Reconstruct identity alerts from chronology and entity relationships
Use Investigate alerts in Microsoft Defender for Identity to review this narrow operational decision without extending the source beyond its stated scope.
Read the briefingDSE security knowledge hubIT
IT
Knowledge
Page 22 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Explore this topic
Start with the cornerstone guide IT knowledge center
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
DSE post stream
429 articlesIT
Authorize identity remediation actions by connector and RBAC scope
Use Remediation actions in Microsoft Defender for Identity to review this narrow operational decision without extending the source beyond its stated scope.
Read the checklist
Move Defender for Identity access to least-privileged unified RBAC roles
Use Microsoft Defender for Identity role groups to review this narrow operational decision without extending the source beyond its stated scope.
Read the explainer
Link fragmented user accounts only with evidence of common identity
Use Manage related identities and accounts in Microsoft Defender for Identity to review this narrow operational decision without extending the source beyond its stated scope.
Read the guide
Triage Defender for Identity health issues by environment and sensor
Use Microsoft Defender for Identity health issues to review this narrow operational decision without extending the source beyond its stated scope.
Read the playbook
Schedule identity reports without treating them as real-time detection
Use Download and schedule Defender for Identity reports in Microsoft Defender XDR (Preview) to review this narrow operational decision without extending the source beyond its stated scope.
Read the briefing
Manage Defender for Identity sensor status, health, updates, and proxy settings together
Use Manage and update Microsoft Defender for Identity sensors to review this narrow operational decision without extending the source beyond its stated scope.
Read the checklist
Prefer granular alert tuning before Defender for Identity detection exclusions
Use Configure Defender for Identity detection exclusions in Microsoft Defender to review this narrow operational decision without extending the source beyond its stated scope.
Read the explainer
Record the Defender for Identity workspace ID and name for support and proxy changes
Use View information on the Defender for Identity About page to review this narrow operational decision without extending the source beyond its stated scope.
Read the guide
Remove an identity sensor deliberately when decommissioning its domain controller
Use Remove the Microsoft Defender for Identity sensor to review this narrow operational decision without extending the source beyond its stated scope.
Read the playbook