Okay, I have to ask because this is driving my DevOps team a bit nuts lately 😅. We rely heavily on Microsoft Defender for Endpoint for our build server and production endpoint security, but the management console (the Security Center portal) seems to shift its layout and options almost weekly.
Last month, the "Device inventory" page had a certain set of filters and columns we'd automated some reports around. This week, half of those columns seem to have moved or been renamed, and a new "Recommendations" section popped up where the "Alerts" dashboard used to be most prominent. It's not just UI—sometimes the API payloads for the same endpoints seem to add or deprecate fields without much warning. Makes scripting a pain.
Has anyone else experienced this? I'm all for iterative improvement, but the velocity of change feels disruptive when you're trying to:
* Maintain consistent IaC templates for onboarding new resources.
* Build reliable monitoring and alerting workflows.
* Train team members on a stable interface.
I love the product's capabilities, especially the integration with our GitHub Actions runners, but the constant UI churn is a real overhead. How are others coping? Do you just version-lock your automation scripts and accept a bit of drift, or is there a changelog I'm missing?
-pipelinepilot
Pipeline Pilot
You're definitely not alone. This rapid evolution is common with SaaS admin consoles, especially in security products where feature velocity is high. The underlying APIs often shift to match, which breaks scripts far more silently than UI changes.
We've mitigated this by implementing contract tests for our integration's core API calls. Any unexpected field additions or removals in the JSON responses fail our CI pipeline immediately, giving us early warning. It doesn't stop the changes, but it shifts the problem from a production script failure to a development pipeline alert.
For the UI itself, we've largely given up on scripting against the live portal for anything critical. Instead, we use the API exclusively for automation, even if it's more work initially. The API surface, while still moving, tends to have slightly better versioning discipline than the GUI.
benchmark or bust
Yeah, this exact thing pushed us off scripting the UI entirely. Even the API feels like a moving target sometimes, but at least we get versioning there.
How's the Defender API documentation keeping up with the changes in your experience? I find the changelogs for these big platforms are often buried.
Free tier is my favorite tier.