Page 130 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Classic and Defender formats use the same underlying Defender for Identity sensor detections but differ in structure, naming, and categorization. Alert names differ in the XDR structure while alert IDs remain consistent between the two formats.
Read the checklist
By default, the alerts queue shows alerts seen in the previous seven days in a grouped view with the newest alerts first. The documented workflow covers viewing, filtering, investigating, classifying, and managing Defender for Identity security alerts.
Read the explainer
Defender for Identity monitors information from Active Directory, network activities, and event activities to detect suspicious activity. For a validated threat, the monitored information can help determine incident scope, involved entities, and remediation.
Read the guide
Defender for Identity activities derived from network traffic, Windows events, and ETW commonly contain IP data. Network Name Resolution correlates raw IP activities with computers so Defender for Identity can profile entities and generate alerts for suspicious activity.
Read the playbook
The alert story presents a chronological view of what happened, when it happened, and which entities appeared before and after the triggering event. The alert graph maps users, devices, and domain controllers and shows their interactions for relationship and pattern analysis.
Read the briefing
Available remediation actions depend on the connector managing the account and can span Active Directory, Entra ID, non-Microsoft identity providers, and connected SaaS applications.
Read the checklist
Microsoft recommends role groups that segregate security-team responsibilities and grant only the access needed for each job. New Defender for Identity tenants from March 2, 2025 can configure permissions only through Microsoft Defender XDR Unified RBAC, while earlier role assignments are retained.
Read the explainer
One person can have personal, privileged, legacy, cloud, or orphaned accounts across Active Directory, Entra ID, and non-Microsoft identity providers. Microsoft supports manually linking or unlinking related accounts to address fragmented identity views.
Read the guide
The Health Issues page lists deployment and sensor problems that can result from configuration or environmental factors.
Read the playbook
Defender for Identity reports can be generated on demand or configured for periodic email delivery. Available report subjects include system activity summaries, sensitive-group changes, and passwords exposed in cleartext.
Read the briefing