Daily Defender News
Aboutmerill.net
Microsoft Defender for Identity
Identity protection

Standalone sensor prerequisites - Microsoft Defender for Identity | Microsoft Learn

19 October 2026Doc update+9 / −6 lines

In brief

The page now uses clearer deployment wording, fixes the static IP example and links, and separates auditing guidance for AD FS and AD CS servers.

What Defender admins need to know

Review the updated guidance when preparing standalone sensors, especially the separate AD FS and AD CS auditing instructions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Standalone sensor prerequisites - Microsoft Defender for Identity | Microsoft Learn

This article lists prerequisitesPrepare a dedicated server for deploying a Microsoft Defender for Identity standalone sensor where they differ fromsensor. Review the main deployment prerequisites., then complete the additional standalone requirements below.

For more information, see Plan capacity for Microsoft Defender for Identity deployment.

Standalone sensors differ from Defender for Identity sensor prerequisites as follows:

  • Standalone sensors require a minimum of 5 GB of disk spacespace.

  • Standalone sensors can also be installed on servers that are in a workgroup.

  • Standalone sensors can support monitoring multiple domain controllers, depending on the amount of network traffic to and from the domain controllers.

  • If you're working with multiple forests, your standalone sensor machines must be allowed to communicate with all remote forest domain controllers using LDAP. Important

    • Configure port mirroring for the capture adapter as the destination of the domain controller network traffic. Typically, you need to work with the networking or virtualization team to configure port mirroring.
    • Configure a static non-routable IP address (with /32 mask) for your environment with no default sensor gateway and no DNS server addresses. For example: `10.10.10.0.10/32.32. This configuration ensures that the capture network adapter can capture the maximum amount of traffic and that the management network adapter is used to send and receive the required network traffic.

Note

Defender for Identity detection relies on specific Windows Event logs that the sensor parses from your domain controllers. For the correct events to be audited and included in the Windows Event log, your domain controllers require accurate Windows Advanced Audit Policy settings.

For more information, see,see Advanced audit policy check and Advanced security audit policies in the Windows documentation.