Page 238 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Microsoft moved classic Defender for Identity portal users to the unified Defender portal; the documentation says redirection is automatic and the legacy portal cannot be restored.
Read the explainer
Sensor settings must be configured correctly before Defender for Identity data becomes visible. Microsoft states that additional configuration and integration are needed to use the product’s full capabilities.
Read the guide
Devices enter Defender for Identity’s monitoring scope when they authenticate or request authorization from Active Directory; this includes mobile and non-Windows endpoints.
Read the playbook
A Directory Service Account reads Active Directory data by querying objects, tracking changes, and resolving entities, while the action account performs remediation. Directory Service Accounts apply only to sensor v2.x; sensor v3.x uses LocalSystem and does not use DSA or gMSA configuration.
Read the briefing
The documented gMSA is for sensor v2.x to read Active Directory data such as objects, changes, and entity information. Sensor v3.x uses LocalSystem for Active Directory interactions and does not require a gMSA or other Directory Service Account.
Read the checklist
Defender for Identity needs the required permissions to perform remediation actions on compromised on-premises Active Directory accounts, separately from the account used to read directory data.
Read the explainer
The page defines prerequisite differences for a standalone sensor relative to the main deployment prerequisites. Standalone sensors do not collect ETW entries used by multiple detections, so Microsoft recommends the standard Defender for Identity sensor for full coverage.
Read the guide
A standalone sensor needs port mirroring or a network TAP to see domain-controller network traffic. Microsoft directs organizations using port mirroring to configure each monitored domain controller as a traffic source and coordinate with networking or virtualization teams.
Read the playbook
Windows event forwarding can enhance standalone-sensor detections with events that are unavailable from domain-controller network traffic. Standalone sensors still do not collect ETW entries used by multiple detections, and Microsoft recommends the standard sensor for full coverage.
Read the briefing
The document defines required message syntax for a standalone sensor to listen for supported SIEM event types. Its RSA Security Analytics example uses a Windows event 4776 message and treats the standard RFC 3164 syslog header prefix as optional.
Read the checklist