https://securitynews.ms/products/microsoft-defender-for-identity/Microsoft Defender for Identity news and documented product changes, each linked to Microsoft's own source.enThu, 01 Oct 2026 00:00:00 +0000https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alertshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alertsThu, 01 Oct 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe October announcement includes the following new alerts: New alerts related to Entra ID : Malicious registration of a device with strong MFA Malicious registration of an attacker controlled MFA device Newly created user performed organization branding change Suspicious registration…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#known-limitation-sensor-v3x-activation-without-defender-for-endpoint-isnt-supported-in-government-cloudshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#known-limitation-sensor-v3x-activation-without-defender-for-endpoint-isnt-supported-in-government-cloudsThu, 01 Oct 2026 00:00:00 +0000Defender for Identity · Microsoft LearnActivating the Defender for Identity v3.x sensor on servers without Microsoft Defender for Endpoint deployment is temporarily not supported in government cloud environments.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#general-availability-of-sensor-v3x-activation-without-defender-for-endpointhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#general-availability-of-sensor-v3x-activation-without-defender-for-endpointThu, 01 Oct 2026 00:00:00 +0000Defender for Identity · Microsoft LearnDefender for Identity sensor v3.x activation without Defender for Endpoint is now generally available. Supported servers include eligible domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers running Windows Server 2019 or later. This activation method supports only…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-sensor-v3x-activation-and-windows-auditing-for-existing-customershttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-sensor-v3x-activation-and-windows-auditing-for-existing-customersThu, 01 Oct 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThis rollout applies only to organizations that are licensed for Defender for Identity and have an active workspace. Eligible organizations included in the rollout see a banner on the Sensor management tab of the On-premises settings page for 30 days…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-support-for-additional-identity-server-roles-ad-cs-ad-fs-and-entra-connect-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-support-for-additional-identity-server-roles-ad-cs-ad-fs-and-entra-connect-previewTue, 01 Sep 2026 00:00:00 +0000Defender for Identity · Microsoft LearnDefender for Identity sensor v3.x now supports eligible AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers and don't have an existing Defender for Identity sensor. For more information, see Defender for Identity sensor v3.x prerequisites…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-onboarding-without-microsoft-defender-for-endpoint-deployment-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-onboarding-without-microsoft-defender-for-endpoint-deployment-previewTue, 01 Sep 2026 00:00:00 +0000Defender for Identity · Microsoft LearnYou can now activate the Defender for Identity sensor v3.x on eligible domain controllers without first onboarding them to Defender for Endpoint. This preview supports only new sensor v3.x deployments on eligible domain controllers running Windows Server 2019 or later…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v2x-installation-restriction-for-new-workspaces-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v2x-installation-restriction-for-new-workspaces-previewTue, 01 Sep 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe sensor v2.x installation restriction for new workspaces is in preview. Starting in October 2026, Defender for Identity will restrict sensor v2.x installation in new workspaces. In these workspaces, sensor v3.x is the supported onboarding option for eligible servers running…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-security-dashboard-and-coverage--maturityhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-security-dashboard-and-coverage--maturityTue, 01 Sep 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Identity Security dashboard provides a centralized view of identity-related security risks and posture across your organization. Coverage & Maturity helps security teams understand identity protection across on-premises, cloud, SaaS, identity providers, and partner technologies, identify coverage and deployment gaps…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#combined-sensor-management-tab-on-the-on-premises-settings-pagehttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#combined-sensor-management-tab-on-the-on-premises-settings-pageTue, 01 Sep 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Onboarding and Sensors tabs on the identity On-premises settings page are now combined into a single Sensor management tab that lists both installed sensors and servers eligible for activation. Automatic sensor v3.x activation is now configured on the Advanced…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-sensor-v3x-activation-and-windows-auditing-by-defaulthttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-sensor-v3x-activation-and-windows-auditing-by-defaultTue, 01 Sep 2026 00:00:00 +0000Defender for Identity · Microsoft LearnAutomatic sensor v3.x activation and automatic Windows auditing apply only to organizations with an active license that includes Microsoft Defender for Identity. The rollout differs for new Microsoft Defender for Endpoint customers and existing Defender for Identity customers: New Microsoft…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#expanded-automatic-auditing-support-for-ad-cs-ad-fs-and-entra-connect-servershttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#expanded-automatic-auditing-support-for-ad-cs-ad-fs-and-entra-connect-serversSat, 01 Aug 2026 00:00:00 +0000Defender for Identity · Microsoft LearnAutomatic Windows event auditing now configures auditing for AD FS, AD CS, and Microsoft Entra Connect. Auditing is configured automatically on any eligible server that runs Defender for Identity sensor v3.x, including servers that aren't domain controllers. For more information…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updateshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updatesSat, 01 Aug 2026 00:00:00 +0000Defender for Identity · Microsoft LearnVersion number Updates 2.255.19347.63719 This sensor update includes security improvements.https://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--domain-investigationhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#july-2026--domain-investigationWed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft Learn(GA) The Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#migration-readiness-reasons-on-the-sensors-pagehttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#migration-readiness-reasons-on-the-sensors-pageWed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft LearnWhen a server is marked Not ready for migration on the Sensors page, you can now hover over the status to see a tooltip that lists the specific reasons the server doesn't meet the migration prerequisites. For more information, see…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#migrate-windows-server-2025-domain-controllers-to-sensor-v3xhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#migrate-windows-server-2025-domain-controllers-to-sensor-v3xWed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft LearnYou can now migrate domain controllers running Windows Server 2025 from sensor v2.x to sensor v3.x. For more information, see Migrate to Defender for Identity sensor v3.x .https://learn.microsoft.com/en-us/defender-for-identity/whats-new#general-availability-of-the-domain-investigation-pagehttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#general-availability-of-the-domain-investigation-pageWed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Domain investigation page allows you to investigate an Active Directory domain. It shows Active Directory domain security, including domain properties, deployment health, identity summary, service account breakdown, sensitive entities, active recommendations, group policies, and trust relationships. For more information…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#general-availability-of-sensor-v2x-to-v3x-migrationhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#general-availability-of-sensor-v2x-to-v3x-migrationWed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft LearnMigration of Defender for Identity sensors from v2.x to v3.x is now generally available. For more information, see Migrate to Defender for Identity sensor v3.x .https://learn.microsoft.com/en-us/defender-for-identity/whats-new#expanded-saas-app-support-in-password-protection-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#expanded-saas-app-support-in-password-protection-previewWed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Password protection page now includes password risks from SaaS apps connected through Microsoft Defender for Cloud Apps, in addition to Active Directory, Microsoft Entra ID, and Okta. SaaS apps that support SaaS Security Posture Management (SSPM), such as Salesforce…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-1https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-1Wed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft LearnVersion number Updates 2.255.19295.47272 This sensor update adds support for a new Event Tracing for Windows (ETW) provider and includes other improvements.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-rpc-auditing-on-domain-controllershttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-rpc-auditing-on-domain-controllersWed, 01 Jul 2026 00:00:00 +0000Defender for Identity · Microsoft LearnDefender for Identity now automatically enables RPC auditing on domain controllers when you upgrade to sensor version 3.0.8 or later. You no longer need to apply a tag manually to enable RPC auditing. For more information, see Configure RPC auditing…https://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--identity-security-dashboardhttps://learn.microsoft.com/en-us/defender-xdr/whats-new#june-2026--identity-security-dashboardMon, 01 Jun 2026 00:00:00 +0000Defender for Identity · Microsoft Learn(Preview) The Identity Security dashboard now includes a new Human identities card that shows your human identities by source (Entra ID, SaaS, and on-premises), giving you a single view of where your human identities live. For more information, see Identity…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#visibility-into-service-principals-used-by-ai-agents-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#visibility-into-service-principals-used-by-ai-agents-previewMon, 01 Jun 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe non-human identity inventory now identifies which Entra ID service principals are used by AI agents. A new "Used by AI agents" column and insight card help you find and prioritize these identities. For more information, see View the Identity…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-1https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-1Mon, 01 Jun 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThese new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Anomalous activity following Global Administrator elevation Reciprocal Temporary Access Pass creation between users Suspicious service principal sign-in following credential addition Suspicious…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#nhi-inventory-enhancements-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#nhi-inventory-enhancements-previewMon, 01 Jun 2026 00:00:00 +0000Defender for Identity · Microsoft LearnExpanded Entra ID inventory : The non-human identity inventory now includes all Microsoft Entra service principals, not just those with API permissions. For more information, see View the Identity inventory . Microsoft Entra roles visibility : The Permissions tab now…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-risk-score-is-now-generally-availablehttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-risk-score-is-now-generally-availableMon, 01 Jun 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe identity risk score is now generally available. The score ranges from 0 to 100 and reflects how likely an identity is to be compromised and how much damage a compromise could cause, based on the identity's criticality level and…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-supports-all-identity-roles-on-domain-controllershttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-supports-all-identity-roles-on-domain-controllersFri, 01 May 2026 00:00:00 +0000Defender for Identity · Microsoft LearnDefender for Identity sensor v3.x now supports domain controllers running all identity roles, including Microsoft Entra Connect, AD FS, and AD CS identity roles. For deployment details, see Defender for Identity sensor v3.x prerequisites .https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-2https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-2Fri, 01 May 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThese new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Guest user account promoted to member User was created and assigned to Global Administrator role Failed credential abuse attempt in Entra…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#known-limitation-migration-of-domain-controllers-with-windows-server-2025-from-sensor-v2x-to-sensor-v3x-is-not-supportedhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#known-limitation-migration-of-domain-controllers-with-windows-server-2025-from-sensor-v2x-to-sensor-v3x-is-not-supportedFri, 01 May 2026 00:00:00 +0000Defender for Identity · Microsoft LearnWhen announced in May 2026, migration of Windows Server 2025 domain controllers from sensor v2.x to sensor v3.x wasn't supported. This limitation was resolved in July 2026. See Windows Server 2025 migration support and the current migration requirements .https://learn.microsoft.com/en-us/defender-for-identity/whats-new#increased-sensor-capacityhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#increased-sensor-capacityFri, 01 May 2026 00:00:00 +0000Defender for Identity · Microsoft LearnDefender for Identity now supports up to 1,000 sensors per workspace, increased from the previous limit of 350. To add more than 1,000 sensors, contact Defender for Identity support.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-2https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-2Fri, 01 May 2026 00:00:00 +0000Defender for Identity · Microsoft LearnVersion number Updates 2.255.19247.44775 This sensor update adds properties to Group Policy (GPO) event collection and includes bug fixes.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-explorer-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-explorer-previewWed, 01 Apr 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Identity page now includes the Identity Explorer tab for customers with a Microsoft Sentinel Data Lake license. This tab uses the hunting graph to visualize identity attack paths and exposure scenarios as interactive graphs. Use predefined identity scenarios to…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#custom-account-correlation-rules-previewhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#custom-account-correlation-rules-previewWed, 01 Apr 2026 00:00:00 +0000Defender for Identity · Microsoft LearnCustom account correlation rules let you link accounts that belong to the same identity, such as privileged accounts with unique naming conventions. You can correlate accounts that don't share strong identifiers such as account ID, SID, object ID, or UPN…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-windows-event-auditing-configuration-for-sensors-v3x-is-now-generally-availablehttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#automatic-windows-event-auditing-configuration-for-sensors-v3x-is-now-generally-availableWed, 01 Apr 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Automatic Windows event-auditing configuration for sensors v3.x is now generally available. Automatic Windows event-auditing streamlines deployment by automatically applying the required auditing settings to new sensors and correcting misconfigurations on existing ones.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#updates-to-secure-score-category-calculations-for-increased-accuracyhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#updates-to-secure-score-category-calculations-for-increased-accuracySun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnTo improve accuracy and better protect organizational identities, some security recommendations categorized as Cloud apps recommendations are now considered identity-related and grouped under the Identity category. While the total Secure Score remains unchanged, individual identity and app scores may change.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#suspected-pass-the-ticket-attack-alert-is-now-generally-availablehttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#suspected-pass-the-ticket-attack-alert-is-now-generally-availableSun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Suspected pass-the-ticket attack alert is now generally available. This alert was previously available in public preview as Pass-the-Ticket (PtT) attack . For more information, see Lateral movement alerts .https://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-support-for-domain-controllers-with-microsoft-entra-connect-identity-roleshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-v3x-support-for-domain-controllers-with-microsoft-entra-connect-identity-rolesSun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnDefender for Identity sensor v3.x now supports domain controllers that run Microsoft Entra Connect, including detections and identity security posture management (ISPM) recommendations. Detections and ISPM recommendations for additional identity roles, including AD FS and AD CS, will become available…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-3https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-3Sun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThese new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Attempt to disable Defender for Identity service principal observed Suspicious Entra account enablement after disruption Suspicious Intune device registration activity Suspicious…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#migrate-defender-for-identity-sensors-from-v2x-to-v3xhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#migrate-defender-for-identity-sensors-from-v2x-to-v3xSun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnYou can now migrate Defender for Identity sensors from v2.x to v3.x directly from the Microsoft Defender portal. The v2.x sensor continues running during the migration until the v3.x sensor is ready, so there's no downtime. Eligible servers appear as…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#migrate-defender-for-identity-sensors-from-v2x-to-v3x-1https://learn.microsoft.com/en-us/defender-for-identity/whats-new#migrate-defender-for-identity-sensors-from-v2x-to-v3x-1Sun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnYou can now migrate Defender for Identity sensors from v2.x to v3.x directly from the Microsoft Defender portal. The v2.x sensor continues running during the migration until the v3.x sensor is ready, so there's no downtime. Eligible servers appear as…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-security-enhancements-1https://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-security-enhancements-1Sun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnNew identity security capabilities help you monitor and manage identity security for human and non-human identities: Identity Security dashboard (Preview) : The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and IGA integrations, and…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-security-enhancementshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#identity-security-enhancementsSun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnNew identity security capabilities help you monitor and manage identity security for human and non-human identities: Identity Security dashboard (Preview) : The Identity Security dashboard provides summary cards for identity providers, on-premises identities, SaaS identities, PAM and IGA integrations, and…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-4https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-4Sun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnSensor versions now display the full version number (for example, 2.255.19201.14651) instead of only the major/minor version (for example, 2.255). This makes it easier to identify the exact update installed on each sensor. When you validate upgrades or troubleshoot, the…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-3https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-3Sun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnSensor versions now display the full version number (for example, 2.255.19201.14651) instead of only the major/minor version (for example, 2.255). This makes it easier to identify the exact update installed on each sensor. When you validate upgrades or troubleshoot, the…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#continued-rollout-of-new-health-alert-sensor-v3x-rpc-audit-misconfiguredhttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#continued-rollout-of-new-health-alert-sensor-v3x-rpc-audit-misconfiguredSun, 01 Mar 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThe Sensor v3.x RPC Audit Misconfigured health alert is continuing to be rolled out gradually to customers. The new health alert helps identify v3.x sensors where Enhanced RPC auditing configuration is either missing or incorrectly applied. Enhanced RPC auditing is…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-4https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts-4Sun, 01 Feb 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThese new alerts were added to the Defender for Identity security alerts: New alerts related to Entra ID : Suspicious user configuration change activity from Entra ID sync application Anomalous OAuth device code authentication activity Suspicious Graph API request made…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-5https://learn.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-sensor-updates-5Sun, 01 Feb 2026 00:00:00 +0000Defender for Identity · Microsoft LearnVersion number Updates 2.255 This sensor update includes bug fixes.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-updateshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#sensor-updatesThu, 01 Jan 2026 00:00:00 +0000Defender for Identity · Microsoft LearnVersion number Updates 2.254 The sensor now supports a new DNS zone target for *.atp.gcc.azure.com. Make sure your sensors in GCC can access this zone with your sensor DNS prefix.https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-security-posture-assessmentshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-security-posture-assessmentsThu, 01 Jan 2026 00:00:00 +0000Defender for Identity · Microsoft LearnRemove stale Active Directory accounts (Preview) lists any user accounts in Active Directory that are stale, meaning they haven't logged in at all during the past 90 days. Microsoft Entra ID privileged user accounts that are also privileged in Active…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-security-posture-assessment-locate-accounts-in-built-in-operator-groupshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-security-posture-assessment-locate-accounts-in-built-in-operator-groupsThu, 01 Jan 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThis identity security posture assessment lists Active Directory accounts that are members of built-in Operator Groups, including direct and indirect membership. You can use this assessment to review legacy or unnecessary operator access and take action when elevated access isn't…https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-security-posture-assessment-identify-service-accounts-in-privileged-groupshttps://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-security-posture-assessment-identify-service-accounts-in-privileged-groupsThu, 01 Jan 2026 00:00:00 +0000Defender for Identity · Microsoft LearnThis identity security posture assessment lists Active Directory service accounts with direct or nested membership in privileged groups. You can use this assessment to identify service accounts with elevated permissions and take action when privileged access isn't required. For more…