Microsoft Defender for Identity
Identity protectionQuarterly or Ad-hoc Operational Guide - Microsoft Defender for Identity
In brief
The guide’s title, description, date, heading, and authoring metadata were updated. The Test-MDIConfiguration guidance was shortened while retaining its purpose and warning about incorrect audit policies.
What Defender admins need to know
No administrator configuration change, migration, or deadline is specified.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Quarterly / ad ad-hoc operational guide - Microsoft Defender for Identity
This article reviews the Microsoft Defender for Identity activities we recommend for your team on a quarterly or ad-hoc basis, depending on your organization's needs and processes.
Persona: Security administrators
We recommend that you periodically run the Test-MDIConfiguration PowerShell command. This command testsIt checks whether your domain controller Advanced Audit Policyaudit policy settings are configured correctly. Misconfiguredcorrect. Wrong settings can cause gaps in the Event Log and incompletereduce Defender for Identity coverage.
For more information, see:
- Configure audit policies for Windows event logs
- Test-MDIConfiguration PowerShell documentation
Related content
For more information, see:
@@ -1,15 +1,15 @@ ----title: Quarterly or ad hoc operational guide - Microsoft Defender for Identity-description: Learn about the Microsoft Defender for Identity activities that we recommend for your team on a quarterly or ad-hoc basis.-ms.date: 06/15/2026+title: Quarterly or Ad-hoc Operational Guide - Microsoft Defender for Identity+description: Review quarterly and ad hoc Microsoft Defender for Identity tasks, including checking service health, verifying sensor deployment in server setup processes, and validating domain controller audit policies.+ms.date: 07/02/2026 ms.topic: how-to #customerIntent: As a Microsoft Defender for Identity customer, I want to know the recommended activities for my team on a quarterly or ad-hoc basis. ms.reviewer: martin77s ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- -# Quarterly / ad hoc operational guide - Microsoft Defender for Identity+# Quarterly / ad-hoc operational guide - Microsoft Defender for Identity This article reviews the Microsoft Defender for Identity activities we recommend for your team on a quarterly or ad-hoc basis, depending on your organization's needs and processes. @@ -47,18 +47,15 @@ For more information, see [Deploy Microsoft Defender for Identity with Microsoft **Persona**: Security administrators -We recommend that you periodically run the **Test-MDIConfiguration** PowerShell command. This command tests whether your domain controller Advanced Audit Policy settings are configured correctly. Misconfigured settings can cause gaps in the Event Log and incomplete Defender for Identity coverage.+We recommend that you periodically run the **Test-MDIConfiguration** PowerShell command. It checks whether your domain controller audit policy settings are correct. Wrong settings can cause gaps in the Event Log and reduce Defender for Identity coverage. For more information, see: - [Configure audit policies for Windows event logs](../deploy/configure-windows-event-collection.md) - [Test-MDIConfiguration](/powershell/module/defenderforidentity/test-mdiconfiguration) PowerShell documentation - ## Related content -For more information, see:- - [Microsoft Defender Security operations overview](/security/operations/overview) - [Microsoft Defender for Identity operational guide](ops-guide.md) - [Daily operational guide - Microsoft Defender for Identity](ops-guide-daily.md)