How to read the Ignite Book of News like a security engineer

On the morning after the Ignite keynote the Book of News appears: one web page, usually well over a hundred announcements, every product team's best week of the year squeezed into bullet points. In 2025 the security chapter alone covered Sentinel, Defender, Entra, Purview, Security Copilot and the new Agent 365, and most of it was "preview", "coming", or "generally available for customers with…".

The lab team read it the way most people do: top to bottom, bookmarking everything that sounded exciting. Three weeks later nobody could say which items changed anything for our tenant. This post is the reading method we use now. It takes about ninety minutes, produces a one-page action list, and the CISO can read that page in five.

TL;DR

Problem: the Book of News is written for everyone at once. Read in order, it tells you what Microsoft shipped, not what your tenant must do.
Who it hurts: the CISO who gets a list of forty "interesting" items and no decision; the SOC lead who misses a retirement date buried in a preview note; the licensing owner who finds out in March that a feature was included in E5 since November.
Fix: read the security chapter once with three questions per item (what gets retired, which licence gets it, what must I do before which date), confirm each keeper against the product's "What's new" page on Learn, and write a one-page table with an owner and a date per row.
Cost: ninety minutes on 18 November. The value is deciding in November instead of discovering in March.
Prove it: a table with at most ten rows, each with a Learn link, a licence column and a date. Worked examples from 2025 below.

1. The problem
2. Who gets hurt
3. Cost and value
4. The reading method
5. Prove it: 2025 worked examples
Gotchas
Checklist
What changed recently
Sources

1. The problem

A Book of News entry looks like this: product name, one paragraph of benefit, one sentence of availability. The availability sentence is where the engineering lives, and it is written in a code: "in preview" means you can try it but not rely on it; "generally available" means supported; "included with E5" means you already pay for it; "retiring" or "will transition to" means a deadline, usually a year out, often without the exact date on the page.

Think of a restaurant menu that lists every dish the chef can make, with the price and the allergy note in small print at the end of each line. A hungry reader orders by the dish names. A careful reader starts with the small print.

The lab's 2025 reading, done the hungry way, produced forty bookmarks and zero actions. Reading the same chapter the careful way produced seven rows, three of which had dates in 2026 and 2027 that nobody in the team had heard of.

2. Who gets hurt

Who	What they lose
Organisation / CISO	A list instead of a decision; budget surprises when an "included" feature turns out to need an add-on, or an add-on turns out to be included
Users	Features that would have removed friction (passwordless, Copilot in the portals) arrive a quarter late
IT / SOC	Retirement dates found by accident; migrations done under pressure instead of in a planned week
Security products	Preview features enabled in production because the availability line was not read; GA features never enabled because nobody owned the row

3. Cost and value

Approach	Time on 18 November	Output	Typical result in the lab
Read everything, bookmark	2 to 3 hours	40 bookmarks	No action; rediscovered in March
Read headlines, watch the keynote	1 hour	A feeling	Decisions made on the keynote demo, not on the availability line
Three questions per item + Learn check	90 minutes	One-page table, 7 to 10 rows, owner and date each	Three dated migrations planned in November; two included features switched on in the same week

No licence or tooling is involved. The only cost is holding the line on the three questions and refusing to add a row without a Learn link.

4. The reading method

Step 1. Get the right page and the right chapter

Open the Book of News from news.microsoft.com (search "Ignite 2026 Book of News"). Use the web page, not a PDF someone forwards; the page is updated during the week.
Go straight to the Security chapter. Then scan the Microsoft 365, Azure and AI chapters only for the words Entra, Purview, Defender, Sentinel, Copilot, Agent 365, identity, compliance. Skip everything else on the first pass.

Step 2. Three questions per item

For every item in the chapter, answer three questions in one line each. If you cannot answer at least one, the item is not a row.

What gets retired or replaced? Look for "transition", "retire", "replaces", "will no longer", "portal". The 2025 chapter's quietest line was about the Sentinel experience moving into the Defender portal; the date (31 March 2027) was only on Learn.
Which licence gets it? Look for "included with", "available to customers with", "add-on", "E5", "E3", "P2". Security Copilot "included with Microsoft 365 E5" was the most expensive sentence to miss in 2025.
What must I do before which date? Preview means decide whether to test; GA means decide whether to enable; retirement means a migration task with a date.

Step 3. Confirm against Learn, same day

The Book of News is marketing-accurate. Learn is support-accurate. For each keeper, open the product's "What's new" page and find the matching entry; copy the Learn link and the date it was published. If Learn does not mention it yet, mark the row "announced, not documented" and re-check in a week.

Product pages to keep open on 18 November:

Microsoft Sentinel: What's new
Microsoft Defender XDR: What's new
Microsoft Entra: What's new
Microsoft Purview: What's new in Microsoft Purview
Microsoft Security Copilot: What's new
Security for AI: What's new

Step 4. The one-page table

Item	Retires / replaces	Licence	Date	Owner	Learn link

Rules: at most ten rows, every row has a date (a real one or "decide by 15 December"), every row has one owner, and no row without a Learn link. Send the page to the CISO; keep the forty bookmarks for yourself.

5. Prove it: 2025 worked examples

The same method applied to three 2025 announcements, with what Learn said afterwards.

2025 Book of News item	Q1 Retires	Q2 Licence	Q3 Date / action	What Learn confirmed
Security Copilot included with Microsoft 365 E5	Nothing	E5: 400 SCU per month per 1,000 licences, capped at 10,000	Enable in November, turn on the included agents	Whats-new entry November 2025; capacity appears without purchase
Entra Agent ID (preview) with Conditional Access for agents	Nothing yet; registry later converging under Agent 365	Entra ID P1 and up for the policies	Decide by December whether to pilot; inventory agent identities first	GA in 2026 with three policy templates
Sentinel data lake and the Defender portal as the home for Sentinel	Azure portal experience	Sentinel; no XDR or E5 needed in the Defender portal since January 2026	Migrate SOC before 31 March 2027; test KQL over the lake	Deadline on Learn; September 2026 integrated SIEM and data lake onboarding

Each row took about ten minutes. The third row is the one the lab would have missed with the hungry reading: the deadline is not in the Book of News at all.

Gotchas

"Generally available" in the Book of News can mean GA in one region or one cloud. Learn's entry says which.
Preview features sometimes need a tenant-level switch (for example in Defender's preview features page). Turning them on in production is a decision, not a click.
Licence lines quote the top SKU. "Included with E5" rarely means "included with E3"; check the Learn licensing table before telling the CISO it is free.
The Book of News page is edited during the week. Date your reading and re-check the keepers on the Friday.
Do not paste the Book of News into an AI assistant and ask for "the security summary": you get the hungry reading, faster. Ask it the three questions per item instead, then verify on Learn yourself.

Checklist

[ ] Book of News open on the web page, Security chapter first
[ ] Three questions answered per item; items with no answer skipped
[ ] Each keeper matched to a Learn "What's new" entry with a date
[ ] One-page table: at most ten rows, owner and date on every row
[ ] Table sent to the CISO on 18 November; keepers re-checked on 20 November

What changed recently

Checked against Microsoft Learn on 2026-10-29:

The 2025 Book of News security chapter items used as examples are now documented on Learn: Security Copilot included with Microsoft 365 E5 (November 2025), Entra Agent ID generally available with Conditional Access templates for agents, Sentinel in the Defender portal generally available without Defender XDR or E5 (January 2026) and the Azure portal retirement date of 31 March 2027.
Since the 2025 edition, Agent 365 (preview November 2025) has become the place where the agent registry, Entra identities, Defender detection and Purview data controls meet; expect the 2026 chapter to reference it heavily.
Ignite 2026 is 17 to 20 November in San Francisco; the keynote is 17 November at 10 a.m. Pacific, 1 a.m. on 18 November in Vietnam.

Sources

Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along: