Microsoft Defender for Identity
Identity protectionConfigure sensors for AD FS, AD CS, and Microsoft Entra Connect - Microsoft Defender for Identity | Microsoft Learn
In brief
The article now applies its procedures and Directory Service Account requirement specifically to Defender for Identity v2.x sensors. Administrators using v3.x sensors are directed to separate deployment and configuration guidance.
What Defender admins need to know
Check the sensor version before following this article; use the linked v3.x guidance when applicable.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Configure sensors for AD FS, AD CS, and Microsoft Entra Connect - Microsoft Defender for Identity | Microsoft Learn
Use these procedures for Defender for Identity v2.x sensors. For v3.x sensors, follow v3.x deployment and configuration.
Install and configure sensors on non-domain-controller servers
Install and configure the Defender for Identity sensor v2.x on Active Directory Federation Services (AD FS), Active Directory Certificate Services (AD CS), and Microsoft Entra Connect servers that aren't domain controllers. Before you begin, make sure you've completed the sensor installation prerequisites.
Prerequisites
For general sensor prerequisites, see the Microsoft Defender for Identity prerequisites article. The following additional requirements apply to v2.x sensors on AD FS, AD CS, and Microsoft Entra Connect servers.
A v2.x sensor installed on an AD FS, AD CS, or Microsoft Entra Connect server can't use the local service account to connect to the domain. Instead, you need to configure a Directory Service Account.
In addition, the Defender for Identity sensor for AD CS supports only AD CS servers with Certification Authority Role Service.
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Learn how to configure Microsoft Defender for Identity on Active Directory Federation Services (AD FS), Active Directory Certificate Services (AD CS), and Microsoft Entra Connect servers.-ms.date: 2026-08-31T00:00:00.0000000Z+ms.date: 2026-10-18T00:00:00.0000000Z ms.topic: how-to ms.reviewer: rlitinsky ai-usage: ai-assisted@@ -44,6 +44,8 @@ platformId: 2436d91c-852c-5e67-0682-7e57e07838f4 # Configure sensors for AD FS, AD CS, and Microsoft Entra Connect - Microsoft Defender for Identity | Microsoft Learn +Use these procedures for Defender for Identity v2.x sensors. For v3.x sensors, follow [v3.x deployment and configuration](deploy-sensor-v3).
+
## Install and configure sensors on non-domain-controller servers
Install and configure the Defender for Identity sensor v2.x on Active Directory Federation Services (AD FS), Active Directory Certificate Services (AD CS), and Microsoft Entra Connect servers that aren't domain controllers. Before you begin, make sure you've completed the [sensor installation prerequisites](prerequisites-sensor-version-2).
@@ -60,9 +62,9 @@ These considerations apply:
## Prerequisites
-For general sensor prerequisites, see the [Microsoft Defender for Identity prerequisites](prerequisites-sensor-version-2) article. The following additional requirements apply to AD FS, AD CS, and Microsoft Entra Connect servers.
+For general sensor prerequisites, see the [Microsoft Defender for Identity prerequisites](prerequisites-sensor-version-2) article. The following additional requirements apply to v2.x sensors on AD FS, AD CS, and Microsoft Entra Connect servers.
-A sensor installed on an AD FS, AD CS, or Microsoft Entra Connect server can't use the local service account to connect to the domain. Instead, you need to configure a [Directory Service Account](directory-service-accounts).
+A v2.x sensor installed on an AD FS, AD CS, or Microsoft Entra Connect server can't use the local service account to connect to the domain. Instead, you need to configure a [Directory Service Account](directory-service-accounts).
In addition, the Defender for Identity sensor for AD CS supports only AD CS servers with Certification Authority Role Service.