Microsoft Defender for Identity Updates & Release Notes

Name: Microsoft Defender for Identity
Brand: Microsoft

Follow Microsoft Defender for Identity to add their release notes to your feed!

8 updates curated from 1 source by the Releasebot Team. Last updated: Jul 20, 2026

Get this feed:

July 2026
Date parsed from source:
Jul 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

Sensor v2.x to v3.x migration is now generally available

Microsoft Defender for Identity now supports migrating sensors from v2.x to v3.x with general availability.

Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x.
Original source
July 2026
Date parsed from source:
Jul 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

Expanded SaaS app support in Password protection (Preview)

Microsoft Defender for Identity expands Password protection with SaaS app risks from Defender for Cloud Apps.

The Password protection page now includes password risks from SaaS apps connected through Microsoft Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce and ServiceNow, appear on the Password Hygiene and Password Policies tabs. Each SaaS app requires a Defender for Cloud Apps app connector. For more information, see Investigate identity password protection.
Original source
All of your release notes in one feed

Join Releasebot and get updates from Microsoft and hundreds of other software products.

Create account
Get updates with:
July 2026
Date parsed from source:
Jul 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

The Domain investigation page is now generally available

Microsoft Defender for Identity releases the Domain investigation page in general availability for Active Directory domain security insights.

The Domain investigation page is now generally available

The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information, see Investigate a domain.
Original source
July 2026
Date parsed from source:
Jul 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

Automatic RPC auditing on domain controllers

Microsoft Defender for Identity now automatically enables RPC auditing on domain controllers after sensor version 3.0.8 upgrades.

Defender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later.

You no longer need to apply a tag manually to enable RPC auditing.

For more information, see Configure RPC auditing.
Original source
June 2026
Date parsed from source:
Jun 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

Identity risk score is now generally available

Microsoft Defender for Identity introduces a generally available identity risk score with breakdowns, percentile comparisons, and trends.

The identity risk score is now generally available.

The score ranges from 0 to 100 and reflects how likely an identity is to be compromised and how much damage a compromise could cause, based on the identity's criticality level and privileged role assignments.

The Risk score tab on the Identity page provides a detailed breakdown of risk factors, percentile comparison, and risk trends.
Original source
Similar to Microsoft Defender for Identity with recent updates:
June 2026
Date parsed from source:
Jun 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

New Defender for Identity security alerts

Microsoft Defender for Identity adds new security alerts across Entra ID, Active Directory, and other identity providers, including detections for suspicious sign-ins, bulk deletion activity, DCSync attacks, Entra Connect authentication, and SailPoint ISC brute-force attempts.
These new alerts were added to the Defender for Identity security alerts:

New alerts related to Entra ID:

Anomalous activity following Global Administrator elevation

Reciprocal Temporary Access Pass creation between users

Suspicious service principal sign-in following credential addition

Suspicious bulk user deletion via scripted activity

Suspicious removal of privileged app role assignment through Graph API

Suspicious sign-in by a user exhibiting a spike in account update activity

User exhibiting spike in distinct application-resource access combinations

New alerts related to Active Directory:

DCSync attack (replication of directory services)

Suspicious Entra Connect account authentication

New alerts related to other identity providers:

SailPoint ISC suspected brute-force attack

Original source
June 2026
Date parsed from source:
Jun 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

NHI inventory enhancements (Preview)

Microsoft Defender for Identity expands Entra ID inventory and shows Microsoft Entra roles in the Permissions tab.
Expanded Entra ID inventory: The non-human identity inventory now includes all Microsoft Entra service principals, not just those with API permissions. For more information, see View the Identity inventory.

Microsoft Entra roles visibility: The Permissions tab now shows assigned Microsoft Entra roles alongside API permissions. For more information, see View your app details with app governance.

Original source
June 2026
Date parsed from source:
Jun 1, 2026

First seen by Releasebot:
Jul 20, 2026
Microsoft Defender for Identity by Microsoft

Visibility into service principals used by AI agents (Preview)

Microsoft Defender for Identity adds a Used by AI agents column and insight card to identify Entra ID service principals.

The non-human identity inventory now identifies which Entra ID service principals are used by AI agents.

A new "Used by AI agents" column and insight card help you find and prioritize these identities.

For more information, see View the Identity inventory.
Original source