Microsoft Defender for Identity Updates & Release Notes

In new Defender for Identity workspaces, you can install sensor v2.x only on servers running Windows Server 2016 or earlier. This restriction applies to all server roles. Existing workspaces aren't affected. For more information, see Select your deployment method.

The new read-only Find-MdiAuditingGpoConflicts.ps1 PowerShell script identifies GPOs that override automatic auditing settings on a domain controller.

You can use the results to update or unlink the conflicting GPOs.

For more information, see Find GPO conflicts that revert automatic auditing.

You can now deploy Defender for Identity sensor v3.x on servers that run Active Directory Federation Services (AD FS), Active Directory Certificate Services (AD CS), or Microsoft Entra Connect. These servers can be domain controllers or standalone servers. For more information, see Deploy the Defender for Identity sensor v3.x.

Automatic Windows event auditing now configures auditing for AD FS, AD CS, and Microsoft Entra Connect.

Auditing is configured automatically on any eligible server that runs Defender for Identity sensor v3.x, including servers that aren't domain controllers.

For more information, see Configure Defender for Identity to collect Windows events automatically.

A new Defender for Identity health alert notifies you when a conflicting policy, such as a Group Policy Object (GPO), repeatedly reverts the auditing configuration required by sensor v3.x on a domain controller. For more information, see Microsoft Defender for Identity health issues.

This sensor update adds support for a new Event Tracing for Windows (ETW) provider and includes other improvements.

You can now migrate domain controllers running Windows Server 2025 from sensor v2.x to sensor v3.x. For more information, see Migrate to Defender for Identity sensor v3.x.

When a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see Troubleshoot "Not ready for migration" status.

Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x.

The Password protection page now includes password risks from SaaS apps connected through Microsoft Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce and ServiceNow, appear on the Password Hygiene and Password Policies tabs. Each SaaS app requires a Defender for Cloud Apps app connector. For more information, see Investigate identity password protection.

The Domain investigation page is now generally available.

The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information, see Investigate a domain.

Defender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later.

You no longer need to apply a tag manually to enable RPC auditing.

For more information, see Configure RPC auditing.

The identity risk score is now generally available.

The score ranges from 0 to 100 and reflects how likely an identity is to be compromised and how much damage a compromise could cause, based on the identity's criticality level and privileged role assignments.

The Risk score tab on the Identity page provides a detailed breakdown of risk factors, percentile comparison, and risk trends.

• Expanded Entra ID inventory: The non-human identity inventory now includes all Microsoft Entra service principals, not just those with API permissions. For more information, see View the Identity inventory.

• Microsoft Entra roles visibility: The Permissions tab now shows assigned Microsoft Entra roles alongside API permissions. For more information, see View your app details with app governance.