Page 242 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Microsoft recommends role groups that segregate security-team responsibilities and grant only the access needed for each job. New Defender for Identity tenants from March 2, 2025 can configure permissions only through Microsoft Defender XDR Unified RBAC, while earlier role assignments are retained.
Read the explainer
One person can have personal, privileged, legacy, cloud, or orphaned accounts across Active Directory, Entra ID, and non-Microsoft identity providers. Microsoft supports manually linking or unlinking related accounts to address fragmented identity views.
Read the guide
The Health Issues page lists deployment and sensor problems that can result from configuration or environmental factors.
Read the playbook
Defender for Identity reports can be generated on demand or configured for periodic email delivery. Available report subjects include system activity summaries, sensitive-group changes, and passwords exposed in cleartext.
Read the briefing
The Sensors experience covers sensor status and health, sensor details, updates for v2.x and v3.x, and proxy configuration. A sensor details pane exposes health information and provides paths to manage configuration or reopen closed health issues.
Read the checklist
Defender for Identity supports excluding specific IP addresses, computers, domains, or users from a number of detections. Microsoft recommends Defender XDR alert-tuning rules instead of exclusions because tuning supports more granular conditions and lets analysts review tuned alerts.
Read the explainer
The Defender for Identity About page reports the workspace ID and name, latest available sensor version, assigned license count, and identities active during the preceding 28 days.
Read the guide
Microsoft documents sensor removal for domain-controller decommissioning, orphaned or duplicate sensor cleanup, and intentionally stopping monitoring on a server. Deleting a v3.x sensor removes its software and stops Defender for Identity monitoring on that domain controller.
Read the playbook
Defender for Identity scoping can focus monitoring and visibility on specified Active Directory domains or organizational units. Scoped access is configured with a custom Microsoft Defender unified RBAC role that assigns users or Entra groups to the selected directory scope.
Read the briefing
Defender for Identity VPN integration is supported only by sensor v2.x. The integration listens to forwarded RADIUS accounting events and can add connection IP address and location context plus an abnormal-VPN-connection detection.
Read the checklist