Microsoft Defender for Identity

Security Testing Best Practices

4 September 2026Doc update+2 / −2 lines

In brief

The guidance changes references from Microsoft Defender XDR to Microsoft Defender and updates the Security operations overview link.

What Defender admins need to know

Administrators will see updated terminology and the corresponding link when reviewing integration guidance. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

|Check that Defender for Identity is deployed on all domain controllers |Deployment on all domain controllers ensures that you're getting all of the signals for threat detection. Not having full protection can lead to missed detections or false positives. |Microsoft Defender for Identity deployment overview | |Check that Defender for Identity is deployed on all AD FS, AD CS, and Microsoft Entra Connect servers |Deployment on all these servers ensures that you're getting all of the signals for threat detection. Not having full protection can lead to missed detections or false positives.| Configure sensors for AD FS, AD CS, and Microsoft Entra Connect | |Check the health of your Defender for Identity sensors |It's critical that your sensor is healthy and reporting as expected to ensure optimal performance. Having an unhealthy sensor can lead to missed detections. Review all health alerts before running any tests. |Microsoft Defender for Identity health issues | |Consider integrating with Microsoft ~~XDR|~~Defender|Defender for Identity provides alerting on identity-based threats. Integrating with Microsoft Defender ~~XDR~~ lets you correlate these alerts with other signals for a more comprehensive view of threats and potential solutions.

Microsoft Defender ~~XDR~~ is a unified pre-breach and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response ~~across~~in endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.|Microsoft Defender.| |Check Windows event collection configuration|Optimal event collection is essential for Defender for Identity to analyze and detect threats effectively. Check your configuration before running any tests. |- Configure Windows event collection for domain controllers
- Configure Windows event collection for AD CS
- Configure Windows event collection for AD FS
- Configure Windows event collection for Microsoft Entra Connect
- Use PowerShell to check your configuration| |Check that NNR is configured correctly|NNR is a critical component of Defender for Identity. Defender for Identity uses NNR to correlate between raw activities containing IP addresses and the computers involved in each activity. Defender for Identity profiles entities, including computers, and generates security alerts for suspicious activities. It's important for NNR to be configured correctly for a successful deployment and to help detect advanced threats.|Configure Network Name Resolution (NNR) for Microsoft Defender for Identity| |Check that you have a Directory Service account (DSA) |While a DSA is optional in some scenarios, we recommend that you configure a DSA for Defender for Identity for full security protection. When you have a DSA configured:
- The DSA connects to the domain controller at startup.
- The DSA queries the domain controller for data on entities seen in network traffic, monitored events, and monitored Event Tracing for Windows (ETW) activities.

A DSA is required for the following features and functionality:
- When working with a sensor installed on an AD FS / AD CS server
- To access the DeletedObjects container to collect information about deleted users and computers
- For domain and trust mapping, which occurs at sensor startup, and again every 10 minutes.
- To query another domain via LDAP for details, when detecting activities from entities in those other domains. |Directory Service Accounts for Microsoft Defender for Identity|

Related content

The Microsoft Defender ~~XDR~~ Security operations overview.

@@ -41,7 +41,7 @@ Here are some common issues that can affect your offensive security testing: |Check that Defender for Identity is deployed on all domain controllers  |Deployment on all domain controllers ensures that you're getting all of the signals for threat detection. Not having full protection can lead to missed detections or false positives.   |[Microsoft Defender for Identity deployment overview](deploy/deploy-defender-identity.md)   | |Check that Defender for Identity is deployed on all AD FS, AD CS, and Microsoft Entra Connect servers     |Deployment on all these servers ensures that you're getting all of the signals for threat detection. Not having full protection can lead to missed detections or false positives.| [Configure sensors for AD FS, AD CS, and Microsoft Entra Connect](deploy/active-directory-federation-services.md)  | |Check the health of your Defender for Identity sensors     |It's critical that your sensor is healthy and reporting as expected to ensure optimal performance. Having an unhealthy sensor can lead to missed detections. Review all health alerts before running any tests.  |[Microsoft Defender for Identity health issues](health-alerts.md) |-|Consider integrating with Microsoft XDR|Defender for Identity provides alerting on identity-based threats. Integrating with Microsoft Defender XDR lets you correlate these alerts with other signals for a more comprehensive view of threats and potential solutions.<br></br>Microsoft Defender XDR is a unified pre-breach and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.|[Microsoft Defender](/defender-xdr/microsoft-365-defender-train-security-staff).|+|Consider integrating with Microsoft Defender|Defender for Identity provides alerting on identity-based threats. Integrating with Microsoft Defender lets you correlate these alerts with other signals for a more comprehensive view of threats and potential solutions.<br></br>Microsoft Defender is a unified pre-breach and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response in endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.|[Microsoft Defender](/defender-xdr/microsoft-365-defender-train-security-staff).| |Check Windows event collection configuration|Optimal event collection is essential for Defender for Identity to analyze and detect threats effectively. Check your configuration before running any tests. |- [Configure Windows event collection for domain controllers](deploy/configure-windows-event-collection.md)</br> - [Configure Windows event collection for AD CS](deploy/configure-windows-event-collection.md#configure-auditing-on-an-ad-cs-server)</br> - [Configure Windows event collection for AD FS](deploy/configure-windows-event-collection.md#configure-auditing-on-an-ad-fs-server)</br> - [Configure Windows event collection for Microsoft Entra Connect](deploy/configure-windows-event-collection.md#configure-auditing-on-microsoft-entra-connect)</br> - [Use PowerShell to check your configuration](https://www.powershellgallery.com/packages/DefenderForIdentity/1.0.0.4)| |Check that NNR is configured correctly|NNR is a critical component of Defender for Identity. Defender for Identity uses NNR to correlate between raw activities containing IP addresses and the computers involved in each activity. Defender for Identity profiles entities, including computers, and generates security alerts for suspicious activities. It's important for NNR to be configured correctly for a successful deployment and to help detect advanced threats.|[Configure Network Name Resolution (NNR) for Microsoft Defender for Identity](nnr-policy.md)| |Check that you have a Directory Service account (DSA) |While a DSA is optional in some scenarios, we recommend that you configure a DSA for Defender for Identity for full security protection. When you have a DSA configured: <br> - The DSA connects to the domain controller at startup.<br> - The DSA queries the domain controller for data on entities seen in network traffic, monitored events, and monitored Event Tracing for Windows (ETW) activities.<br><br>A DSA is required for the following features and functionality:<br> - When working with a sensor installed on an AD FS / AD CS server<br> - To access the DeletedObjects container to collect information about deleted users and computers<br> - For domain and trust mapping, which occurs at sensor startup, and again every 10 minutes.<br> - To query another domain via LDAP for details, when detecting activities from entities in those other domains. |[Directory Service Accounts for Microsoft Defender for Identity](deploy/directory-service-accounts.md)|@@ -66,4 +66,4 @@ Make sure that the learning periods for the alerts listed below have been met be  ## Related content -- The Microsoft Defender XDR [Security operations overview](/security/operations/overview).+- The Microsoft Defender [Security operations overview](/security/operations/overview).