Microsoft Defender for Identity
Identity protectionSecurity Testing Best Practices
In brief
The guidance now says sensor v2.x deployments should configure a Directory Service Account for full security coverage. A DSA is required to access the DeletedObjects container and for certain cross-domain and non-domain-controller scenarios.
What Defender admins need to know
Review sensor deployments and configure a DSA where required to maintain full coverage and access.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Consider integrating with Microsoft Defender | Defender for Identity provides alerting on identity-based threats. Integrating with Microsoft Defender lets you correlate these alerts with other signals for a more comprehensive view of threats and potential solutions.Microsoft Defender is a unified pre-breach and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response in endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. | Microsoft Defender. |
| Check Windows event collection configuration | Optimal event collection is essential for Defender for Identity to analyze and detect threats effectively. Check your configuration before running any tests. | - Configure Windows event collection for domain controllers - Configure Windows event collection for AD CS - Configure Windows event collection for AD FS - Configure Windows event collection for Microsoft Entra Connect - Use PowerShell to check your configuration |
| Check that NNR is configured correctly | NNR is a critical component of Defender for Identity. Defender for Identity uses NNR to correlate between raw activities containing IP addresses and the computers involved in each activity. Defender for Identity profiles entities, including computers, and generates security alerts for suspicious activities. It's important for NNR to be configured correctly for a successful deployment and to help detect advanced threats. | Configure Network Name Resolution (NNR) for Microsoft Defender for Identity |
| Check that you havedirectory access requirements for your sensor version | For sensor v2.x deployments, configure a Directory Service accountAccount (DSA) | While a DSA is optional in some scenarios, we recommend that you configure a DSA for Defender for Identity for full security protection. When you have a DSA configured: - The DSA connects to the domain controller at startup. - The DSA queries the domain controller for data on entities seen in network traffic, monitored events, and monitored Event Tracing for Windows (ETW) activities.coverage. A DSA is required for the following features and functionality: - When working with a sensor installed on an AD FS / AD CS server - Toto access the DeletedObjects container to collectand for specific cross-domain and non-domain-controller scenarios.The sensor v3.x uses LocalSystem for Active Directory interactions. On domain controllers, the sensor v3.x collects information about deleted users and computers - For domain and trust mapping, which occurs at sensor startup, and again every 10 minutes. - To query another domain via LDAP for details, when detecting activities from entities in those other domains.without a DSA or additional DeletedObjects container permission configuration. | Directory Service Accounts for Microsoft Defender for Identity |
| Check the alert learning periods | Alerts rely on learning periods to build a profile of patterns and then distinguish between legitimate and suspicious activities. Each alert incorporates specific conditions within the detection logic, such as thresholds and filtering of popular activities. Check these alerts to make sure that they meet the required learning periods. | Alerts overview |
| Check the alert thresholds | The threshold level of an alert influences the number of alerts you receive for that trigger. The default threshold for all alerts is High. You can customize the threshold level for individual alerts to High, Medium, or Low. Lowering the threshold of an alert increases the number of alerts generated by Microsoft Defender for Identity. Alerts that are triggered when threshold is set to Medium or Low contain text that indicates the alert threshold.When you enable the Recommended Test Mode button, all alert threshold levels are set to Low. When the threshold is low, you get more alerts, including some related to legitimate traffic and activities. This setting can be useful to get more data into a nonproduction environment that doesn't have enough entity historical data or profiles.Lowering the threshold to Low also leads to more false positives and isn't recommended for production environments. | Adjust alert threshold settings or enable recommended test mode |
| Review the Secure Score recommendations for Defender for Identity | Following Secure Score recommendations helps improve your security posture and enhances the effectiveness of Defender for Identity in detecting threats. | Microsoft Secure Score |
@@ -13,9 +13,11 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Learn about best practices for Offensive Security Testing for Microsoft Defender for Identity.-ms.date: 2026-01-26T00:00:00.0000000Z+ms.date: 2026-09-29T00:00:00.0000000Z ms.topic: article ms.reviewer: martin77s+ms.custom: msecd-doc-authoring-1015+ai-usage: ai-assisted locale: en-us document_id: 14e58f10-a76f-dffc-302b-7812bf222291 document_version_independent_id: 14e58f10-a76f-dffc-302b-7812bf222291@@ -34,11 +36,9 @@ source_path: defender-for-identity/security-testing-best-practices.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/5711eaa5-435f-4c40-8d89-924ef7945eec - https://authoring-docs-microsoft.poolparty.biz/devrel/b1cfdec6-b0c3-4209-818c-736879856e0e-- https://authoring-docs-microsoft.poolparty.biz/devrel/bcbcbad5-4208-4783-8035-8481272c98b8 spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/8ee4d551-d6c4-4e91-986e-0f1afd52559f - https://authoring-docs-microsoft.poolparty.biz/devrel/2d0723c1-cf38-4c30-ab3d-5df787b33270-- https://authoring-docs-microsoft.poolparty.biz/devrel/43b2e5aa-8a6d-4de2-a252-692232e5edc8 platformId: 424fd10d-357e-e0f9-1900-87c1474ef7ad --- @@ -79,7 +79,7 @@ Here are some common issues that can affect your offensive security testing: | Consider integrating with Microsoft Defender | Defender for Identity provides alerting on identity-based threats. Integrating with Microsoft Defender lets you correlate these alerts with other signals for a more comprehensive view of threats and potential solutions.Microsoft Defender is a unified pre-breach and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response in endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. | [Microsoft Defender](/en-us/defender-xdr/microsoft-365-defender-train-security-staff). |
| Check Windows event collection configuration | Optimal event collection is essential for Defender for Identity to analyze and detect threats effectively. Check your configuration before running any tests. | - [Configure Windows event collection for domain controllers](deploy/configure-windows-event-collection) - [Configure Windows event collection for AD CS](deploy/configure-windows-event-collection#configure-auditing-on-an-ad-cs-server) - [Configure Windows event collection for AD FS](deploy/configure-windows-event-collection#configure-auditing-on-an-ad-fs-server) - [Configure Windows event collection for Microsoft Entra Connect](deploy/configure-windows-event-collection#configure-auditing-on-microsoft-entra-connect) - [Use PowerShell to check your configuration](https://www.powershellgallery.com/packages/DefenderForIdentity/1.0.0.4) |
| Check that NNR is configured correctly | NNR is a critical component of Defender for Identity. Defender for Identity uses NNR to correlate between raw activities containing IP addresses and the computers involved in each activity. Defender for Identity profiles entities, including computers, and generates security alerts for suspicious activities. It's important for NNR to be configured correctly for a successful deployment and to help detect advanced threats. | [Configure Network Name Resolution (NNR) for Microsoft Defender for Identity](nnr-policy) |
-| Check that you have a Directory Service account (DSA) | While a DSA is optional in some scenarios, we recommend that you configure a DSA for Defender for Identity for full security protection. When you have a DSA configured: - The DSA connects to the domain controller at startup. - The DSA queries the domain controller for data on entities seen in network traffic, monitored events, and monitored Event Tracing for Windows (ETW) activities.A DSA is required for the following features and functionality: - When working with a sensor installed on an AD FS / AD CS server - To access the DeletedObjects container to collect information about deleted users and computers - For domain and trust mapping, which occurs at sensor startup, and again every 10 minutes. - To query another domain via LDAP for details, when detecting activities from entities in those other domains. | [Directory Service Accounts for Microsoft Defender for Identity](deploy/directory-service-accounts) |
+| Check directory access requirements for your sensor version | For sensor v2.x deployments, configure a Directory Service Account (DSA) for full security coverage. A DSA is required to access the *DeletedObjects* container and for specific cross-domain and non-domain-controller scenarios.The sensor v3.x uses LocalSystem for Active Directory interactions. On domain controllers, the sensor v3.x collects information about deleted users and computers without a DSA or additional *DeletedObjects* container permission configuration. | [Directory Service Accounts for Microsoft Defender for Identity](deploy/directory-service-accounts) |
| Check the alert learning periods | Alerts rely on learning periods to build a profile of patterns and then distinguish between legitimate and suspicious activities. Each alert incorporates specific conditions within the detection logic, such as thresholds and filtering of popular activities. Check these alerts to make sure that they meet the required learning periods. | [Alerts overview](alerts-overview) |
| Check the alert thresholds | The threshold level of an alert influences the number of alerts you receive for that trigger. The default threshold for all alerts is **High**. You can customize the threshold level for individual alerts to **High**, **Medium**, or **Low**. Lowering the threshold of an alert increases the number of alerts generated by Microsoft Defender for Identity. Alerts that are triggered when threshold is set to **Medium** or **Low** contain text that indicates the alert threshold.When you enable the **Recommended Test Mode** button, all alert threshold levels are set to **Low**. When the threshold is low, you get more alerts, including some related to legitimate traffic and activities. This setting can be useful to get more data into a nonproduction environment that doesn't have enough entity historical data or profiles.Lowering the threshold to **Low** also leads to more false positives and isn't recommended for production environments. | [Adjust alert threshold settings or enable recommended test mode](advanced-settings#adjust-alert-thresholds) |
| Review the Secure Score recommendations for Defender for Identity | Following Secure Score recommendations helps improve your security posture and enhances the effectiveness of Defender for Identity in detecting threats. | [Microsoft Secure Score](https://security.microsoft.com/securescore?viewid=actions) |