Identity Inventory
Identity protection
The page updates the Hybrid identity description, corrects the Risk score link, and points investigation guidance to non-human identities.
Product
Microsoft Defender for Identity
Track documentation and Message Center changes for Microsoft Defender for Identity.
Microsoft Learn documentation ↗Latest Microsoft Defender for Identity changes
Service Account Discovery
Identity protection
The article now points to two different authoring references.
Activate Sensor
Identity protection
The documentation now describes Defender for Identity sensor v3.x onboarding without Defender for Endpoint for eligible servers, including domain controllers, AD FS, AD CS, and Microsoft Entra Connect.
Alerts Xdr
Identity protection
The page’s DevRel metadata links were updated, and the “AADInternals private key extraction attempt” alert entry was removed.
Deploy Defender Identity
Architecture and deployment
Windows Server 2019 or later AD FS, AD CS, and Microsoft Entra Connect servers are now documented as supporting sensor v3.x onboarding with or without Microsoft Defender for Endpoint.
Deploy Sensor V3
Architecture and deployment
The documentation now states that eligible servers can use sensor v3.x onboarding without Defender for Endpoint deployment, replacing the previous domain-controller-specific wording.
Uninstall Sensor
Identity protection
The guidance now applies to servers, specifically v3.x sensors deployed without Defender for Endpoint. Administrators must run the offboarding package on the server before deleting its portal entry; deleting the entry alone may leave the sensor active, sending data, and able to reactivate.
Whats New
Identity protection
The documentation expands support for Defender for Identity sensor v3.x activation without Defender for Endpoint to eligible AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later, in addition to eligible domain controllers.
Whats New
Identity protection
The page now links to entries covering malicious or suspicious MFA-device and method registration, organization branding changes by newly created users, and potential Certighost (CVE-2026-54121) AD CS abuse.
Configure sensor settings in Microsoft Defender for Identity - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The page now covers configuration and validation for Defender for Identity v2.x sensors, while directing v3.x users to separate post-activation guidance and shared deployment validation steps.
Configure sensors for AD FS, AD CS, and Microsoft Entra Connect - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The article now applies its procedures and Directory Service Account requirement specifically to Defender for Identity v2.x sensors. Administrators using v3.x sensors are directed to separate deployment and configuration guidance.
Configure Windows event auditing - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The documentation clarifies automatic Windows auditing for v3.x sensors, distinguishes it from automatic sensor activation, updates the listed auditing settings, changes the System event ID from 7045 to 4697, and directs administrators to use Certification Authority for CA auditing.
Deploy Defender Identity
Architecture and deployment
The deployment guidance now links to v2.x server requirements and migration prerequisites. It specifies that in-place migration from sensor v2.x to v3.x is currently available only for eligible domain controllers, not other servers.
Deploy Sensor V3
Architecture and deployment
The sizing tool now applies only to v2.x sensors and is not required for v3.x. Automatic auditing for v3.x configures supported auditing settings, with additional steps specified.
Directory Service Accounts for Microsoft Defender for Identity - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The page now explicitly scopes DSA usage, recommendations, supported options, and selection behavior to Defender for Identity v2.x sensors. It also clarifies domain synchronizer responsibilities and improves wording.
Health Alerts
Identity protection
The guidance now specifies that automatic Windows event auditing applies to v3.x sensors and tells administrators to check the health issue table for the relevant sensor version before remediation. Several alert descriptions were also clarified.
Install Sensor
Identity protection
The guide now specifies that eligible Windows Server 2019 or later domain controllers should follow the v3.x deployment guidance, not the v2.x installer procedures. It also links to the v3.x onboarding package for deployments without Defender for Endpoint.
Manage action accounts in Microsoft Defender for Identity - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The article now explicitly states that action accounts with the required permissions are used for remediation actions and are separate from Directory Service Accounts.
Migrate To Sensor V3
Identity protection
The guide now says to select “Automatically use the sensor's local system account” before migrating because migration does not change this setting automatically. It also instructs admins to verify that the setting remains selected instead of using gMSA for action accounts.
Sensor Settings
Identity protection
The section now refers to removing the legacy Unified Sensor RPC Audit tag and clarifies that removing it does not disable automatic RPC auditing on v3.x sensors.
Standalone sensor prerequisites - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The page now uses clearer deployment wording, fixes the static IP example and links, and separates auditing guidance for AD FS and AD CS servers.
Test connectivity for Microsoft Defender for Identity sensor servers - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The page now separates v2.x and v3.x prerequisites, ports, and connectivity procedures. It adds v3.x guidance stating that the sensor uses Microsoft Defender for Endpoint service endpoints and clarifies expected test results and troubleshooting use.
Troubleshooting Known Issues
Identity protection
The troubleshooting page now points scheduled-task and proxy silent-installation references to the corresponding sections under `deploy/install-sensor`; page metadata was also refreshed.
Validate sensor deployment on domain controllers - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The page now describes validating Defender for Identity sensors through portal data, advanced hunting, and test alerts. It also clarifies that queries should run separately and explains which placeholders to replace.
Whats New
Identity protection
Eligible organizations with an active Defender for Identity workspace receive a 30-day banner before sensor v3.x activation and Windows auditing are enabled by default, including settings currently set to Off. Windows Server 2025 sensor migration support is also documented as resolved.
Group policy security assessments - Microsoft Defender for Identity | Microsoft Learn
Identity protection
The page now documents assessments for excessive local-group privileges granted by GPOs and reversible passwords stored in Group Policy Preferences, including risks, user impact, and remediation steps.
Alerts Xdr
Identity protection
The alert catalog now includes updated descriptions and fields, plus entries for several OAuth, Okta, Kerberos, AD CS, and DPAPI-related alerts. The malicious MFA device registration severity is shown as High.
Deploy Defender Identity
Architecture and deployment
The documented prerequisite for Windows Server 2019 or later changed from the July 2026 cumulative update to the September 2026 cumulative update.
Deploy Sensor V3
Architecture and deployment
The prerequisite changed from the July 2026 to the September 2026 Windows Server cumulative update for sensor version 3.0.10 or later. The guidance also clarifies v2 migration account settings and that migration does not automatically remove workspace DSA or gMSA configuration.
Health Alerts
Identity protection
The health alerts page revises the entry describing a missing or incorrectly applied Unified Sensor RPC Audit configuration tag and its resolution steps.
Migrate To Sensor V3
Identity protection
The prerequisite changed from the July 2026 to the September 2026 or later Windows Server cumulative update. Post-migration guidance now covers manually removing workspace DSA or gMSA configuration and retiring unused gMSA accounts after verifying they have no other users.
Sensor Settings
Identity protection
The documented prerequisite changed from the July 2026 or later cumulative update to the September 2026 or later cumulative update.
Technical Faq
Identity protection
The FAQ now states that offboarding a server from Defender for Endpoint stops Defender for Identity v3.x sensor reporting, including sensors migrated from v2.x, and does not automatically enable identity-only mode.
Whats New
Identity protection
The October announcement adds 19 alerts covering Entra ID, Active Directory, and other identity providers, including Okta, with links to detailed alert information.
Whats New Archive
Identity protection
The archive entry for “Suspicious network connection over Encrypting File System Remote Protocol” now links to the “Suspected PetitPotam coercion attack” section.
Remediation Actions
Identity protection
The Defender for Identity remediation-actions table now lists Security Operator among the roles for the Revoke session action.
Activate Sensor
Identity protection
The documentation now states that automatic sensor activation and automatic Windows auditing require an active license that includes Microsoft Defender for Identity. The domain-controller onboarding heading no longer labels the process as preview.
Configure Windows Event Collection
Identity protection
Automatic sensor activation and automatic Windows auditing now require an active license that includes Microsoft Defender for Identity.
Uninstall Sensor
Identity protection
The page date was updated, and the “Offboard a domain controller without Defender for Endpoint deployment” heading no longer includes “(Preview).”
Whats New
Identity protection
The documentation adds sensor v3.x activation without Defender for Endpoint for eligible Windows Server 2019 or later domain controllers. It applies only to new sensor v3.x deployments, and automatic activation and Windows auditing require an active license that includes Microsoft Defender for Identity.
Activate Sensor
Identity protection
The page now specifies that the method supports new sensor v3.x deployments on eligible domain controllers without sensor v2.x, and that the standalone package activates sensor v3.x on Windows Sense in restricted identity-only mode.
Activate Sensor
Identity protection
Automatic activation applies to eligible Defender for Endpoint-onboarded domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. It activates the existing capability, does not install a separate package, and excludes servers that already have a Defender for Identity sensor.
Configure Windows Event Collection
Identity protection
The documentation now explains that enabling both automatic sensor v3.x activation and automatic Windows auditing configures eligible onboarded servers automatically.
Deploy Sensor V3
Architecture and deployment
Manual activation preview is limited to eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers without an existing sensor. A July 2026 or later Windows Server cumulative update is required before installing or upgrading to sensor version 3.0.8 or later for automatic RPC auditing on domain controllers.
Directory Service Accounts
Identity protection
The documentation now specifies that a directory service account (DSA) is required for the listed features and functionality when using sensor v2.x.
Security Testing Best Practices
Identity protection
The guidance now says sensor v2.x deployments should configure a Directory Service Account for full security coverage. A DSA is required to access the DeletedObjects container and for certain cross-domain and non-domain-controller scenarios.
Troubleshooting Known Issues
Identity protection
The troubleshooting documentation now states that migrating from sensor v2.x to v3.x is unsupported when the Defender for Identity workspace and Defender for Endpoint onboarding for the same server belong to different Microsoft tenants. The server may appear ready, but v3.x activation fails.
Whats New
Identity protection
Eligible new Defender for Endpoint customers may receive automatic Defender for Identity sensor v3.x activation and Windows auditing. Existing Defender for Identity customers will see a portal notice before these settings are enabled; eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers are now covered. A sensor update with security improvements is also listed.
Microsoft Defender for Identity health issues
Identity protection
The health alerts article revision date changed, and the Sensor v3.x RPC Audit Misconfigured entry now includes resolution guidance, including verifying the Unified Sensor RPC Audit configuration.
Account correlation rules in Microsoft Defender for Identity (Preview)
Identity protection
The article was retitled and expanded with guidance for adding, editing, and removing account correlation rules, plus a settings screenshot and clearer license and role prerequisites.
Accounts security posture assessment
Identity protection
The page adds assessments for privileged external or guest accounts, WriteDACL permissions on sensitive groups, and highly privileged service accounts. It also updates anchors and removes “(Preview)” from several existing assessment headings.
Activate the Microsoft Defender for Identity sensor v3.x
Identity protection
The documentation now covers eligible domain controllers and non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers. Activation on the latter servers is in preview and currently requires manual activation; automatic activation and migration aren't supported.
Adjust alert thresholds | Microsoft Defender for Identity
Incidents and response
The page’s publication date and custom metadata were updated. It also includes a warning that reverting to default is irreversible and discards threshold-level changes.
Certificates security posture assessment in Microsoft Defender for Identity
Identity protection
The page now explicitly identifies the ESC11, insecure IIS endpoints/ESC8, and ESC7 assessments, clarifies the AD CS sensor prerequisite, and presents the testing warning as a caution callout.
Cloud identity assessments in Microsoft Defender for Identity
Identity protection
The documentation now describes Microsoft Defender for Identity assessments for Okta, CyberArk Identity, and SailPoint Identity Security Cloud, including connection prerequisites and revised remediation guidance.
Configure a gMSA directory service account for Defender for Identity
Identity protection
The instructions now cover multi-domain and multi-forest deployments, require Enterprise Admin permissions when using a root-level group and single gMSA, and document KDS root-key replication timing and group-scope options.
Configure scoped access for Microsoft Defender for Identity
Identity protection
The article now opens with an Overview section, with minor wording updates. Its publication date and custom metadata were also updated.
Configure sensor settings in Microsoft Defender for Identity
Identity protection
The article title, publication date, authoring metadata, and wording introducing related articles were updated.
Configure sensors for AD FS, AD CS, and Microsoft Entra Connect | Microsoft Defender for Identity
Identity protection
The documentation now states that sensor v3.x can be used in preview on eligible AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. Sensor v2.x procedures remain documented for other applicable servers.
Configure Windows event auditing
Identity protection
The documentation now describes automatic Windows event auditing for sensor v3.x on domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers. Sensor v2.x and opted-out v3.x deployments still require manual configuration. AD CS requires an existing CA audit filter.
Configure Windows event forwarding | Microsoft Defender for Identity
Identity protection
Updated the page metadata, corrected the Step 3 heading level, and clarified wording for selecting a subscription and verifying forwarded events.
Connect CyberArk Identity to Microsoft Defender for Identity (Preview)
Identity protection
The Defender for Identity–CyberArk Identity article updates its prerequisites and RBAC terminology. It now states that users tagging identities as privileged accounts in the Microsoft Defender portal must also have the Privileged Cloud Auditors role.
Connect Okta to Microsoft Defender for Identity (Preview)
Identity protection
The documentation now explicitly instructs administrators to create a custom Okta role named Microsoft Defender for Identity, assign it with the Read-Only Administrator role, and remove Super Admin after confirming both roles are assigned.
Connect SailPoint Identity Security Cloud to Microsoft Defender for Identity (Preview)
Identity protection
The article now describes connecting SailPoint Identity Security Cloud through the Defender portal API connector, updates role-based access terminology, and instructs administrators to create a dedicated SailPoint user before generating a personal access token.
Connect to the Defender for Identity service | Microsoft Defender for Identity
Identity protection
The documentation now explains how to use the deployment executable to configure or clear an authenticated proxy, including the required URL and credentials, and how to test connectivity afterward.
Daily Operational Guide - Microsoft Defender for Identity
Identity protection
The guide’s title and metadata were updated, and its incident-triage guidance was streamlined. It continues to recommend reviewing the Global and Sensor Health Issues tabs and setting up service-issue email notifications.
Deploy Microsoft Defender for Identity sensors
Architecture and deployment
The deployment article now states that VPN integration and syslog notifications require the v2.x sensor on applicable domain controllers; these features aren't supported by v3.x.
Deploy the Defender for Identity sensor v3.x
Architecture and deployment
The documentation now covers v3.x sensors on non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers. Activation there is in preview, requires manual activation, and does not support automatic activation or migration.
Detection exclusions in Microsoft Defender XDR
Identity protection
The documentation now states that existing exclusions do not automatically carry over when detections move to the Microsoft Defender XDR detection engine. Once moved, those exclusions stop applying and previously suppressed alerts can reappear.
Entity tags in Microsoft Defender for Identity
Identity protection
The article now uses Microsoft Defender terminology, clarifies sensitive, Exchange server, and honeytoken tagging guidance, and notes that Entra ID and SailPoint Identity Security Cloud roles are used for sensitive entity tagging.
Identity Security dashboard in Microsoft Defender for Identity (Preview)
Identity protection
The article date and metadata were updated, an explicit dashboard heading was added, and the risky lateral movement path table entry was synchronized.
Install the sensor v2.x | Microsoft Defender for Identity
Identity protection
The installation page now clarifies sensor package download steps, formats endpoint lists, and adds tables and examples for silent and proxy installations. It also updates the post-installation next steps.
Integrate Microsoft And Pam Services
Identity protection
The page now refers to Microsoft Defender instead of Microsoft Defender XDR for automatic PAM-managed identity tagging and password resets for high-risk privileged accounts.
Integrate VPN with Microsoft Defender for Identity
Identity protection
The guide now requires at least one connected, healthy Defender for Identity sensor version 2.x to receive RADIUS accounting events. It also reiterates that FIPS environments aren't supported and updates Microsoft Defender terminology and navigation.
Investigate alerts in Microsoft Defender for Identity
Identity protection
The article now refers to the alert details side pane, identifies Defender for Identity as the capability tuned by alert classification, and clarifies the tabs and Related Entities data in exported Excel alert reports. The metadata and date were also updated.
Investigate Domain
Identity protection
Documentation now describes a Security recommendations (Preview) view for scoped users on domain pages. Users can access it from the Identity dashboard and review recommendation names, statuses, update times, details, and remediation guidance.
Listen for SIEM events | Microsoft Defender for Identity
Identity protection
The page now clarifies supported SIEM event types, required message syntax, and examples for RSA Security Analytics, MicroFocus ArcSight, Splunk, and QRadar, including required CEF keys and timestamp guidance.
Manage action accounts in Microsoft Defender for Identity
Identity protection
The article title, wording, and screenshot descriptions were updated. It now explicitly introduces configuring a dedicated gMSA action account and clarifies the security rationale for separating action and Directory Service accounts.
Manage and Update Sensors
Identity protection
The documentation now includes domain controllers running AD FS, AD CS, or Microsoft Entra Connect, and states that v3.x sensors update through Windows Update. It also clarifies that the per-sensor Delayed update option applies only to v2.x sensors and expands migration-state descriptions.
Manage related identities and accounts in Microsoft Defender for Identity
Identity protection
The article now explains manual account linking and automatic correlation through account correlation rules, including the Microsoft Defender portal path and a link to the rule-management procedure.
Manage reports | Microsoft Defender for Identity
Identity protection
The Defender for Identity reports article updates its metadata and clarifies that administrators should repeat the linked report-scheduling steps to change scheduled times or recipients.
Microsoft 365 Security Center Mdi
Identity protection
The page now refers to Microsoft Defender instead of Microsoft Defender XDR and updates the alert-tuning description to say it improves threat detection coverage throughout your system.
Microsoft Defender for Identity classic security alerts
Identity protection
The alerts documentation now explains that some vulnerability alerts may still trigger after the relevant security update. When all affected systems are patched, applicable alerts have Low severity and may show patch status in the evidence. Documentation for Group Policy Tampering was also added.
Microsoft Defender for Identity health issues
Identity protection
The article adds context for Configuration-container auditing, clarifies the no-traffic alert wording, and makes minor metadata and RPC audit text updates.
Microsoft Defender for Identity Notifications
Identity protection
The page now uses Microsoft Defender naming, refreshed navigation wording, and updated SIEM guidance that instructs automation authors to use the permanent externalId field. The event-collection link text was also updated, and the TLS certificate tip was removed.
Microsoft Defender for Identity Overview
Identity protection
The page date changed to July 23, 2026, and wording was corrected and clarified, including “non-human” and examples of high-value targets.
Microsoft Defender for Identity Security Posture Assessments
Identity protection
The page now describes six assessment categories, clarifies AD CS and Microsoft Entra Connect sensor prerequisites, and updates formatting, images, and related-content navigation.
Microsoft Defender for Identity sensor v2.x prerequisites | Microsoft Defender for Identity
Identity protection
The prerequisites page now recommends sensor v3.x for Windows Server 2019 or later and clarifies that CPU, memory, and disk requirements are additional to resources used by the operating system and domain controller services.
Microsoft Defender for Identity XDR security alerts
Identity protection
The page adds entries for AADInternals private-key extraction, malicious or suspicious MFA-method registration, and updates several existing alert descriptions. It removes entries for Honeytoken Activity, stolen session-cookie replay, suspicious Entra device join or registration, and adds guidance on Classic versus Defender-format alerts and alert tuning.
Migrate from Advanced Threat Analytics
Identity protection
The article now uses a shared ATA end-of-life notice, adds a Defender for Identity prerequisites link, identifies the final ATA release, and updates product names and links to Microsoft Defender.
Migrate To Sensor V3
Identity protection
Migration is unsupported on non-domain-controller servers running AD FS, AD CS, or Microsoft Entra Connect, while domain controllers running these roles are included. RPC auditing is automatic from sensor 3.0.8, and v3.x updates through Windows Update without the v2.x delayed-update option. Readiness reasons now appear in the Sensors page tooltip.
Monitored Activities
Identity protection
The monitored activities page now refers to Microsoft Defender’s Advanced Hunting page instead of Microsoft Defender XDR’s Advanced Hunting page; the link destination is unchanged.
Monthly Operational Guide - Microsoft Defender for Identity
Identity protection
Updated the page title capitalization, publication date, custom metadata, and Persona formatting. An incomplete “For more information, see:” line was removed.
Password protection in Microsoft Defender
Identity protection
The page title and heading were updated to remove the “Preview” label. The documentation date and custom metadata were also updated.
Plan capacity for deployment | Microsoft Defender for Identity
Architecture and deployment
The article now more clearly describes using the sizing tool, reviewing prerequisites, following the tool’s steps, and using manual sizing guidance when the tool is unavailable.
Quarterly or Ad-hoc Operational Guide - Microsoft Defender for Identity
Identity protection
The guide’s title, description, date, heading, and authoring metadata were updated. The Test-MDIConfiguration guidance was shortened while retaining its purpose and warning about incorrect audit policies.
Remediate Hybrid Security Posture Assessments in Defender for Identity
Identity protection
The hybrid security posture assessments page now documents the assessment for privileged SaaS accounts outside identity-provider control, including its impact and implementation steps. Other edits update headings, formatting, metadata, and links.
Remediation Actions for Compromised Users in Microsoft Defender for Identity
Identity protection
The article now explains that remediation actions depend on the connector managing an identity and includes connected apps through Microsoft Defender for Cloud Apps. Enable is listed for CyberArk Identity, SailPoint Identity Security Cloud, and Salesforce, while Force password change is listed for Microsoft Entra ID as well as Active Directory.
Role Groups
Identity protection
The role-groups documentation was updated for permissions to perform Defender for Identity response actions, including the custom Response (manage) role and listed Microsoft Entra roles.
Security alerts
Identity protection
The page now explains that sensor versions can contribute to either classic or Defender-format alerts. During the transition, detections may appear in both lists with different names; Detection source identifies the format. Tuning and exclusions are format-specific.
Security Testing Best Practices
Identity protection
The guidance changes references from Microsoft Defender XDR to Microsoft Defender and updates the Security operations overview link.
Start your Defender for Identity deployment security assessment
Identity protection
The page now states that the assessment identifies servers without a Defender for Identity sensor and helps you unde… It also updates the metadata date and changes the advanced hunting link text from Microsoft Defender XDR to Microsoft Defender.
Test connectivity for Microsoft Defender for Identity sensor servers
Identity protection
The page title was clarified, the publication date and metadata were updated, and the introduction now links directly to connectivity test procedures.
Troubleshoot the Defender for Identity sensor using logs
Troubleshooting
The page now uses clearer descriptions of sensor and deployment logs, including their locations, archived-file handling, and troubleshooting use cases.
Troubleshooting known issues
Identity protection
The article now identifies two affected alerts involving the ADFS and Configuration containers, clarifies that the issue affects sensor v3.x environments, and adds a Microsoft Defender portal resolution path.
Uninstall the Sensor
Identity protection
The page now prominently warns that deleting the sensor removes the v3.x sensor software and stops monitoring on the domain controller. Steps, images, headings, and numbering were also reformatted.
Validate sensor deployment on domain controllers
Identity protection
The page metadata was updated, and the testing example now explicitly refers to verifying that assessments appear as expected.
View and manage Microsoft Defender for Identity security alerts
Identity protection
The article now provides clearer guidance for viewing, filtering, investigating, classifying, and managing alerts in the Microsoft Defender portal, with updated headings, navigation links, terminology, and alert-layout descriptions.
View Defender for Identity workspace details on the About page in Microsoft Defender XDR
Identity protection
The article title and wording were refreshed, and it now explains that workspace details and the workspace name are available on the About page in Microsoft Defender. The workspace name is used for proxy or firewall configuration.
Weekly Operational Guide - Microsoft Defender for Identity
Identity protection
The page title, publication date, and custom metadata were updated. Wording about configuring and running custom detection rules was streamlined, including how they trigger alerts and response actions.
What's new | Microsoft Defender for Identity
Identity protection
The August 2026 documentation describes automatic auditing for eligible AD FS, AD CS, and Microsoft Entra Connect servers running sensor v3.x, sensor version 2.255.19295.47272, Windows Server 2025 domain controller migration to sensor v3.x, and migration-readiness reasons on the Sensors page.
Service Account Discovery
Identity protection
The documentation explains that custom classification rules can identify service accounts Defender for Identity does not detect automatically, such as accounts using an `srv` prefix.
Migrate from Advanced Threat Analytics (ATA) to Microsoft Defender for Identity
Identity protection
Updated Microsoft Defender documentation in defender-for-identity/migrate-from-ata-overview.md.
Deploy Microsoft Defender for Identity sensors
Architecture and deployment
Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-defender-identity.md.
Deploy the Defender for Identity sensor v3.x
Architecture and deployment
Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-sensor-v3.md.
Manage and update sensors
Identity protection
Updated Microsoft Defender documentation in defender-for-identity/sensor-settings.md.
Microsoft Defender for Identity health issues
Identity protection
Updated Microsoft Defender documentation in defender-for-identity/health-alerts.md.
Migrate To Sensor V3
Identity protection
Updated Microsoft Defender documentation in defender-for-identity/deploy/migrate-to-sensor-v3.md.
What's new | Microsoft Defender for Identity
Identity protection
Updated Microsoft Defender documentation in defender-for-identity/whats-new.md.
Deploy Sensor V3
Architecture and deployment
Updated Microsoft Defender documentation in defender-for-identity/deploy/deploy-sensor-v3.md.