Microsoft Defender for Identity Updates & Release Notes

Name: Microsoft Defender for Identity
Brand: Microsoft

Follow Microsoft Defender for Identity to add their release notes to your feed!

23 updates curated from 1 source by the Releasebot Team. Last updated: Oct 18, 2026

Get this feed:

October 2026
Date parsed from source:
Oct 1, 2026

First seen by Releasebot:
Oct 18, 2026
Microsoft Defender for Identity by Microsoft

Automatic sensor v3.x activation and Windows auditing for existing customers

Microsoft Defender for Identity is rolling out automatic sensor v3.x activation and Windows auditing configuration as default settings for eligible organizations, with a 30-day notice and an option to opt out.

This rollout applies only to organizations that are licensed for Defender for Identity and have an active workspace. Eligible organizations included in the rollout see a banner on the Sensor management tab of the On-premises settings page for 30 days.

After the 30-day notice period, Automatic sensor v3.x activation and Automatic Windows auditing configuration are enabled by default through a very gradual rollout, including settings currently set to Off. To keep your current settings, select Opt out in the banner during the notice period.

While the banner appears, select Go to Advanced features to enable the settings yourself, or Opt out to prevent automatic enablement.

For more information, see Activate the Defender for Identity sensor v3.x and Configure Windows event auditing.
Original source
October 2026
Date parsed from source:
Oct 1, 2026

First seen by Releasebot:
Oct 7, 2026
Microsoft Defender for Identity by Microsoft

General availability of sensor v3.x activation without Defender for Endpoint

Microsoft Defender for Identity now supports sensor v3.x activation without Defender for Endpoint on eligible Windows Server 2019+ domain controllers.

Defender for Identity sensor v3.x activation without Defender for Endpoint is now generally available for eligible domain controllers running Windows Server 2019 or later.

This activation method supports only new sensor v3.x deployments on eligible domain controllers without an existing Defender for Identity sensor.

Sensor v2.x migration isn't supported.

For more information, see Activate the Defender for Identity sensor.
Original source
All of your release notes in one feed

Join Releasebot and get updates from Microsoft and hundreds of other software products.

Create account
Get updates with:
October 2026
Date parsed from source:
Oct 1, 2026

First seen by Releasebot:
Jul 20, 2026

Modified by Releasebot:
Oct 14, 2026
Microsoft Defender for Identity by Microsoft

New Defender for Identity security alerts

Microsoft Defender for Identity adds October alerts covering suspicious Entra ID sign-ins, Active Directory attacks and certificate abuse, and risky or anomalous Okta activity.
The October announcement includes the following new alerts:

New alerts related to Entra ID

Suspicious sign-in via Temporary Access Pass

New alerts related to Active Directory

Kerberos privilege escalation using a diamond ticket

Malicious Kerberos activity and CVE-2025-33073 exploitation attempt

Malicious request of Data Protection API (DPAPI) master key

Possible data exfiltration over DNS

Suspicious Active Directory Certificate Services (AD CS) certificate request

Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance abuse (ESC8)

Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance over RPC (ESC11)

Suspicious Active Directory Certificate Services (AD CS) misconfigured certificate template abuse (ESC1)

Suspicious Certificate Authority (CA) certificate and private key theft

Suspicious Kerberos PKINIT authentication (AS-REQ)

Suspicious Kerberos ticket authorization data

New alerts related to other identity providers

Anomalous volume of failed Okta authentication attempts

Multifactor authentication method added for a privileged Okta account

Okta access or refresh token grant from a risky context

Okta anomalous privileged account authentication

Okta consent grant from a risky context

Password of a privileged Okta account was reset by another account

Secondary identity provider added in Okta

Original source
September 2026
Date parsed from source:
Sep 1, 2026

First seen by Releasebot:
Sep 30, 2026

Modified by Releasebot:
Oct 18, 2026
Microsoft Defender for Identity by Microsoft

Automatic sensor v3.x activation and Windows auditing by default

Microsoft Defender for Identity rolls out automatic sensor v3.x activation and Windows auditing for eligible organizations, with different onboarding paths for new Defender for Endpoint customers and existing customers who can opt out during a 30-day notice period.

Automatic sensor v3.x activation and automatic Windows auditing apply only to organizations with an active license that includes Microsoft Defender for Identity.

Rollout for new and existing customers

The rollout differs for new Microsoft Defender for Endpoint customers and existing Defender for Identity customers:

New Microsoft Defender for Endpoint customers

This applies to organizations licensed for Defender for Identity whose first device was onboarded to Defender for Endpoint on or after September 13, 2026. Automatic sensor v3.x activation and Windows auditing are enabled by default when Defender for Identity identifies an eligible identity-role server that's onboarded to Defender for Endpoint. A Defender for Identity workspace is also created automatically.

This flow activates the Defender for Identity sensor capability on eligible servers that are already onboarded to Defender for Endpoint. It doesn't add a separate Defender for Identity installation, activate the sensor on other Defender for Endpoint servers, or affect servers that already have a Defender for Identity sensor.

Existing Defender for Identity customers

This rollout applies only to organizations that are licensed for Defender for Identity and have an active workspace. Eligible organizations included in the rollout see a banner on the Sensor management tab of the On-premises settings page for 30 days.

After the 30-day notice period, Automatic sensor v3.x activation and Automatic Windows auditing configuration are enabled by default through a very gradual rollout, including settings currently set to Off. To keep your current settings, select Opt out in the banner during the notice period.

While the banner appears, select Go to Advanced features to enable the settings yourself, or Opt out to prevent automatic enablement.

For more information, see Activate the Defender for Identity sensor v3.x and Configure Windows event auditing.
Original source
September 2026
Date parsed from source:
Sep 1, 2026

First seen by Releasebot:
Sep 17, 2026
Microsoft Defender for Identity by Microsoft

Identity Security dashboard and Coverage & Maturity

Microsoft Defender for Identity adds an Identity Security dashboard for centralized risk visibility and coverage maturity insights.

The Identity Security dashboard provides a centralized view of identity-related security risks and posture across your organization. Coverage & Maturity helps security teams understand identity protection across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage and deployment gaps, and prioritize actions to improve identity security posture. For more information, see Coverage & Maturity.
Original source
Similar to Microsoft Defender for Identity with recent updates:
September 2026
Date parsed from source:
Sep 1, 2026

First seen by Releasebot:
Sep 10, 2026

Modified by Releasebot:
Sep 15, 2026
Microsoft Defender for Identity by Microsoft

Sensor v3.x onboarding without Microsoft Defender for Endpoint deployment (Preview)

Microsoft Defender for Identity now supports activating sensor v3.x on eligible domain controllers without Defender for Endpoint onboarding.

You can now activate the Defender for Identity sensor v3.x on eligible domain controllers without first onboarding them to Defender for Endpoint. This preview supports only new sensor v3.x deployments on eligible domain controllers running Windows Server 2019 or later. For more information, see Activate the Defender for Identity sensor.
Original source
September 2026
Date parsed from source:
Sep 1, 2026

First seen by Releasebot:
Sep 10, 2026

Modified by Releasebot:
Sep 30, 2026
Microsoft Defender for Identity by Microsoft

Sensor v3.x support for additional identity server roles: AD CS, AD FS, and Entra Connect (Preview)

Microsoft Defender for Identity adds support for eligible AD FS, AD CS, and Microsoft Entra Connect servers without existing sensors.

Defender for Identity sensor v3.x now supports eligible AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers and don't have an existing Defender for Identity sensor. For more information, see Defender for Identity sensor v3.x prerequisites.
Original source
September 2026
Date parsed from source:
Sep 1, 2026

First seen by Releasebot:
Sep 10, 2026
Microsoft Defender for Identity by Microsoft

Combined Sensor management tab on the On-premises settings page

Microsoft Defender for Identity combines Onboarding and Sensors into a Sensor management tab and moves automatic sensor v3.x activation to Advanced features.

The Onboarding and Sensors tabs on the identity On-premises settings page are now combined into a single Sensor management tab that lists both installed sensors and servers eligible for activation. Automatic sensor v3.x activation is now configured on the Advanced features page. For more information, see Manage and update Microsoft Defender for Identity sensors.
Original source
August 2026
Date parsed from source:
Aug 1, 2026

First seen by Releasebot:
Sep 1, 2026
Microsoft Defender for Identity by Microsoft

Sensor v2.x installation restriction for new workspaces

Microsoft Defender for Identity restricts sensor v2.x installs in new workspaces to Windows Server 2016 or earlier.

In new Defender for Identity workspaces, you can install sensor v2.x only on servers running Windows Server 2016 or earlier. This restriction applies to all server roles. Existing workspaces aren't affected. For more information, see Select your deployment method.
Original source
August 2026
Date parsed from source:
Aug 1, 2026

First seen by Releasebot:
Aug 11, 2026
Microsoft Defender for Identity by Microsoft

Script to find GPO conflicts that revert auditing

Microsoft Defender for Identity adds a read-only PowerShell script to find GPO conflicts that override automatic auditing settings.

The new read-only Find-MdiAuditingGpoConflicts.ps1 PowerShell script identifies GPOs that override automatic auditing settings on a domain controller.

You can use the results to update or unlink the conflicting GPOs.

For more information, see Find GPO conflicts that revert automatic auditing.
Original source
August 2026
Date parsed from source:
Aug 1, 2026

First seen by Releasebot:
Aug 11, 2026
Microsoft Defender for Identity by Microsoft

Sensor v3.x support for AD FS, AD CS, and Microsoft Entra Connect servers

Microsoft Defender for Identity now supports sensor v3.x deployment on AD FS, AD CS, and Microsoft Entra Connect servers.

You can now deploy Defender for Identity sensor v3.x on servers that run Active Directory Federation Services (AD FS), Active Directory Certificate Services (AD CS), or Microsoft Entra Connect. These servers can be domain controllers or standalone servers. For more information, see Deploy the Defender for Identity sensor v3.x.
Original source
August 2026
Date parsed from source:
Aug 1, 2026

First seen by Releasebot:
Aug 11, 2026

Modified by Releasebot:
Aug 25, 2026
Microsoft Defender for Identity by Microsoft

Expanded automatic auditing for AD CS, AD FS and Entra Connect servers

Microsoft Defender for Identity now automates Windows event auditing for AD FS, AD CS, and Entra Connect on eligible servers.

Automatic Windows event auditing now configures auditing for AD FS, AD CS, and Microsoft Entra Connect.

Auditing is configured automatically on any eligible server that runs Defender for Identity sensor v3.x, including servers that aren't domain controllers.

For more information, see Configure Defender for Identity to collect Windows events automatically.
Original source
August 2026
Date parsed from source:
Aug 1, 2026

First seen by Releasebot:
Aug 11, 2026

Modified by Releasebot:
Sep 30, 2026
Microsoft Defender for Identity by Microsoft

Defender for Identity sensor updates

Microsoft Defender for Identity adds security improvements in this sensor update.

This sensor update includes security improvements.
Original source
August 2026
Date parsed from source:
Aug 1, 2026

First seen by Releasebot:
Jul 21, 2026

Modified by Releasebot:
Aug 11, 2026
Microsoft Defender for Identity by Microsoft

New health alert for reverted auditing configuration

Microsoft Defender for Identity adds a health alert for conflicting policies that keep reverting required sensor v3.x auditing settings.

A new Defender for Identity health alert notifies you when a conflicting policy, such as a Group Policy Object (GPO), repeatedly reverts the auditing configuration required by sensor v3.x on a domain controller. For more information, see Microsoft Defender for Identity health issues.
Original source
July 2026
Date parsed from source:
Jul 1, 2026

First seen by Releasebot:
Jul 22, 2026
Microsoft Defender for Identity by Microsoft

Migrate Windows Server 2025 domain controllers to sensor v3.x

Microsoft Defender for Identity now supports migrating Windows Server 2025 domain controllers from sensor v2.x to v3.x.

You can now migrate domain controllers running Windows Server 2025 from sensor v2.x to sensor v3.x. For more information, see Migrate to Defender for Identity sensor v3.x.
Original source