Microsoft Defender for Identity
Architecture and deploymentDeploy Sensor V3
In brief
The prerequisite changed from the July 2026 to the September 2026 Windows Server cumulative update for sensor version 3.0.10 or later. The guidance also clarifies v2 migration account settings and that migration does not automatically remove workspace DSA or gMSA configuration.
What Defender admins need to know
Install the September 2026 cumulative update before installing or upgrading the sensor, and select the local system account option before migrating from sensor v2.x.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Is onboarded to Defender for Endpoint. The Microsoft Defender Antivirus component can be in either active or passive mode. For eligible domain controllers, you can instead use sensor v3.x onboarding without Defender for Endpoint deployment.
- Doesn't have a Defender for Identity sensor v2.x already deployed.
- Runs Windows Server 2019 or later.
- Has the Windows Server
JulySeptember 2026 or later cumulative updateinstalled.installed (Defender for Identity sensor version 3.0.10 or later).
Use the September 2026 cumulative update for your Windows Server version, or a later cumulative update:
| Windows Server version | September 2026 cumulative update |
|---|---|
| Windows Server 2019 | KB5122876 |
| Windows Server 2022 | KB5122882 |
| Windows Server 2025 | KB5122871 |
Supported server types
The v3.x sensor uses the local system identity of the server for both purposes. It doesn't use Directory Service Accounts (DSA) or group Managed Service Accounts (gMSA). LocalSystem is the only supported identity for v3.x.
If you'reBefore migrating from sensor v2.x and previously had a gMSA configured for action accounts,x, select Automatically use the sensor's local system account in the Microsoft Defender portal (Settings > Identities > Microsoft Defender for Identity > Manage action accounts). Migration doesn't change this action account setting automatically. The v3.x sensors don't use gMSA accounts configured for v2.x sensors.
Important
If your workspace still has a Directory Service Account (DSA) or group Managed Service Account (gMSA) configured because v2.x sensors on AD FS, AD CS, or Entra Connect servers still require it, DSA and gMSA credentials continue to be validated on all sensors in the workspace, including v3.x sensors. If DSA or gMSA credential validation fails, the Directory services user credentials are incorrect health alert appears. Workspace-level validation of DSA and gMSA credentials on all sensors is by design. Defender for Identity validates DSA and gMSA credentials at the workspace level for all sensors as long as those accounts exist, regardless of whether individual sensors use them for auditing or response actions.
Defender for Identity v3.x sensors ignore the DSA and gMSA for auditing and response actions, but they're still included in workspace-level credential validation. Migration doesn't remove the workspace-level DSA or gMSA configuration automatically. To stop receiving this health alert on v3.x sensors, manually remove the workspace-level DSA or gMSAconfiguration after all sensors are fully migrated to v3.x and no v2.x sensors require it. Removing the workspace configuration doesn't delete the gMSA account in Active Directory.
Test your prerequisites
Configure RPC auditing
Install the JulySeptember 2026 or later Windows Server cumulative update before you install or upgrade to Defender for Identity sensor version 3.0.810 or later. Starting with sensor version 3.0.8, RPC auditing is enabled automatically on domain controllers, so you no longer need to apply an RPC configuration tag. The related health alert clears shortly after the upgrade.
Note
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.-ms.date: 2026-09-23T00:00:00.0000000Z+ms.date: 2026-10-14T00:00:00.0000000Z ms.topic: how-to ms.custom: msecd-doc-authoring-1016 ms.reviewer: rlitinsky@@ -35,12 +35,12 @@ item_type: Content source_path: defender-for-identity/deploy/deploy-sensor-v3.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/b1cfdec6-b0c3-4209-818c-736879856e0e+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/fc3f72c2-fb6f-4cea-95ee-b444e52254ee - https://authoring-docs-microsoft.poolparty.biz/devrel/1dd701e0-441f-4b0a-9806-aa47decc4e35-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/57eae307-c3a1-4cac-b645-1a899934bac8 spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/2d0723c1-cf38-4c30-ab3d-5df787b33270+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/f12cf087-582d-48ac-a085-0c19adf1e391 - https://authoring-docs-microsoft.poolparty.biz/devrel/0a2fc935-5977-4aa6-9f55-0be03bd2acb8-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/ee561821-1ac7-45a8-9409-6ba5eb7a5b97 platformId: 1d6f7caa-98cc-b973-667d-5b1673c51a02 --- @@ -67,7 +67,15 @@ Make sure that the server on which you're activating the sensor: - Is onboarded to Defender for Endpoint. The Microsoft Defender Antivirus component can be in either active or passive mode. For eligible domain controllers, you can instead use [sensor v3.x onboarding without Defender for Endpoint deployment](activate-sensor#onboard-the-domain-controller-preview).
- Doesn't have a Defender for Identity sensor v2.x already deployed.
- Runs Windows Server 2019 or later.
-- Has the Windows Server July 2026 or later cumulative update installed.
+- Has the Windows Server September 2026 or later cumulative update installed (Defender for Identity sensor version 3.0.10 or later).
+
+Use the September 2026 cumulative update for your Windows Server version, or a later cumulative update:
+
+| Windows Server version | September 2026 cumulative update |
+| --- | --- |
+| Windows Server 2019 | [KB5122876](https://support.microsoft.com/en-us/servicing/os/windows-10/2026/09/kb5122876-windows-10-1809-security-update) |
+| Windows Server 2022 | [KB5122882](https://support.microsoft.com/en-us/servicing/os/windows-server/2026/09/kb5122882-windows-server-2022-security-update) |
+| Windows Server 2025 | [KB5122871](https://support.microsoft.com/en-us/servicing/os/windows-server/2026/09/kb5122871-windows-server-2025-security-update) |
#### Supported server types
@@ -138,7 +146,7 @@ The Defender for Identity sensor interacts with Active Directory in two ways:
The v3.x sensor uses the local system identity of the server for both purposes. It doesn't use Directory Service Accounts (DSA) or group Managed Service Accounts (gMSA). LocalSystem is the only supported identity for v3.x.
-If you're migrating from sensor v2.x and previously had a gMSA configured for [action accounts](manage-action-accounts), select **Automatically use the sensor's local system account** in the Microsoft Defender portal (**Settings** > **Identities** > **Microsoft Defender for Identity** > **Manage action accounts**). The v3.x sensors don't use gMSA accounts configured for v2.x sensors.
+Before migrating from sensor v2.x, select **Automatically use the sensor's local system account** in the Microsoft Defender portal (**Settings** > **Identities** > **Microsoft Defender for Identity** > **Manage action accounts**). Migration doesn't change this [action account setting](manage-action-accounts) automatically. The v3.x sensors don't use gMSA accounts configured for v2.x sensors.
Important
@@ -148,7 +156,7 @@ If any of your sensors are v3.x, select **Automatically use the sensor's local s
If your workspace still has a Directory Service Account (DSA) or group Managed Service Account (gMSA) configured because v2.x sensors on AD FS, AD CS, or Entra Connect servers still require it, DSA and gMSA credentials continue to be validated on all sensors in the workspace, including v3.x sensors. If DSA or gMSA credential validation fails, the **Directory services user credentials are incorrect** health alert appears. Workspace-level validation of DSA and gMSA credentials on all sensors is by design. Defender for Identity validates DSA and gMSA credentials at the workspace level for all sensors as long as those accounts exist, regardless of whether individual sensors use them for auditing or response actions.
-Defender for Identity v3.x sensors ignore the DSA and gMSA for auditing and response actions, but they're still included in workspace-level credential validation. To stop receiving this health alert on v3.x sensors, remove the workspace-level DSA or gMSA after all sensors are fully migrated to v3.x and no v2.x sensors require it.
+Defender for Identity v3.x sensors ignore the DSA and gMSA for auditing and response actions, but they're still included in workspace-level credential validation. Migration doesn't remove the workspace-level DSA or gMSA configuration automatically. To stop receiving this health alert on v3.x sensors, manually remove the configuration after all sensors are fully migrated to v3.x and no v2.x sensors require it. Removing the workspace configuration doesn't delete the gMSA account in Active Directory.
### Test your prerequisites
@@ -172,7 +180,7 @@ If automatic auditing isn't available or you opted out, [configure auditing manu
### Configure RPC auditing
-Install the July 2026 or later Windows Server cumulative update before you install or upgrade to Defender for Identity sensor version 3.0.8 or later. Starting with sensor version 3.0.8, RPC auditing is enabled automatically on domain controllers, so you no longer need to apply an RPC configuration tag. The related health alert clears shortly after the upgrade.
+Install the September 2026 or later Windows Server cumulative update before you install or upgrade to Defender for Identity sensor version 3.0.10 or later. Starting with sensor version 3.0.8, RPC auditing is enabled automatically on domain controllers, so you no longer need to apply an RPC configuration tag. The related health alert clears shortly after the upgrade.
Note