Microsoft Defender for Identity
Identity protectionTechnical Faq
In brief
The FAQ now states that offboarding a server from Defender for Endpoint stops Defender for Identity v3.x sensor reporting, including sensors migrated from v2.x, and does not automatically enable identity-only mode.
What Defender admins need to know
Administrators needing Defender for Identity without full Defender for Endpoint protection should use the documented onboarding method that excludes Defender for Endpoint deployment.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
We recommend that you have a Defender for Identity sensor or standalone sensor for each one of your domain controllers. For more information, see Defender for Identity sensor sizing.
Will my Defender for Identity v3.x sensor continue working if I offboard the server from Defender for Endpoint?
No. Offboarding a server from Defender for Endpoint stops Defender for Identity v3.x sensor reporting, including sensors migrated from v2.x. Offboarding doesn't automatically switch the server to identity-only mode.
To deploy sensor v3.x without full Defender for Endpoint protection, use onboarding without Defender for Endpoint deployment.
Does Defender for Identity work with encrypted traffic?
While network protocols with encrypted traffic, such as AtSvc and WMI, aren't decrypted, sensors do still analyze the traffic.
@@ -141,6 +141,12 @@ In addition, Microsoft conducts background verification checks on certain operat
We recommend that you have a Defender for Identity sensor or standalone sensor for each one of your domain controllers. For more information, see [Defender for Identity sensor sizing](capacity-planning#sizing).
+### Will my Defender for Identity v3.x sensor continue working if I offboard the server from Defender for Endpoint?
+
+No. Offboarding a server from Defender for Endpoint stops Defender for Identity v3.x sensor reporting, including sensors migrated from v2.x. Offboarding doesn't automatically switch the server to identity-only mode.
+
+To deploy sensor v3.x without full Defender for Endpoint protection, use [onboarding without Defender for Endpoint deployment](deploy/activate-sensor#onboard-a-domain-controller-without-defender-for-endpoint-deployment).
+
### Does Defender for Identity work with encrypted traffic?
While network protocols with encrypted traffic, such as AtSvc and WMI, aren't decrypted, sensors do still analyze the traffic.