Microsoft Defender for Identity
Architecture and deploymentDeploy Sensor V3
In brief
The sizing tool now applies only to v2.x sensors and is not required for v3.x. Automatic auditing for v3.x configures supported auditing settings, with additional steps specified.
What Defender admins need to know
For v3.x deployments, skip the sizing tool and enable automatic auditing. Review and complete the additional auditing steps.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The Defender for Identity sensor v3.x limits CPU utilization to 30% and memory usage to 1.5 GB. However, if another service uses substantial system resources, the server might still experience performance strain. If the sensor reaches the CPU limit, it throttles some event processing. If the sensor reaches the memory limit, the sensor service might restart.
ReferThe Defender for Identity sizing tool applies to the Defender for Identity Capacity Planning documentation to determine whether your servers have enough resourcesv2.x sensors and isn't required for a Microsoft Defender for Identity sensor.v3.x.
Service account requirements
Configure Windows event auditing
Defender for Identity relies on Windows event logs for many detections. For v3.x sensors, enable automatic auditing to configure supported auditing settings. Complete the additional steps for AD FS or AD CS, which handles all auditing settings without manual configuration.as applicable.
If automatic auditing isn't available or you opted out, configure auditing manually or configure Windows event collection using PowerShell.
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.-ms.date: 2026-10-14T00:00:00.0000000Z+ms.date: 2026-10-18T00:00:00.0000000Z ms.topic: how-to ms.custom: msecd-doc-authoring-1016 ms.reviewer: rlitinsky@@ -135,7 +135,7 @@ When running as a virtual machine, always allocate all memory to the virtual mac
The Defender for Identity sensor v3.x limits CPU utilization to 30% and memory usage to 1.5 GB. However, if another service uses substantial system resources, the server might still experience performance strain. If the sensor reaches the CPU limit, it throttles some event processing. If the sensor reaches the memory limit, the sensor service might restart.
-Refer to the [Defender for Identity Capacity Planning documentation](/en-us/defender-for-identity/deploy/capacity-planning) to determine whether your servers have enough resources for a Microsoft Defender for Identity sensor.
+The [Defender for Identity sizing tool](capacity-planning) applies to v2.x sensors and isn't required for v3.x.
### Service account requirements
@@ -174,7 +174,7 @@ Complete these configuration steps after the sensor is activated and running.
### Configure Windows event auditing
-Defender for Identity relies on Windows event logs for many detections. For v3.x sensors, [enable automatic auditing](configure-windows-event-collection#configure-defender-for-identity-to-collect-windows-events-automatically), which handles all auditing settings without manual configuration.
+Defender for Identity relies on Windows event logs for many detections. For v3.x sensors, [enable automatic auditing](configure-windows-event-collection#configure-defender-for-identity-to-collect-windows-events-automatically) to configure supported auditing settings. Complete the additional steps for [AD FS](configure-windows-event-collection#configure-auditing-on-an-ad-fs-server) or [AD CS](configure-windows-event-collection#configure-auditing-on-an-ad-cs-server), as applicable.
If automatic auditing isn't available or you opted out, [configure auditing manually](configure-windows-event-collection#configure-windows-event-collection-manually) or [configure Windows event collection using PowerShell](configure-windows-event-collection#configure-windows-event-collection-using-powershell).