Microsoft Defender for Identity
Identity protectionConfigure Windows Event Collection
In brief
The documentation now explains that enabling both automatic sensor v3.x activation and automatic Windows auditing configures eligible onboarded servers automatically.
What Defender admins need to know
Administrators can better understand the effect of these settings when onboarding eligible servers.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
uhfHeaderId: MSDocsHeader-MicrosoftDefender
ms.suite: ems
description: Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.
ms.date: 2026-08-10T00:09-23T00:00:00.0000000Z
ms.topic: how-to
ms.custom:
- msecd-doc-authoring-1015
If you're deploying the Defender for Identity sensor v3.x, use automatic Windows auditing. This approach requires no manual configuration and handles all auditing settings for you.
Turn onControl automatic Windows auditing
Note
When Automatic sensor v3.x activation and Automatic Windows auditing configuration are enabled, Defender for Identity automatically activates sensor v3.x and configures Windows auditing on eligible domain controllers, AD FS, AD CS, or Microsoft Entra Connect servers that you onboard to Defender for Endpoint. The servers must run Windows Server 2019 or later.
To enable automatic Windows auditing in the Defender portal, complete the following steps:
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.-ms.date: 2026-08-10T00:00:00.0000000Z+ms.date: 2026-09-23T00:00:00.0000000Z ms.topic: how-to ms.custom: - msecd-doc-authoring-1015@@ -63,7 +63,11 @@ If you configure auditing properly, Windows event auditing has minimal effect on
If you're deploying the Defender for Identity sensor v3.x, use automatic Windows auditing. This approach requires no manual configuration and handles all auditing settings for you.
-### Turn on automatic Windows auditing
+### Control automatic Windows auditing
+
+Note
+
+When **Automatic sensor v3.x activation** and **Automatic Windows auditing configuration** are enabled, Defender for Identity automatically activates sensor v3.x and configures Windows auditing on eligible domain controllers, AD FS, AD CS, or Microsoft Entra Connect servers that you onboard to Defender for Endpoint. The servers must run Windows Server 2019 or later.
To enable automatic Windows auditing in the Defender portal, complete the following steps: