Microsoft Defender for Identity
TroubleshootingTroubleshoot the Defender for Identity sensor using logs
In brief
The page now uses clearer descriptions of sensor and deployment logs, including their locations, archived-file handling, and troubleshooting use cases.
What Defender admins need to know
Admins can more easily locate and interpret logs when investigating sensor installation or runtime issues. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Troubleshooting Microsoft Defender for Identity sensor using the Defender for Identity logs
The Defender for Identity logs provide insight into what each component of Microsoft Defender for Identity sensor is doingactivity and status at any given point in time.
The Defender for Identity sensor logs are located in a subfolder calledthe Logs where Defender for Identitysubfolder under the sensor installation directory. By default, the sensor is installed; the default location is:installed in C:\Program Files\Azure Advanced Threat Protection Sensor. In the default installation location,, and the Logs folder can be found at: C:\Program Files\Azure Advanced Threat Protection Sensor\version number\Logs.
Defender for Identity sensor logs
- Microsoft.Tri.Sensor.Updater-Errors.log – This log contains just the errors that are caught by the Defender for Identity sensor updater. Its main use is performing health checks and investigating issues that need to be correlated to specific times.
Defender for Identity deployment logs
The Defender for Identity deployment logs are located in the temp directory of the user who installed the product. Typically, you can find these logs at %USERPROFILE%\AppData\Local\Temp. If the deployment was performed by a service, the deployment logs might be located in C:\Windows\Temp or C:\Windows\SystemTemp, depending on your Windows version and patch level.
Defender for Identity sensor deployment logs:
- Azure Advanced Threat Protection Sensor_YYYYMMDDHHMMSS_001_MsiPackage.log - This log file lists the steps in the process of the deployment of the Defender for Identity sensor binaries. Its main use is tracking the deployment of the Defender for Identity sensor binaries.
Related content
@@ -1,18 +1,18 @@ ----title: Troubleshooting the sensor using logs | Microsoft Defender for Identity-description: Describes how you can use the Microsoft Defender for Identity logs to troubleshoot issues-ms.date: 06/15/2026+title: Troubleshoot the Defender for Identity sensor using logs+description: Use Microsoft Defender for Identity sensor logs to diagnose component behavior and investigate installation or runtime issues. Includes log locations and guidance for troubleshooting.+ms.date: 07/02/2026 ms.topic: how-to ms.reviewer: rlitinsky ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Troubleshooting Microsoft Defender for Identity sensor using the Defender for Identity logs -The Defender for Identity logs provide insight into what each component of Microsoft Defender for Identity sensor is doing at any given point in time.+The Defender for Identity logs provide insight into sensor activity and status at any given point in time. -The Defender for Identity logs are located in a subfolder called **Logs** where Defender for Identity is installed; the default location is: `C:\Program Files\Azure Advanced Threat Protection Sensor`. In the default installation location, the Logs folder can be found at: `C:\Program Files\Azure Advanced Threat Protection Sensor\version number\Logs`.+The Defender for Identity sensor logs are located in the **Logs** subfolder under the sensor installation directory. By default, the sensor is installed in `C:\Program Files\Azure Advanced Threat Protection Sensor`, and the Logs folder can be found at: `C:\Program Files\Azure Advanced Threat Protection Sensor\version number\Logs`. ## Defender for Identity sensor logs @@ -27,11 +27,11 @@ The Defender for Identity sensor has the following logs: - **Microsoft.Tri.Sensor.Updater-Errors.log** – This log contains just the errors that are caught by the Defender for Identity sensor updater. Its main use is performing health checks and investigating issues that need to be correlated to specific times. > [!NOTE]-> The log files have a maximum size of up to 50 MB. When a log file reaches 50 MB, a new log file is opened and the previous one is renamed to "<original file name>-Archived-00000" where the number increments each time it is renamed. By default, if more than 10 archived log files of the same log type already exist, the oldest files are deleted.+> The log files have a maximum size of up to 50 MB. When a log file reaches 50 MB, a new log file is opened and the previous one is renamed to "<original file name>-Archived-00000" where the number increments each time it is renamed. By default, if more than 10 archived files already exist for that specific log file name, the oldest archived files are deleted. ## Defender for Identity deployment logs -The Defender for Identity deployment logs are located in the temp directory of the user who installed the product. Typically, you can find these logs at `%USERPROFILE%\AppData\Local\Temp`. If the deployment was performed by a service, the logs might be located in `C:\Windows\Temp` or `C:\Windows\SystemTemp`, depending on your Windows version and patch level.+The Defender for Identity deployment logs are located in the temp directory of the user who installed the product. Typically, you can find these logs at `%USERPROFILE%\AppData\Local\Temp`. If the deployment was performed by a service, the deployment logs might be located in `C:\Windows\Temp` or `C:\Windows\SystemTemp`, depending on your Windows version and patch level. Defender for Identity sensor deployment logs: @@ -42,7 +42,7 @@ Defender for Identity sensor deployment logs: - **Azure Advanced Threat Protection Sensor_YYYYMMDDHHMMSS_001_MsiPackage.log** - This log file lists the steps in the process of the deployment of the Defender for Identity sensor binaries. Its main use is tracking the deployment of the Defender for Identity sensor binaries. > [!NOTE]-> In addition to the deployment logs mentioned here, there are other logs that begin with "Azure Advanced Threat Protection" that can also provide additional information on the deployment process.+> In addition to the deployment logs listed in this section, other logs whose names begin with "Azure Advanced Threat Protection" can also provide information about the deployment process. ## Related content