Microsoft Defender for Identity
Architecture and deploymentDeploy Sensor V3
In brief
Manual activation preview is limited to eligible non-domain-controller AD FS, AD CS, and Microsoft Entra Connect servers without an existing sensor. A July 2026 or later Windows Server cumulative update is required before installing or upgrading to sensor version 3.0.8 or later for automatic RPC auditing on domain controllers.
What Defender admins need to know
Install the required cumulative update before deploying or upgrading the sensor, and verify that preview servers meet the eligibility conditions.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Note
Activating theManual activation of Defender for Identity sensor v3.x on eligible AD FS, AD CS, and Microsoft Entra Connect servers is in preview. This preview applies only to servers that aren't domain controllers is in preview. Manual activation and automatic Windows event auditing are supported. Automatic activation and migration arendon't currently supportedhave an existing Defender for these servers.Identity sensor.
Important
Configure RPC auditing
Starting withInstall the July 2026 or later Windows Server cumulative update before you install or upgrade to Defender for Identity sensor release (sensor version 3.0.8),8 or later. Starting with sensor version 3.0.8, RPC auditing is enabled automatically enabled on domain controllers whencontrollers, so you upgrade the sensor to the latest version. You no longer need to apply a tag manually to enablean RPC auditing, and theconfiguration tag. The related health alert clears shortly after the upgrade.
Note
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.-ms.date: 2026-09-09T00:00:00.0000000Z+ms.date: 2026-09-23T00:00:00.0000000Z ms.topic: how-to ms.custom: msecd-doc-authoring-1016 ms.reviewer: rlitinsky@@ -79,7 +79,7 @@ The v3.x sensor supports domain controllers. It also supports servers that aren'
Note
-Activating the Defender for Identity sensor v3.x on AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers is in preview. Manual activation and automatic Windows event auditing are supported. Automatic activation and migration aren't currently supported for these servers.
+Manual activation of Defender for Identity sensor v3.x on eligible AD FS, AD CS, and Microsoft Entra Connect servers is in preview. This preview applies only to servers that aren't domain controllers and don't have an existing Defender for Identity sensor.
Important
@@ -172,7 +172,7 @@ If automatic auditing isn't available or you opted out, [configure auditing manu
### Configure RPC auditing
-Starting with the July 2026 Defender for Identity sensor release (sensor version 3.0.8), RPC auditing is automatically enabled on domain controllers when you upgrade the sensor to the latest version. You no longer need to apply a tag manually to enable RPC auditing, and the related health alert clears shortly after the upgrade.
+Install the July 2026 or later Windows Server cumulative update before you install or upgrade to Defender for Identity sensor version 3.0.8 or later. Starting with sensor version 3.0.8, RPC auditing is enabled automatically on domain controllers, so you no longer need to apply an RPC configuration tag. The related health alert clears shortly after the upgrade.
Note