Use this document to connect an official requirement or behavior to observable evidence: Add sensor onboarding and Test-MDIConfiguration to identity-platform reviews. Only the official source and traced locations below supply facts. Confirm applicability before acting.
\nThe official Quarterly or ad-hoc operational guide for Microsoft Defender for Identity from Microsoft supports the following bounded statements:
\nKeep the evidence boundary at these traced claims. They support a review of identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows; they do not support conclusions outside the source’s stated conditions.
\nThe source is a quarterly or ad-hoc guide; local cadence, supported server roles, permissions, and remediation ownership still require an environment-specific operating procedure. Do not read the source as proof of implementation or permission to change production. Its guidance remains conditional on Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing and the environment’s recorded constraints.
\nDSE recommends using the cited source as the evidence anchor for this decision. Anchor the review in the cited section and keep observation separate from interpretation. Record the source location, examined part of identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows, observed and expected states, owner, and reason for deviation.
\nIf the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing and sanitize protected material before retention.
\nA reviewer should be able to retrace the decision from Review server setup process to include sensors; Check domain configuration via PowerShell through alert records, investigation timelines, analyst actions, tuning or exclusion approvals, remediation results, and case closure. Record what was collected, where, when, by whom, and which system or role it represents.
\nRecord the decision even when no change is made, including uncertainty and the next trigger. Use safe testing conditions for disruptive work, preserve rollback proof, and revisit the conclusion after relevant platform, dependency, vendor, or ownership changes.
\n