact: Low
Release Start: 15 Nov 2026
Release End: 01 Dec 2026
Services: Defender XDR
Category: Stay informed
Tags: Admin Action, Feature Update, New Feature
History
9/28/2026 Item Added to Message Center
Microsoft Message
We are introducing detection source selection for alert tuning rules in Microsoft Defender XDR. This update enables alert tuning rules to be scoped to specific detection sources, providing more granular control over how alert tuning rules are applied.
As part of this update, alert tuning rules will apply to the detection sources selected for each rule. Existing rules that are not updated will apply to all detection sources under their selected service sources, including custom detections.
Rollout schedule
Public Preview (Worldwide): Rollout begins in mid-October 2026 and is expected to complete in early November 2026.
Note: Detection source selection will become available in mid-October 2026, and configured detection source selections will take effect in early November 2026.
General Availability (Worldwide): Rollout begins in mid-November 2026 and is expected to complete in early December 2026.
Note: Detection source selection will become available in mid-November 2026, and configured detection source selections will take effect in early December 2026.
Impact on your organization
Who is affected
Organizations that use alert tuning rules in Microsoft Defender XDR.
Platforms and services
Microsoft Defender XDR
What will happen
- Alert tuning rules will be configurable to apply to specific detection sources and apply only to the detection sources selected for each rule.
- If not updated, existing alert tuning rules will apply to all detection sources under their selected service sources, including custom detections.
Detection source selection
Action required and recommendations
No action is required if existing rules should apply to all detection sources under their selected service sources, including custom detections. Otherwise, we recommend that you review existing alert tuning rules and update the detection source selections as needed.
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.