Page 126 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Microsoft calls for activating the sensor on all applicable servers and directs older or non-domain-controller identity roles to sensor v2.x instead. Eligible domain controllers can be activated automatically when discovered or manually by selecting servers from the inventory.
Read the checklist
Sensor v2 supports domain controllers running Windows Server 2016 or earlier and AD FS, AD CS, or Microsoft Entra Connect servers that are not domain controllers. For domain controllers running Windows Server 2019 or later, Microsoft recommends sensor v3 instead of sensor v2.
Read the explainer
The capacity planning tool was designed for the resource-intensive network processes of sensor v2.x. Microsoft says sensor v3.x does not require the sizing tool because it relies mainly on Windows events and event tracing and has lower resource requirements.
Read the guide
Defender for Identity supports multiple Active Directory forests and can monitor activity and profile users across them. Each Defender for Identity sensor can report to only one Defender for Identity workspace.
Read the playbook
Each Defender for Identity sensor requires internet connectivity to the cloud service to report data and operate.
Read the briefing
The Defender for Identity sensor requires network connectivity to the Defender for Identity service. Microsoft recommends browser or PowerShell connectivity tests before deployment and again when a deployed sensor has connectivity problems.
Read the checklist
Microsoft moved classic Defender for Identity portal users to the unified Defender portal; the documentation says redirection is automatic and the legacy portal cannot be restored.
Read the explainer
Sensor settings must be configured correctly before Defender for Identity data becomes visible. Microsoft states that additional configuration and integration are needed to use the product’s full capabilities.
Read the guide
Devices enter Defender for Identity’s monitoring scope when they authenticate or request authorization from Active Directory; this includes mobile and non-Windows endpoints.
Read the playbook
A Directory Service Account reads Active Directory data by querying objects, tracking changes, and resolving entities, while the action account performs remediation. Directory Service Accounts apply only to sensor v2.x; sensor v3.x uses LocalSystem and does not use DSA or gMSA configuration.
Read the briefing