Monday, 19 October 2026

Updated October 19, 2026: We have identified that this message did not reach it's intended audience. You can safely disregard this message, and we apologize any confusion this may have caused.

Administrators can select specific detection sources within service sources when creating or editing alert tuning rules, including include/exclude choices for existing rules.

The table reference replaces DnsEventType and DnsEventSubType with EventType and EventSubType, and updates the request-filter example accordingly.

The documentation now clarifies that the mobile threat defense connector is the Defender for Endpoint–Intune integration, separates assignment steps, and refers to the automatic-launch control as a switch.

The page now lists supported Defender configuration areas, clarifies the onboarding and Managed Google Play prerequisites, and updates the Intune policy creation link and wording.

The page revises privacy wording, terminology, punctuation, and descriptions of collected data. The required-data list no longer includes basic browser information.

The page now describes the refreshed Android interface, including dashboards, feature tiles, alert cards, and the Device Protection feature card. It also clarifies the separate feedback and log-submission flows and updates screenshot descriptions, wording, and formatting.

The page now more clearly highlights Android onboarding and Xiaomi Permanent Protection issues, and refines instructions for updating Microsoft Authenticator. Wording, screenshots, links, and formatting were also refreshed.

Eligible organizations with an active Defender for Identity workspace receive a 30-day banner before sensor v3.x activation and Windows auditing are enabled by default, including settings currently set to Off. Windows Server 2025 sensor migration support is also documented as resolved.

The guide now says to select “Automatically use the sensor's local system account” before migrating because migration does not change this setting automatically. It also instructs admins to verify that the setting remains selected instead of using gMSA for action accounts.

The documentation clarifies automatic Windows auditing for v3.x sensors, distinguishes it from automatic sensor activation, updates the listed auditing settings, changes the System event ID from 7045 to 4697, and directs administrators to use Certification Authority for CA auditing.

The page now separates v2.x and v3.x prerequisites, ports, and connectivity procedures. It adds v3.x guidance stating that the sensor uses Microsoft Defender for Endpoint service endpoints and clarifies expected test results and troubleshooting use.

The page now explicitly scopes DSA usage, recommendations, supported options, and selection behavior to Defender for Identity v2.x sensors. It also clarifies domain synchronizer responsibilities and improves wording.

The page now uses clearer deployment wording, fixes the static IP example and links, and separates auditing guidance for AD FS and AD CS servers.

The page now describes validating Defender for Identity sensors through portal data, advanced hunting, and test alerts. It also clarifies that queries should run separately and explains which placeholders to replace.

The guidance now specifies that automatic Windows event auditing applies to v3.x sensors and tells administrators to check the health issue table for the relevant sensor version before remediation. Several alert descriptions were also clarified.

The troubleshooting page now points scheduled-task and proxy silent-installation references to the corresponding sections under `deploy/install-sensor`; page metadata was also refreshed.

The article now applies its procedures and Directory Service Account requirement specifically to Defender for Identity v2.x sensors. Administrators using v3.x sensors are directed to separate deployment and configuration guidance.

The page now covers configuration and validation for Defender for Identity v2.x sensors, while directing v3.x users to separate post-activation guidance and shared deployment validation steps.

The article now explicitly states that action accounts with the required permissions are used for remediation actions and are separate from Directory Service Accounts.

The section now refers to removing the legacy Unified Sensor RPC Audit tag and clarifies that removing it does not disable automatic RPC auditing on v3.x sensors.

The guide now specifies that eligible Windows Server 2019 or later domain controllers should follow the v3.x deployment guidance, not the v2.x installer procedures. It also links to the v3.x onboarding package for deployments without Defender for Endpoint.

The deployment guidance now links to v2.x server requirements and migration prerequisites. It specifies that in-place migration from sensor v2.x to v3.x is currently available only for eligible domain controllers, not other servers.

The sizing tool now applies only to v2.x sensors and is not required for v3.x. Automatic auditing for v3.x configures supported auditing settings, with additional steps specified.