Microsoft Defender for Identity
Identity protectionHealth Alerts
In brief
The health alerts page revises the entry describing a missing or incorrectly applied Unified Sensor RPC Audit configuration tag and its resolution steps.
What Defender admins need to know
Administrators troubleshooting this alert should consult the revised verification guidance; no action is required solely because of this change.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Radius accounting (VPN integration) data ingestion failures | The listed Defender for Identity sensors have radius accounting (VPN integration) data ingestion failures. | Validate that the shared secret in the Defender for Identity configuration settings matches your VPN server, according to the guidance described Configure VPN in Defender for Identity section, in the Defender for Identity VPN integration page. | Low | Health issues page | 2.x |
| Auditing for AD CS servers isn't enabled as required | The Advanced Auditing Policy Configuration or AD CS auditing isn't enabled as required. (This configuration is validated once a day, per sensor.) | Enable the Advanced Auditing Policy Configuration and AD CS auditing according to the guidance as described in the Configure auditing on AD CS section, in the Configure Windows Event collection page. | Medium | Sensors health issues tab | 2.x |
| Sensor failed to retrieve Microsoft Entra Connect service configuration | The sensor is unable to retrieve the configuration from the Microsoft Entra Connect service (also known as Microsoft Azure AD sync). | Ensure that the Microsoft Entra connect service (Microsoft Azure AD Sync) is running and follow the instructions in Configure permissions for the Microsoft Entra Connect (ADSync) database to grant the sensor the necessary permissions. If the issue persists, follow the troubleshooting guidance at SQL connectivity issues with Microsoft Entra Connect. | Medium | Sensors health issues tab | 2.x |
| Sensor v3.x RPC Audit Misconfigured | The sensor is missing the required Unified Sensor RPC Audit configuration tag, or the tag was not applied correctly. | To resolve this issue, do one of the following:- Verify that the Unified Sensor RPC Audit configuration is correctly applied to the relevant devices. Once the tag is applied, the configuration is enforced automatically on matching devices.- Install the JulySeptember 2026 or later Windows cumulative update to upgrade the Defender for Identity sensor to version 3.0.810 or later. In sensor version 3.0.8 or later, RPC auditing is applied automatically, and the tag is no longer required.For more information, see Configure RPC auditing. | Medium | Sensors health issues tab | 3.x |
Note
@@ -126,7 +126,7 @@ Each health issue table includes a **Displayed in** column that indicates whethe | **Radius accounting (VPN integration) data ingestion failures** | The listed Defender for Identity sensors have radius accounting (VPN integration) data ingestion failures. | Validate that the shared secret in the Defender for Identity configuration settings matches your VPN server, according to the guidance described [Configure VPN in Defender for Identity](vpn-integration#configure-vpn-in-defender-for-identity) section, in the [Defender for Identity VPN integration](vpn-integration) page. | Low | Health issues page | 2.x |
| **Auditing for AD CS servers isn't enabled as required** | The Advanced Auditing Policy Configuration or AD CS auditing isn't enabled as required. (This configuration is validated once a day, per sensor.) | Enable the Advanced Auditing Policy Configuration and AD CS auditing according to the guidance as described in the [Configure auditing on AD CS](configure-windows-event-collection#configure-auditing-on-ad-cs) section, in the [Configure Windows Event collection](configure-windows-event-collection) page. | Medium | Sensors health issues tab | 2.x |
| **Sensor failed to retrieve Microsoft Entra Connect service configuration** | The sensor is unable to retrieve the configuration from the Microsoft Entra Connect service (also known as Microsoft Azure AD sync). | Ensure that the Microsoft Entra connect service **(Microsoft Azure AD Sync)** is running and follow the instructions in [Configure permissions for the Microsoft Entra Connect (ADSync) database](deploy/active-directory-federation-services#configure-permissions-for-the-microsoft-entra-connect-adsync-database) to grant the sensor the necessary permissions. If the issue persists, follow the troubleshooting guidance at [SQL connectivity issues with Microsoft Entra Connect](/en-us/entra/identity/hybrid/connect/tshoot-connect-tshoot-sql-connectivity). | Medium | Sensors health issues tab | 2.x |
-| **Sensor v3.x RPC Audit Misconfigured** | The sensor is missing the required Unified Sensor RPC Audit configuration tag, or the tag was not applied correctly. | To resolve this issue, do one of the following:- Verify that the Unified Sensor RPC Audit configuration is correctly applied to the relevant devices. Once the tag is applied, the configuration is enforced automatically on matching devices.- Install the July 2026 or later Windows cumulative update to upgrade the Defender for Identity sensor to version 3.0.8 or later. In sensor version 3.0.8 or later, RPC auditing is applied automatically, and the tag is no longer required.For more information, see [Configure RPC auditing](deploy/deploy-sensor-v3#configure-rpc-auditing). | Medium | Sensors health issues tab | 3.x |
+| **Sensor v3.x RPC Audit Misconfigured** | The sensor is missing the required Unified Sensor RPC Audit configuration tag, or the tag was not applied correctly. | To resolve this issue, do one of the following:- Verify that the Unified Sensor RPC Audit configuration is correctly applied to the relevant devices. Once the tag is applied, the configuration is enforced automatically on matching devices.- Install the September 2026 or later Windows cumulative update to upgrade the Defender for Identity sensor to version 3.0.10 or later. In sensor version 3.0.8 or later, RPC auditing is applied automatically, and the tag is no longer required.For more information, see [Configure RPC auditing](deploy/deploy-sensor-v3#configure-rpc-auditing). | Medium | Sensors health issues tab | 3.x |
Note