What's New in the Docs ​

This page tracks new and substantially updated articles so you can catch up quickly after time away. Feature announcements live on the blog; this page is about the documentation itself. Every page also shows its own last-updated date at the bottom, taken from the docs' change history.

August 6, 2026 ​

Two new pages explain the protocol the whole product rests on, tool groups gained per-security-group scoping, and the agent tools learned to answer fleet-sized questions honestly.

One thing needs action in your tenant

Tool Groups (Admin) — every tool group is now scoped to Entra security groups, built-in groups included, and external groups start closed. Non-admins reach none of a registered MCP server's tools until you attach security groups to its external group or mark it Everyone. Built-in groups carried over the posture they had, so nothing you already had open closed itself — but the external side needs your attention before your users notice a capability going missing.

New pages.

  • Understanding MCP — what the Model Context Protocol actually is, in detail: the problem it solves, how hosts, clients, and servers relate, the three kinds of capability a server exposes, what a tool call looks like as a sequence of exchanges, and why transport choice brings authentication with it. Also covers the half that is easy to miss — InfraScout is an MCP client as well as a server, which makes the protocol its extension layer. Any system that speaks MCP joins an assessment without anyone writing an integration, and the MCP proxy brings systems that are not internet-facing into scope through an agent you have already deployed.
  • Tool Annotations & Role Scoping — the four annotations every tool carries (readOnlyHint, destructiveHint, idempotentHint, openWorldHint), and how the first of them becomes an enforced boundary rather than a hint. Documents the two enforcement points, why a refused call is deliberately indistinguishable from a tool that does not exist, the five-tool assessment carve-out, how role tier stacks with tool-group scoping and resource visibility, and how third-party annotations are trusted in the restrictive direction only.
  • Agent Capabilities — the reference for all thirteen capabilities an agent can advertise: which platforms carry each one, what has to be true on the host for it to appear, and which tools require it. Capabilities are probe-backed rather than assumed from the operating system, so the page also reads as a troubleshooting map — a missing wmi chip points at the WMI service, a missing journald chip at journal permissions, a missing daemon_start at a host that simply is not systemd-managed.

Substantially updated pages.

  • Tool Groups (Admin) — the Visibility section is rewritten around one scoping model for every group type. Built-in groups can now be scoped to security groups rather than only hidden tenant-wide, and the always-available set changed: Sessions, Insights, Persistent Memory, and Chart Display are exempt, while Remote Agents and Inventory — previously un-hideable — are now scopable. Scoping is enforced, not filtered: a closed group's tools are absent from the list a client receives and a call naming one is refused before it runs.
  • MCP Servers (Admin) — two sections rewritten. The tool allowlist now asks what to withhold rather than what to permit, so an unrestricted server paints as all-ticked; the page explains the three ways that inversion could have silently widened an allowlist and how each is handled. A new usage guide field carries admin-authored guidance that actually reaches the model — the Description field never did, and the page now says so plainly.
  • Agent Tools — agent_count and agent_list take a capability filter, matched exactly against what a host advertises (ldap, wmi, etw, journald, mcp_proxy, and the rest). agent_list carries a new warning about what a truncated page is allowed to prove: has_more: true means you have seen one page, not the fleet, and can never establish absence.
  • Chat — an amber steer-send button appears beside Stop while a response streams, so a staged steering message has a visible way to be sent. Reasoning blocks start collapsed and change only when you click one, instead of opening and closing themselves as reasoning starts and finishes.
  • Connecting Entra ID — the sync section now explains that setting a user or group filter takes the connection off the incremental path, because Graph's incremental endpoints cannot express a filter. A filtered connection re-reads everything in scope on every run, and the counts in its summary are objects touched rather than objects changed. Sync summaries now report the mode each run genuinely used, so a filtered connection that starts describing itself as a full read is behaving correctly.
  • Key Concepts — five concepts that shipped over the summer now have entries: Session Group, Tool Group, Task Agent, Agentic Workflow, and Persistent Memory. The Agent Capability entry was rewritten — it listed five of the thirteen capabilities and predated every probe-backed addition since June — and now leads with the probe model and links to the new reference page. The MCP Tool entry notes that every tool declares how it behaves and links to both new MCP pages, and the stale tool count was corrected to 207.

July 27, 2026 ​

The largest batch so far. MCP servers can now run inside your own network on one of your agents, enrolling an agent takes one command, delegated runs stopped receiving the entire tool catalog, and the tool reference grows to 207 tools.

Two things need action in your tenant

Connecting Entra ID — the onboarding script now grants 48 permissions, up from 41. Eight were added during July, and the tools behind them return an explicit missing-permission error until you re-run the idempotent script. The page now carries a table mapping each added permission to the tools it unlocks, plus what licensing each needs on top of consent.

MCP Servers — read-only chat roles previously saw all remote external MCP tools, because their read-only classification was being discarded during discovery. That classification now survives, and it is trusted in the restrictive direction only: a tool that declares nothing is treated as though it writes. If your standard users relied on a remote MCP server's tools, they lose access until the tools are classified — by the server, or by you with the new per-tool overrides.

Substantially updated pages.

  • MCP Servers (Admin) — rewritten around the new hosting model. An agent can now host an MCP server on your behalf, either as a child process it supervises or as an outbound connection to a server already on that network, so nothing needs publishing and no inbound rule is required (Linux hosts, operator-enabled on the machine with infrascout-agent mcp-proxy enable). Also documents OAuth as an authentication method with a consent popup, automatic refresh, and a warning before an Entra refresh grant expires; the tri-state read-only override per tool and the trust framing behind it; the grouped tool picker for servers exposing hundreds of tools; inline failure reasons and the state badge; why metadata edits no longer restart a running server; and the discoverable server-instructions tool.
  • Agent Tools — two Linux tools documented for the first time: agent_query_journald queries the systemd journal with pushed-down filters and a count-only mode, and agent_perf_read_metrics reads system vitals and top processes in the same output shape as the Windows counter tool. The Log Files section is now Log Files & Journals, and agent_read_log_file carries a new warning: a hard credential denylist now refuses the well-known credential locations outright, for every caller and every role. The Agents group stands at 24 tools.
  • Microsoft Cloud — Security Tools — eleven new tools in four new sections. Attack Simulation Training (three tools) reads phishing-simulation campaigns, per-user outcomes, and tenant-wide coverage including the users never included in any simulation. Defender for Identity — Sensor Posture (two tools) gives the sensor inventory and its health issues, which together answer the coverage question a per-sensor view cannot. Defender Vulnerability Management (four tools) covers organization-wide recommendations, the exposure and device secure scores, remediation-task follow-through, and the software inventory with a CVE pivot. Security Exposure Management — Attack Paths (two tools) walks the exposure graph backward from a critical asset, with the exact-depth behavior and the inverted criticality scale explained. The group stands at 52 tools. Two stale claims were also corrected: the onboarding script does now grant AuditLogsQuery.Read.All, and the anchor both that and the Cloud App Discovery page linked to no longer existed.
  • Microsoft Cloud — Intune Tools — four new tools: a per-user managed-device lookup (with the two limitations that matter — object ID or exact UPN, primary users only), the tenant-wide compliance rollup, per-setting fleet-wide failure counts, and the devices a given detected app is installed on. The group stands at 21 tools.
  • Chart Display — pie, heatmap, and treemap join the chart types, with a new color_scale argument and a section on choosing a type by the shape of the question. The severity and sequential ramps are documented as carrying meaning rather than taste.
  • Chat — each tool card now settles as its tool finishes rather than the whole batch flipping together; long tool calls run for as long as the AI asked instead of being cut at two minutes; charts and diagrams cover the new types; an answer can be copied as raw markdown with a numbered sources footer; the tab strip holds ten threads and titles appear without a reload. A new What a delegated run is given section documents brief-derived tool scoping, the structured brief contract, turn-against-budget reporting, and the no-memory rule. Read-only runs can now reach external MCP tools that are classified read-only.
  • Insights — the page now opens filtered to Open, Acknowledged, and In Progress; severity, category, and status filters are multi-select and the interactive cards toggle rather than replace; the status overview's counts deliberately ignore the status filter so it stays usable as a control; and a dashboard deep link now applies the filter it promised.
  • Executions (Audit) — a new Category filter separates agent commands, cloud queries, external MCP calls, agent-hosted MCP calls, native reads, and orchestration overhead, defaulting to the categories that represent real action. An MCP Tool chip marks a call to an agent-hosted MCP server.
  • Deploy on Windows, Linux, and macOS — each page leads with Enroll in One Command: enroll auto signs in to Entra ID with a device code and then provisions, enrolls, and installs the service, with the API address as its only argument. The token path is retained as Enroll With a Token for unattended builds and hosts without a practical browser path. All three carry a warning about enrolling from a user-writable directory. Linux additionally documents the MIPS build for OpenWrt-class hardware, service-manager detection across procd, OpenRC, and SysV, and the new journald and perfmetrics capabilities.
  • Agents Overview — the Enrollment section now describes both paths and when each is the right one.
  • Agents — a new Adding a host section covers the download dialog's paired download-and-enroll commands, and the capability chips note that they are probe-backed, including the MCP Proxy chip for hosts running MCP servers.
  • Security Architecture — new material on how credentials are handled (masked hints, nothing written to an agent's disk, re-provisioning on reconnect rather than local restore), per-tenant content encryption at rest, and a new section on the two boundaries that tightened this month: the log reader's credential denylist and the fail-closed classification of third-party MCP tools.
  • Inventory Tools — service collection is no longer systemd-specific, and what each service manager can honestly report differs rather than being padded.
  • Tool Reference Overview — the total stands at 207 tools across fifteen groups.

July 15, 2026 ​

A security-focused batch. A new reference page pulls the whole trust model together, access to tools is now scoped by role, read-only PowerShell gains a real enforcement path, and the tool reference grows to 190 tools.

New pages.

  • Security Architecture — a single reference for how InfraScout secures your infrastructure: agents that dial out over mutually authenticated TLS with signed binaries and a one-time enrollment token, Microsoft Entra ID sign-in for people, role-scoped tool access, closed-by-default visibility, a complete audit trail behind every finding, and where your data lives. Includes a trust-flow diagram.

Substantially updated pages.

  • Agent Tools — a new agent_exec_powershell_readonly tool runs investigative PowerShell that is validated against an admin-managed command policy before it reaches the host; anything that looks like it changes host state is blocked and recorded, never dispatched. The Agents group stands at 22 tools.
  • Tool Groups (Admin) — two additions: group cards are now clickable and open a read-only view of every tool in the group with its name, description, and read-only/writes classification (built-in, custom, and external); and a new Role-scoped tool access section explains that standard users are confined to read-only tools while operators and administrators keep the full set, enforced across portal chat, delegated runs, and raw MCP clients alike.
  • Chat — a conversation can now pop out into a floating, draggable panel that keeps streaming as you move around the portal; a new empty thread offers curated starter prompts that prefill the composer without sending; and the same conversation open on a second device keeps up in real time, showing a slow tool call the moment it starts.
  • Key Concepts — the Execution concept now notes that assessment PowerShell can run in a validated read-only mode governed by an admin command policy.
  • Onboarding Your Tenant — the script you run in your own tenant to create the InfraScout Entra app is now Authenticode-signed with a publicly-trusted, Microsoft-issued certificate, so it runs cleanly under PowerShell execution policies and its publisher can be verified.
  • Tool Reference Overview — the total stands at 190 tools across fifteen groups.

July 12, 2026 ​

A large batch. Resource visibility reversed its default and needed corrections across nine pages, the AI now plans and delegates its own work, Azure AI Foundry joins the provider list, and the tool reference grows to 189 tools.

Read this one first

Groups (Admin) — resource visibility is now closed by default. A resource with no visibility groups assigned is visible to admins only, where it was previously visible to every authenticated user in the tenant. Non-admins see nothing until an admin opens things up, so the page now carries a checklist of what each tenant admin should do after this release. The page also documents the new Everyone option, the per-agent block inheritance switch for sensitive hosts, and the three-state visibility shield.

Substantially updated pages.

  • Chat — two new sections. The AI now maintains a live task plan for multi-step work and can delegate a self-contained task to a Task Agent: an isolated run that reports back a distilled result, is read-only by default, and shows its spend broken out from the conversation's own. And the AI can now ask you a question mid-turn with a card you answer by clicking, after which the same turn carries on.
  • AI Providers — Azure AI Foundry joins Anthropic and OpenAI, appearing as two provider choices (Claude and OpenAI surfaces) and taking an endpoint URL alongside its key. A new capability table shows which providers support web research, data region, and batch processing — the differences matter, and the page now says how.
  • Memory — the rollup connection must be a batch-capable (Anthropic) connection, now rejected at save time rather than failing quietly. A rollup always runs on the tenant's designated rollup connection, whichever connection a conversation was chatted on. The old description of rollup as a per-turn setting was wrong and has been corrected.
  • Agent Tools — a new Log Files section documents agent_read_log_file, a cross-platform log reader for Windows, Linux, and macOS: tail or head, regex filters, dedupe, and time windows, so a large log answers a question without a raw dump. Includes how zone-less timestamps are read in the host's local time, and a warning that older agents reject the command until they update. The Agents group stands at 21 tools.
  • Tool Reference Overview — the total stands at 189 tools across fifteen groups.
  • Microsoft Cloud — Security Tools — realistic Unified Audit Log search durations (5 to 30 minutes when scoped, hours when wide or unfiltered) replace the old optimistic estimate, and object ID filters must be passed as a list, since a file path such as Q3 Report, Final.docx legitimately contains a comma.
  • Microsoft Cloud — Identity Tools — mscloud_identity_list_users now steers you to pass a select when enumerating, since a default page returns every property on every user.
  • Inventory Tools — the two distribution tools no longer advertise limit and skip, which they never honored; top_n is what bounds the software distribution.
  • Playbooks (Admin) — editing a shared module now rebuilds every playbook that includes it. Deleting a module still leaves dependents stale, so remove the include first.
  • Agentic Workflows — direct (sync) workflow runs now have a twenty-minute execution ceiling, up from about eight.
  • Executions and Executions (Audit) — the new Log File command type appears in the type filter and the table; the audit page now documents the actor column that separates user, workflow, and system-initiated runs.
  • Browser Sessions (Audit) — sessions from the native InfraScout iOS app are identified as iOS App on iOS, and mobile browser and OS detection is now accurate.
  • Dashboard — recent sessions are ordered by last activity, so an active long-running session stays at the top.
  • Visibility corrections across the portal — Key Concepts, Portal Overview, Agent Groups, Users, Groups (Admin), Agent Groups (Admin), Tool Groups, Playbooks (Admin), and Service Accounts all described the old open-by-default model and have been corrected.

July 7, 2026 ​

New Windows diagnostics tooling lands, and the tool reference grows to 188 tools across fifteen groups.

New pages.

  • Data Collection Sets — curated, ready-to-run Windows ETW capture profiles: nine live profiles for problems you can reproduce on demand (incident response, AD reconnaissance, authentication, SMB, TLS, 802.1X, Intune/MDM, device registration, and certificate enrollment) and five boot profiles that record across a reboot for the logon-time failures a live trace can't reach. Four tools — collection_start, collection_arm_boot, collection_harvest_boot, and collection_disarm_boot.
  • Chart Display — the chart_display presentation tool renders an interactive line, area, bar, or donut chart inline in the chat from data the AI has already gathered. One tool.

Substantially updated pages.

  • Agent Tools — a new Performance & Tracing section documents six Windows-only tools: performance-counter discovery and reads (agent_perf_list_counters, agent_perf_read_counters) as a snapshot or a short series, and persistent ETW traces you start, read, stop, and list (agent_trace_start, agent_trace_read, agent_trace_stop, agent_trace_list). The Agents group stands at 20 tools.
  • Tool Reference Overview — the total stands at 188 tools across fifteen groups, with Data Collection Sets and Chart Display joining the InfraScout-native set.
  • Chat — the in-conversation view now renders charts and diagrams inline, with click-to-zoom for diagrams.
  • Memory — the Files view renders nested paths as a browsable folder tree, and the store now holds the AI's dated change logs (a per-host log and an environment-wide one).
  • Chat Audit — a new Model column shows which model or models answered each conversation, and the Cost column now reflects Agentic Workflow runs, not just interactive chats.

July 2, 2026 ​

The AI provider docs now cover two providers, and the tool reference grows to 177 tools.

Substantially updated pages.

  • AI Providers — connections now choose their provider: Anthropic or OpenAI, selected per connection with a provider-scoped model list (the GPT-5 and GPT-5.4 families join the Claude models) and a per-connection encrypted API key. Claude Sonnet 5 is selectable, a new Anthropic-only Data region setting pins inference to the United States or Global, and the page documents where OpenAI differs — web research honors the allowed-domains list only, and Agentic Workflows on OpenAI connections always run in direct (sync) mode.
  • Microsoft Cloud — Security Tools — a new Defender for Office 365 — Analyzed Emails section documents mscloud_security_list_analyzed_emails and mscloud_security_get_analyzed_email (Threat Explorer data for false-positive triage and phishing hunts), and the Unified Audit Log status check now waits server-side instead of asking callers to poll. The Security group stands at 41 tools.
  • Microsoft Cloud — Identity Tools — two new enterprise-application tools, mscloud_identity_list_sp_app_role_assigned_to (who is assigned to an app) and mscloud_identity_list_sp_oauth2_permission_grants (delegated consent grants), bring the Identity group to 24 tools; the $search guidance now shows the bare property:value form.
  • Agent Tools — agent_query_event_log documents the new raw XPath passthrough and count-only mode, both requiring an up-to-date agent.
  • Tool Reference Overview — the total stands at 177 tools, and a new note explains that every tool now rejects unknown argument names with an explicit error instead of silently ignoring them.
  • Connecting Entra ID — the provisioning script now grants 41 permissions; SecurityAnalyzedMessage.Read.All was added for the analyzed-email tools, with a note for tenants provisioned earlier to re-run the idempotent script.
  • Executions, Executions (Audit), and Chat Audit — the executions tables now name the exact tool behind every call in a Tool / Command column, and the Chat Audit gains a per-conversation lifetime Cost column.
  • Chat — safety refusals now appear as a persistent warning card in the thread, with any partial answer preserved above it.

June 15, 2026 ​

New coverage for agentic workflows and per-device Intune security.

New pages.

  • Agentic Workflows — run headless, unattended AI assessments under a dedicated, non-admin service account, triggered by hand, by webhook, or on a schedule, with run history, live phase visibility, and cancellation.
  • Microsoft Cloud — Intune — a dedicated reference page for the 17 Intune tools, now grouped under the mscloud_intune_* prefix (split out of the Services group). It covers eight read-only per-device security tools (configuration and compliance state, the exact non-compliant settings, Defender antivirus health, and detected malware), the config-content tools (Settings Catalog, Administrative Templates, and security baselines) with $expand and beta derived-type reads on device configurations, and three single-resource by-id getters (mscloud_intune_get_configuration_policy, mscloud_intune_get_group_policy_configuration, mscloud_intune_get_device_management_intent) that read one policy/template/baseline — with its settings — in a single Graph call instead of the full scan a filtered list triggers. Per-device configuration/compliance state now inlines each problem row's failing settingStates; per-device drill-down covers legacy profiles and compliance but not Settings Catalog; and the intents tool tolerates select+expand (an upstream 500).

Substantially updated pages.

  • Microsoft Cloud — Services — the Intune tools split out into the new Microsoft Cloud — Intune page above and were renamed to the mscloud_intune_* prefix; the Services group now lists 22 tools. The total across all groups stands at 173.
  • Connecting Entra ID — the provisioning script now grants 40 permissions; the Audit Log Query and Cloud App Discovery permissions are attached automatically, so there is no longer a manual step for them.
  • Throttling resilience (all Microsoft Cloud tools). Single-resource reads now retry transparently on a Microsoft Graph 429/503, honoring Retry-After (with jittered exponential backoff otherwise) within a budget kept under the request timeout. A read that only succeeds after retrying carries a small throttle_note; one that stays throttled returns a structured { throttled: true, attempts, retry_after_seconds } note so the client can retry on its own schedule instead of seeing a raw 429.

June 11, 2026 ​

The tool reference now covers all 162 MCP tools, catching up on a month of platform releases.

New pages.

Substantially updated pages.

  • Microsoft Cloud — Security — added Defender XDR incidents, server-side sign-in aggregation for password-spray hunting, the Microsoft 365 Unified Audit Log tools with three investigation shortcuts, and four new typed Defender Advanced Hunting tools (file, network, registry, and module-load events). Advanced Hunting now runs through Microsoft Graph.
  • Microsoft Cloud — Services — added the SharePoint and OneDrive sharing-link inventory, the tenant sharing policy, and Exchange Online message trace.
  • Agent Tools — agent_get_host_summary now includes the inventory snapshot, agent_exec_daemon_start covers long-lived daemons on Linux, and agent_query_event_log documents the structured event-data filters.
  • Session Tools — added session groups, the containers that tie a conversation to the sessions it starts.
  • Connecting Entra ID — documented that the provisioning script grants 38 permissions, with two newer tool sets requiring manually added permissions at the time (folded into the script on June 15).

May 8, 2026 ​

  • Onboarding Your Tenant — new end-to-end guide for connecting an Entra tenant.
  • Terminology pass across the docs: "Claude" is now "AI client" wherever any MCP client applies.

May 4, 2026 ​

  • Tool Reference — the complete per-tool reference section launched, with a page per functional area.
  • Screenshots across the docs gained click-to-enlarge lightbox behavior.