Microsoft Defender for Identity
Identity protectionConfigure Windows Event Collection
In brief
Automatic sensor activation and automatic Windows auditing now require an active license that includes Microsoft Defender for Identity.
What Defender admins need to know
Verify that your organization has the required active license before using these automatic capabilities.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
uhfHeaderId: MSDocsHeader-MicrosoftDefender
ms.suite: ems
description: Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.
ms.date: 2026-09-23T00:10-06T00:00:00.0000000Z
ms.topic: how-to
ms.custom:
- msecd-doc-authoring-1015
Note
Automatic sensor activation and automatic Windows auditing are available only after your organization has an active license that includes Microsoft Defender for Identity.
When Automatic sensor v3.x activation and Automatic Windows auditing configuration are enabled, Defender for Identity automatically activates sensor v3.x and configures Windows auditing on eligible domain controllers, AD FS, AD CS, or Microsoft Entra Connect servers that you onboard to Defender for Endpoint. The servers must run Windows Server 2019 or later.
To enable automatic Windows auditing in the Defender portal, complete the following steps:
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.-ms.date: 2026-09-23T00:00:00.0000000Z+ms.date: 2026-10-06T00:00:00.0000000Z ms.topic: how-to ms.custom: - msecd-doc-authoring-1015@@ -67,6 +67,8 @@ If you're deploying the Defender for Identity sensor v3.x, use automatic Windows
Note
+Automatic sensor activation and automatic Windows auditing are available only after your organization has an active license that includes Microsoft Defender for Identity.
+
When **Automatic sensor v3.x activation** and **Automatic Windows auditing configuration** are enabled, Defender for Identity automatically activates sensor v3.x and configures Windows auditing on eligible domain controllers, AD FS, AD CS, or Microsoft Entra Connect servers that you onboard to Defender for Endpoint. The servers must run Windows Server 2019 or later.
To enable automatic Windows auditing in the Defender portal, complete the following steps: