Skip to content

BI for Defender — Recent Releases

Subscribe via RSS

Subscribe to the RSS feed to get notifications of new releases.

The 6 most recent releases are listed below. For older versions, see the release archive.

Version 15.0 February 26, 2026 — February 26, 2026

Release Date: February 26, 2026 App Source Version: 1015

BI for Defender v15 expands visibility into software artifacts and improves Secure Score navigation.

This release introduces new objects for software file paths and registry paths, enhancing investigative reporting capabilities.

It also improves performance by optimizing vulnerability-related measures and adding direct links to remediation controls and recommendations.

Version 15.0 Release Details

Product Enhancements

  • Updated the Secure Score page to include direct links to control details from the Control Name field.
  • Updated the Missing Security Updates page to include a direct link to the Recommendation Name for easier remediation access.
  • Optimized performance of vulnerability-related measures within the Device object.

New Features

  • Added new object Software Devices File Path to provide visibility into associated file paths.
  • Added new object Software Devices Registry Path to provide visibility into associated registry paths.

Semantic Model Changes

  • Added new fields to the Software Devices File Path object: File Path, File Path Count.
  • Added new fields to the Software Devices Registry Path object: Registry Path, Registry Path Count.
  • Added Control Link field to the Secure Score Control object.
  • Added Recommendation Link field to the Vulnerability Recommendation object.
  • Removed measures Missing Security Updates Average, Vulnerabilities Detected Average, and Vulnerabilities Exploitable Average from the Device object due to performance considerations.
  • Optimized measures Missing Security Updates Count, Vulnerabilities Detected Count, and Vulnerabilities Exploitable Count within the Device object for improved sync performance.

Important Notes

Version 14.0 Jan. 23, 2026 — January 23, 2026

Release Date: January 23, 2026 App Source Version: 1014

BI for Defender v14 expands device tagging capabilities and enhances vulnerability reporting.

This release introduces support for System device tags and updates tagging behavior for inactive devices. It also refines vulnerability reporting by consolidating fields into the Device object for improved clarity and consistency.

These changes improve reporting accuracy and visibility into device security posture.

Important Notes: As always—before upgrading, back up your custom reports to prevent data loss.

Version 14.0 Release Details

Product Enhancements

  • Added support for System device tags within the Device Tag
  • Updated tagging behavior so that manual tags on inactive devices may appear as System

Semantic Model Changes

  • Removed the Vulnerabilities field from the Software Vulnerabilities This field has been replaced by Vulnerabilities Detected in the Device object.
  • Added new fields to the Device object: Missing Security Updates, Missing Security Updates Average, Missing Security Updates Count, Vulnerabilities Detected, Vulnerabilities Detected Average, Vulnerabilities Detected Count, Vulnerabilities Exploitable, Vulnerabilities Exploitable Average, Vulnerabilities Exploitable Count.

Important Notes

Version 13.0 Nov. 24, 2025 — November 24, 2025

Release Date: November 25, 2025 App Source Version: 1013

Version 13 is a small maintenance release to fix some minor bugs that affected a limited number of customers.

Important Notes: As always—before upgrading, back up your custom reports to prevent data loss.

Version 13.0 Release Details

Product Enhancements

  • N/A

New Features

  • N/A

Bug Fixes

  • On the "Missing Security Updates" page some missing vulnerabilities have no linked devices. This has been resolved in version 13.

Semantic Model Changes

  • N/A

Important Notes

Version 12.0 Oct. 12, 2025 — October 12, 2025

Release Date: October 12, 2025 App Source Version: 1012

BI for Defender v12 improves Cloud App reporting reliability and introduces enhanced filtering capabilities.

This release adds new tag-based parameters to control which Cloud Apps are loaded during sync, reducing timeout issues in large environments.

It also enhances the Cloud App object with additional activity metrics and renames key download and upload fields for clarity. Please review breaking changes if you reference Cloud App data in custom reports.

Version 12.0 Release Details

Product Enhancements

  • Improved Cloud App sync reliability by introducing tag-based filtering to control which Cloud Apps are loaded during sync.
  • Added new fields to the Cloud App page: Cloud App Device Count, Cloud App IP Address Count, and Cloud App Transaction Count to improve visibility into Cloud App activity metrics.

New Features

  • Added new parameter AzureAD Cloud App Tags Only to the semantic model (Default: True). When enabled, only Cloud Apps with matching tags defined in AzureAD Cloud App Tags will be loaded during sync.
  • Added new parameter AzureAD Cloud App Tags to the semantic model. This parameter allows administrators to specify a comma-separated list of Cloud App tags to include during sync.

Bug Fixes

  • Resolved an issue causing Cloud App sync timeouts in certain environments.
  • Resolved an issue where Device Type was blank on the Cloud App page in v11.

Semantic Model Changes

  • Added new fields to the Cloud App object: Cloud App Device Count, Cloud App IP Address Count, Cloud App Transaction Count.
  • Renamed Download (MB) to Cloud App Download (MB) on the Cloud App See the Important Notes section.
  • Renamed Upload (MB) to Cloud App Upload (MB) on the Cloud App See the Important Notes section.

Important Notes

  • Renamed Download (MB) to Cloud App Download (MB) on the Cloud App This is a breaking change. Custom reports referencing the previous field name must be updated.
  • Renamed Upload (MB) to Cloud App Upload (MB) on the Cloud App This is a breaking change. Custom reports referencing the previous field name must be updated.
  • Always backup your custom reports before upgrading!

Version 11.0 Oct. 3, 2025 — October 03, 2025

Release Date: October 3, 2025 App Source Version: 1011

Version 11 is a very big update. We've added several new report pages and many new data fields.

Important Notes: [Action Required!] This version requires and additional permission to be added to the app registration in Entra ID. Without this new permission the sync will fail! Please add CloudApp-Discovery.Read.Allto your app registration. And as always—before upgrading, back up your custom reports to prevent data loss.

Version 11.0 Release Details

Product enhancements

  • Changed how we determine the number of clients for licensing purposes. We now only count “Active”, “Onboarded” devices that are not “Excluded” in Microsoft Defender.

New features

  • Added new “User Info” page.
  • Added new “Cloud App” page.
  • Added new “Antivirus” page.
  • Updated the “Incident & Alerts” page to include an “IP Address” visual.

Bug fixes

  • N/A

Semantic model changes

  • Added new parameter “AzureAD Alert Enable” (Default: TRUE).
  • Added new parameter “AzureAD Cloud App Day(s)” (Possible values: 7, 30, 90 days; -1 = Disabled).
  • Removed “IP Address” from the “Device Network” object.
  • Updated the “Last Logon User” object → Added Local Sign-In User as part of the “User” object.
  • Updated the “Alert Evidence” object → Added Local Sign-In User as part of the “User” object and added “IP Address” as part of the “IP Address” object.
  • Updated the “Device” object → Added “IP Address” as part of the “IP Address” object.
  • Updated the “Software Vulnerabilities” object. New fields include:“Missing Security Update ID”
  • “Missing Security Update URL”. Updated the “IP Address” object. New fields include:
  • “IP Address”
  • “IP Address Count”

Read full release notes...

Version 10.0 June 15, 2025 — June 15, 2025

Release Date: June 15, 2025 App Source Version: 1010

Version 10 is a small maintenace release to fix some minor bugs that affected a limited number of customers and to add minor new feature requested by a customer.

Important Notes: If you missed version 8.0, please review the critical change related to vulnerabilities and security update filtering.  And as always—before upgrading, back up your custom reports to prevent data loss.

Version 10.0 Release Details

Product Enhancements

  • N/A

New Features

  • N/A

Bug Fixes

  • Fixed a bug causing sync timeouts when the “AzureAD Export URL Enable” parameter is set to “False”.
  • On the “Device Info” page “Last Logon” without a "User SID" were causing timeout issue on the visual.

Semantic Model Changes

  • Added "User Manager" object. This aligns with the “User Manager” object in BI for Intune. Columns in the “User Manager” object include:"Manager Count"
  • "Manager User ID"
  • "Manager User Name"

Important Notes