Page 146 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Microsoft documents sensor removal for domain-controller decommissioning, orphaned or duplicate sensor cleanup, and intentionally stopping monitoring on a server. Deleting a v3.x sensor removes its software and stops Defender for Identity monitoring on that domain controller.
Read the playbook
Defender for Identity scoping can focus monitoring and visibility on specified Active Directory domains or organizational units. Scoped access is configured with a custom Microsoft Defender unified RBAC role that assigns users or Entra groups to the selected directory scope.
Read the briefing
Defender for Identity VPN integration is supported only by sensor v2.x. The integration listens to forwarded RADIUS accounting events and can add connection IP address and location context plus an abnormal-VPN-connection detection.
Read the checklist
Defender for Identity supports tagging accounts as sensitive or honeytokens and tagging devices as Exchange servers. Some detections depend on the sensitive tag, while any sign-in from a tagged honeytoken account triggers an alert.
Read the explainer
Custom correlation rules target accounts that do not share strong identifiers such as account ID, SID, object ID, or UPN.
Read the guide
Defender for Identity notifications are supported only by sensor v2.x. The service can notify on health issues and security alerts through email or a Syslog server.
Read the playbook
Some Defender for Identity alerts use learning periods to build activity profiles and distinguish legitimate from suspicious behavior.
Read the briefing
The known-issues page documents a sensor warning when an LDAP connection cannot retrieve a group managed service account password. For that documented issue, Microsoft identifies the cause as the domain controller lacking rights to access the gMSA password.
Read the checklist
Defender for Identity logs provide point-in-time insight into sensor activity and status. The Microsoft.Tri.Sensor.log records sensor operations, resolution, and errors in chronological order and is used for an overall operational view.
Read the explainer
Microsoft’s daily guide covers identity dashboard review, incident triage, alert tuning, proactive hunting, and deployment-health monitoring. The stated operating personas include SOC analysts, security administrators, and identity and access management teams.
Read the guide