Endpoint and identity
Microsoft Defender for Identity
Detection of identity attacks across Active Directory and hybrid identity.
Product changes
New features and changes
All 57 entries Microsoft documented on Learn in the last 12 months, newest first.
October 2026
- New feature
New Defender for Identity security alerts
The October announcement includes the following new alerts: New alerts related to Entra ID : Malicious registration of a device with strong MFA Malicious registration of an attacker controlled MFA device Newly created user performed organization branding change Suspicious registration…
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- New feature
Known limitation: Sensor v3.x activation without Defender for Endpoint isn't supported in government clouds
Activating the Defender for Identity v3.x sensor on servers without Microsoft Defender for Endpoint deployment is temporarily not supported in government cloud environments.
- GA
General availability of sensor v3.x activation without Defender for Endpoint
Defender for Identity sensor v3.x activation without Defender for Endpoint is now generally available. Supported servers include eligible domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. This activation method supports only…
DocsActivate the Microsoft Defender for Identity sensor v3.xNew
Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.
- New feature
Automatic sensor v3.x activation and Windows auditing for existing customers
This rollout applies only to organizations that are licensed for Defender for Identity and have an active workspace. Eligible organizations included in the rollout see a banner on the Sensor management tab of the On-premises settings page for 30 days…
DocsActivate the Microsoft Defender for Identity sensor v3.xNewConfigure Windows event auditingNew
Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.
September 2026
- Preview
Sensor v3.x support for additional identity server roles: AD CS, AD FS, and Entra Connect (Preview)
Defender for Identity sensor v3.x now supports eligible AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers and don't have an existing Defender for Identity sensor. For more information, see Defender for Identity sensor v3.x prerequisites…
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
- Preview
Sensor v3.x onboarding without Microsoft Defender for Endpoint deployment (Preview)
You can now activate the Defender for Identity sensor v3.x on eligible domain controllers without first onboarding them to Defender for Endpoint. This preview supports only new sensor v3.x deployments on eligible domain controllers running Windows Server 2019 or later…
DocsActivate the Microsoft Defender for Identity sensor v3.xNew
Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.
- Preview
Sensor v2.x installation restriction for new workspaces (Preview)
The sensor v2.x installation restriction for new workspaces is in preview. Starting in October 2026, Defender for Identity will restrict sensor v2.x installation in new workspaces. In these workspaces, sensor v3.x is the supported onboarding option for eligible servers running…
- New feature
Identity Security dashboard and Coverage & Maturity
The Identity Security dashboard provides a centralized view of identity-related security risks and posture across your organization. Coverage & Maturity helps security teams understand identity protection across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage and deployment gaps…
DocsView your identity coverage and maturityNew
View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.
- New feature
Combined Sensor management tab on the On-premises settings page
The Onboarding and Sensors tabs on the identity On-premises settings page are now combined into a single Sensor management tab that lists both installed sensors and servers eligible for activation. Automatic sensor v3.x activation is now configured on the Advanced…
DocsManage and update Microsoft Defender for Identity sensorsNew
Manage and update Microsoft Defender for Identity sensors Learn how to view, manage, and update Microsoft Defender for Identity sensors in the Microsoft Defender portal, including sensor health, migration state, and delayed updates.
- New feature
Automatic sensor v3.x activation and Windows auditing by default
Automatic sensor v3.x activation and automatic Windows auditing apply only to organizations with an active license that includes Microsoft Defender for Identity. The rollout differs for new Microsoft Defender for Endpoint customers and existing Defender for Identity customers: New Microsoft…
DocsActivate the Microsoft Defender for Identity sensor v3.xNewConfigure Windows event auditingNew
Activate the Microsoft Defender for Identity sensor v3.x Learn how to automatically or manually activate the Microsoft Defender for Identity sensor v3.x on eligible identity-role servers.
August 2026
- New feature
Expanded automatic auditing support for AD CS, AD FS, and Entra Connect servers
Automatic Windows event auditing now configures auditing for AD FS, AD CS, and Microsoft Entra Connect. Auditing is configured automatically on any eligible server that runs Defender for Identity sensor v3.x, including servers that aren't domain controllers. For more information…
DocsConfigure Windows event auditingNew
Configure Windows event auditing Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.
- New feature
Defender for Identity sensor updates
Version number Updates 2.255.19347.63719 This sensor update includes security improvements.
July 2026
- GA
Domain investigation
(GA) The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more…
DocsInvestigate an Active Directory domainUpdated
Investigate an Active Directory domain Learn how to investigate an Active Directory domain in Microsoft Defender. Review domain health scores, security policies, trust relationships, and recommendations.
- New feature
Migration readiness reasons on the Sensors page
When a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see…
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- New feature
Migrate Windows Server 2025 domain controllers to sensor v3.x
You can now migrate domain controllers running Windows Server 2025 from sensor v2.x to sensor v3.x. For more information, see Migrate to Defender for Identity sensor v3.x .
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- GA
General availability of the Domain investigation page
The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information…
DocsInvestigate an Active Directory domainUpdated
Investigate an Active Directory domain Learn how to investigate an Active Directory domain in Microsoft Defender. Review domain health scores, security policies, trust relationships, and recommendations.
- GA
General availability of sensor v2.x to v3.x migration
Migration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x .
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- Preview
Expanded SaaS app support in Password protection (Preview)
The Password protection page now includes password risks from SaaS apps connected through Microsoft Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce…
DocsPassword protection in Microsoft DefenderUpdated
Password protection in Microsoft Defender Learn how the Password protection page in Microsoft Defender helps you find leaked credentials, exposed passwords, and weak password policies across your identity sources.
- New feature
Defender for Identity sensor updates
Version number Updates 2.255.19295.47272 This sensor update adds support for a new Event Tracing for Windows (ETW) provider and includes other improvements.
- New feature
Automatic RPC auditing on domain controllers
Defender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later. You no longer need to apply a tag manually to enable RPC auditing. For more information, see Configure RPC auditing…
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
June 2026
- Preview
Identity Security dashboard
(Preview) The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live. For more information, see Identity…
DocsIdentity Security dashboard in Microsoft Defender for Identity …
Identity Security dashboard in Microsoft Defender for Identity (Preview) Learn how to work with the Identity Security dashboard in Microsoft Defender for Identity to monitor identity-related security risks.
- Preview
Visibility into service principals used by AI agents (Preview)
The non-human identity inventory now identifies which Entra ID service principals are used by AI agents. A new "Used by AI agents" column and insight card help you find and prioritize these identities. For more information, see View the Identity…
DocsView the Identity inventoryUpdated
View the Identity inventory View and manage all identities across your organization from the Identity inventory page in Microsoft Defender. Investigate identity types, domains, and attributes.
- New feature
New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Anomalous activity following Global Administrator elevation Reciprocal Temporary Access Pass creation between users Suspicious service principal sign-in following credential addition Suspicious…
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- Preview
NHI inventory enhancements (Preview)
Expanded Entra ID inventory : The non-human identity inventory now includes all Microsoft Entra service principals, not just those with API permissions. For more information, see View the Identity inventory . Microsoft Entra roles visibility : The Permissions tab now…
DocsView your OAuth app details with app governanceNewView the Identity inventoryUpdated
View your OAuth app details with app governance Learn how to view OAuth app risk, permissions, usage, and connected AI agents with app governance in Microsoft Defender.
- GA
Identity risk score is now generally available
The identity risk score is now generally available. The score ranges from 0 to 100 and reflects how likely an identity is to be compromised and how much damage a compromise could cause, based on the identity's criticality level and…
DocsInvestigate IdentitiesUpdated
Investigate Identities Learn how to use the Identity page in Microsoft Defender. Investigate user identities, review alerts, analyze activity timelines, and assess security risks across linked accounts.
May 2026
- New feature
Sensor v3.x supports all identity roles on domain controllers
Defender for Identity sensor v3.x now supports domain controllers running all identity roles, including Microsoft Entra Connect, AD FS, and AD CS identity roles. For deployment details, see Defender for Identity sensor v3.x prerequisites .
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
- New feature
New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Guest user account promoted to member User was created and assigned to Global Administrator role Failed credential abuse attempt in Entra…
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- New feature
Known limitation: Migration of domain controllers with Windows Server 2025 from sensor v2.x to sensor v3.x is not supported
When announced in May 2026, migration of Windows Server 2025 domain controllers from sensor v2.x to sensor v3.x wasn't supported. This limitation was resolved in July 2026. See Windows Server 2025 migration support and the current migration requirements .
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- New feature
Increased sensor capacity
Defender for Identity now supports up to 1,000 sensors per workspace, increased from the previous limit of 350. To add more than 1,000 sensors, contact Defender for Identity support.
- New feature
Defender for Identity sensor updates
Version number Updates 2.255.19247.44775 This sensor update adds properties to Group Policy (GPO) event collection and includes bug fixes.
April 2026
- Preview
Identity Explorer (Preview)
The Identity page now includes the Identity Explorer tab for customers with a Microsoft Sentinel Data Lake license. This tab uses the hunting graph to visualize identity attack paths and exposure scenarios as interactive graphs. Use predefined identity scenarios to…
DocsHunting graph in Microsoft Defender advanced huntingUpdatedInvestigate IdentitiesUpdated
Hunting graph in Microsoft Defender advanced hunting Learn how to use the hunting graph in Microsoft Defender XDR advanced hunting to visualize threat scenarios as interactive graphs and trace attack paths.
- Preview
Custom account correlation rules (Preview)
Custom account correlation rules let you link accounts that belong to the same identity, such as privileged accounts with unique naming conventions. You can correlate accounts that don't share strong identifiers such as account ID, SID, object ID, or UPN…
DocsAccount correlation rules in Microsoft Defender for Identity (Preview)Updated
Account correlation rules in Microsoft Defender for Identity (Preview) Learn how to add, edit, and remove account correlation rules in Microsoft Defender for Identity for accounts that don't share strong identifiers.
- GA
Automatic Windows event auditing configuration for sensors v3.x is now generally available
The Automatic Windows event-auditing configuration for sensors v3.x is now generally available. Automatic Windows event-auditing streamlines deployment by automatically applying the required auditing settings to new sensors and correcting misconfigurations on existing ones.
DocsConfigure Windows event auditingNew
Configure Windows event auditing Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.
March 2026
- New feature
Updates to Secure Score category calculations for increased accuracy
To improve accuracy and better protect organizational identities, some security recommendations categorized as Cloud apps recommendations are now considered identity-related and grouped under the Identity category. While the total Secure Score remains unchanged, individual identity and app scores may change.
- GA
Suspected pass-the-ticket attack alert is now generally available
The Suspected pass-the-ticket attack alert is now generally available. This alert was previously available in public preview as Pass-the-Ticket (PtT) attack . For more information, see Lateral movement alerts .
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- New feature
Sensor v3.x support for domain controllers with Microsoft Entra Connect identity roles
Defender for Identity sensor v3.x now supports domain controllers that run Microsoft Entra Connect, including detections and identity security posture management (ISPM) recommendations. Detections and ISPM recommendations for additional identity roles, including AD FS and AD CS, will become available…
DocsDeploy Microsoft Defender for Identity sensorsNewDeploy the Microsoft Defender for Identity sensor v3.xNewMarch 2026 Cumulative Update
Deploy Microsoft Defender for Identity sensors Learn how to deploy Microsoft Defender for Identity sensors on domain controllers and identity servers. Choose the right sensor version for your environment.
- New feature
New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Attempt to disable Defender for Identity service principal observed Suspicious Entra account enablement after disruption Suspicious Intune device registration activity Suspicious…
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- New feature
Migrate Defender for Identity sensors from v2.x to v3.x
You can now migrate Defender for Identity sensors from v2.x to v3.x directly from the Microsoft Defender portal. The v2.x sensor continues running during the migration until the v3.x sensor is ready, so there's no downtime. Eligible servers appear as…
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- New feature
Migrate Defender for Identity sensors from v2.x to v3.x
You can now migrate Defender for Identity sensors from v2.x to v3.x directly from the Microsoft Defender portal. The v2.x sensor continues running during the migration until the v3.x sensor is ready, so there's no downtime. Eligible servers appear as…
DocsMigrate from sensor v2.x to sensor v3.xNew
Migrate from sensor v2.x to sensor v3.x Learn how to migrate from the Defender for Identity sensor v2.x to the sensor v3.x with no downtime using the Sensors page in the Microsoft Defender portal.
- Preview
Identity security enhancements
New identity security capabilities help you monitor and manage identity security for human and non-human identities: Identity Security dashboard (Preview) : The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and IGA integrations, and…
DocsView your identity coverage and maturityNewNon-human identities in Microsoft DefenderNewView the Identity inventoryUpdatedInvestigate IdentitiesUpdated
View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.
- Preview
Identity security enhancements
New identity security capabilities help you monitor and manage identity security for human and non-human identities: Identity Security dashboard (Preview) : The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and IGA integrations, and…
DocsView your identity coverage and maturityNewNon-human identities in Microsoft DefenderNewView the Identity inventoryUpdatedInvestigate IdentitiesUpdated
View your identity coverage and maturity Learn how to use the Coverage and maturity page in Microsoft Defender to check your identity protection status and close coverage gaps in your environments.
- New feature
Defender for Identity sensor updates
Sensor versions now display the full version number (for example, 2.255.19201.14651) instead of only the major/minor version (for example, 2.255). This makes it easier to identify the exact update installed on each sensor. When you validate upgrades or troubleshoot, the…
- New feature
Defender for Identity sensor updates
Sensor versions now display the full version number (for example, 2.255.19201.14651) instead of only the major/minor version (for example, 2.255). This makes it easier to identify the exact update installed on each sensor. When you validate upgrades or troubleshoot, the…
- New feature
Continued rollout of new health alert: Sensor v3.x RPC audit misconfigured
The Sensor v3.x RPC Audit Misconfigured health alert is continuing to be rolled out gradually to customers. The new health alert helps identify v3.x sensors where Enhanced RPC auditing configuration is either missing or incorrectly applied. Enhanced RPC auditing is…
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
February 2026
- New feature
New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Suspicious user configuration change activity from Entra ID sync application Anomalous OAuth device code authentication activity Suspicious Graph API request made…
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- New feature
Defender for Identity sensor updates
Version number Updates 2.255 This sensor update includes bug fixes.
January 2026
- New feature
Sensor updates
Version number Updates 2.254 The sensor now supports a new DNS zone target for *.atp.gcc.azure.com. Make sure your sensors in GCC can access this zone with your sensor DNS prefix.
- Preview
New security posture assessments
Remove stale Active Directory accounts (Preview) lists any user accounts in Active Directory that are stale, meaning they haven't logged in at all during the past 90 days. Microsoft Entra ID privileged user accounts that are also privileged in Active…
DocsAccounts security posture assessment
Accounts security posture assessment Lists all Microsoft Defender for Identity security posture assessments for Active Directory accounts, with detailed impacts and remediation steps to help improve your Secure Score.
- New feature
New security posture assessment: Locate accounts in built-in Operator Groups
This identity security posture assessment lists Active Directory accounts that are members of built-in Operator Groups, including direct and indirect membership. You can use this assessment to review legacy or unnecessary operator access and take action when elevated access isn't…
DocsAccounts security posture assessment
Accounts security posture assessment Lists all Microsoft Defender for Identity security posture assessments for Active Directory accounts, with detailed impacts and remediation steps to help improve your Secure Score.
- New feature
New security posture assessment: Identify service accounts in privileged groups
This identity security posture assessment lists Active Directory service accounts with direct or nested membership in privileged groups. You can use this assessment to identify service accounts with elevated permissions and take action when privileged access isn't required. For more…
DocsAccounts security posture assessment
Accounts security posture assessment Lists all Microsoft Defender for Identity security posture assessments for Active Directory accounts, with detailed impacts and remediation steps to help improve your Secure Score.
- New feature
New Health Alert: Sensor v3.x RPC Audit Misconfigured
Enhanced RPC auditing is required for some Microsoft Defender for Identity advanced identity detections. A new health alert helps identify v3.x sensors where this configuration is either missing or incorrectly applied. The alert is being rolled out gradually to customers…
DocsDeploy the Microsoft Defender for Identity sensor v3.xNew
Deploy the Microsoft Defender for Identity sensor v3.x Learn the requirements and configuration steps to deploy the Defender for Identity sensor v3.x on eligible identity-role servers.
- New feature
New Entra ID user roles to support remediation actions
For some remediation actions , Defender for Identity creates an enterprise application in Microsoft Entra ID. The Microsoft Defender for Identity enterprise application is created automatically in the tenant and is used only to execute remediation actions. When a user…
DocsRemediation Actions for Compromised Users in Microsoft Defender for …Updated
Remediation Actions for Compromised Users in Microsoft Defender for Identity Learn how to respond to compromised users with remediation actions in Microsoft Defender for Identity
- New feature
New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Suspicious sign-in observed from Entra ID sync application to an uncommon resource app Suspicious sign-in observed to Entra ID sync application…
DocsMicrosoft Defender for Identity XDR security alertsUpdated
Microsoft Defender for Identity XDR security alerts Learn about security alerts issued by Defender for Identity in the extended detection and response (XDR) format.
- GA
Identity inventory enhancements are now generally available
Accounts tab in Identity Inventory : The new **Accounts*- tab provides a consolidated view of all accounts associated with an identity, including accounts from Active Directory, Microsoft Entra ID, and supported non-Microsoft identity providers. For more information, see Manage related…
DocsRemediation Actions for Compromised Users in Microsoft Defender for …UpdatedManage related identities and accounts in Microsoft Defender for …IdentityAccountInfo table in the advanced hunting schema
Remediation Actions for Compromised Users in Microsoft Defender for Identity Learn how to respond to compromised users with remediation actions in Microsoft Defender for Identity
- New feature
Automatic Windows event auditing configuration for Defender for Identity sensors v3.x
We're gradually rolling out automatic Windows event-auditing configuration for sensors v3.x, along with related health alerts. Automatic Windows event-auditing streamlines deployment by automatically applying the required auditing settings to new sensors and correcting misconfigurations on existing ones. This update might…
DocsConfigure Windows event auditingNew
Configure Windows event auditing Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies.
December 2025
- Preview
New properties for 'sensorCandidate' resource type in Graph-API (preview)
Property Type Description domainName String The domain name of the sensor. senseClientVersion String The version of the Defender for Identity sensor client. This capability is currently in preview and available in API preview version. Learn more here
DocssensorCandidate resource type
sensorCandidate resource type Represents a Microsoft Defender for Identity sensor that's ready to be activated.
- GA
ADWS LDAP search in Advanced Hunting
New ADWS LDAP search activity is now available in the 'IdentityQueryEvents' table in Advanced Hunting. This can provides visibility into directory queries performed through ADWS, helping customers track these operations and create custom detection based on this data. Version number…
No changes match.