You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/deploy/deploy-defender-identity.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,10 +31,10 @@ Identify your architecture and your requirements, and then use the table below t
31
31
> [!NOTE]
32
32
> The Defender for Identity sensor version 3.x is still in preview and has some limited functionality compared to version 2.x. Keep these limitations in mind before activating the sensor.
33
33
> The Defender for Identity sensor v3.x:
34
-
> - Requires that Defender for Endpoint is deployed on your endpoints
34
+
> - Requires that Defender for Endpoint is deployed
35
35
> - Doesn't currently support VPN integration
36
36
> - Doesn't currently support ExpressRoute
37
-
> - Doesn't currently offer full functionality of health alerts, posture recommendations or security alerts
37
+
> - Doesn't currently offer full functionality of health alerts, posture recommendations, security alerts or advanced hunting data.
38
38
39
39
Once you've evaluated your infrastructure and requirements, follow the instructions for deploying the sensor based on the version you need.
Copy file name to clipboardExpand all lines: ATPDocs/deploy/prerequisites-sensor-version-3.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,10 +14,10 @@ This article describes the requirements for installing the Microsoft Defender fo
14
14
15
15
Before activating the Defender for Identity sensor v3.x, note that this version of the sensor is still in preview and has some limited functionality compared to version 2.x. Keep these limitations in mind before activating the sensor.
16
16
The Defender for Identity sensor v3.x:
17
-
- Requires that Defender for Endpoint is deployed on your endpoints
17
+
- Requires that Defender for Endpoint is deployed
18
18
- Doesn't currently support VPN integration
19
19
- Doesn't currently support ExpressRoute
20
-
- Doesn't currently offer full functionality of health alerts, posture recommendations or security alerts
20
+
- Doesn't currently offer full functionality of health alerts, posture recommendations, security alerts or advanced hunting data.
Copy file name to clipboardExpand all lines: ATPDocs/notifications.md
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,17 @@
1
1
---
2
2
title: Microsoft Defender for Identity notifications
3
3
description: Learn how to use and configure Microsoft Defender for Identity notifications in Microsoft Defender XDR.
4
-
ms.date: 09/03/2023
4
+
ms.date: 07/10/2025
5
5
ms.topic: how-to
6
6
#CustomerIntent: As a Defender for Identity user, I want to learn how to work with Defender for Identity notifications to make sure I'm up to date about events detected by Defender for Identity.
7
7
ms.reviewer: LiorShapiraa
8
8
---
9
9
10
10
# Defender for Identity notifications in Microsoft Defender XDR
11
11
12
+
>[!NOTE]
13
+
>This feature is currently supported only by the Defender for Identity sensor version 2.x.
14
+
12
15
Microsoft Defender for Identity provides notifications for health issues and security alerts, either via email notifications or to a Syslog server.
13
16
14
17
This article describes how to configure Defender for Identity notifications so that you're aware of any health issues or security alerts detected.
Copy file name to clipboardExpand all lines: ATPDocs/sensor-settings.md
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Manage and update sensors
3
3
description: Learn how to manage and update your Microsoft Defender for Identity sensors.
4
-
ms.date: 01/29/2023
4
+
ms.date: 07/10/2025
5
5
ms.topic: how-to
6
6
ms.reviewer: rlitinsky
7
7
---
@@ -104,6 +104,9 @@ The sensors page provides the following information about each sensor:
104
104
105
105
* Disabled
106
106
107
+
>[!NOTE]
108
+
>This feature is supported only by the Defender for Identity sensor version 2.x.
109
+
107
110
***Health status**: Displays the overall health status of the sensor with a colored icon representing the highest severity open health alert. Possible values are:
108
111
109
112
***Healthy (green icon)**: No opened health issues
@@ -143,6 +146,8 @@ Defender for Identity sensors support two kinds of updates:
143
146
> * Defender for Identity sensors always reserve at least 15% of the available memory and CPU available on the domain controller where it is installed. If the Defender for Identity service consumes too much memory, the service is automatically stopped and restarted by the Defender for Identity sensor updater service.
144
147
145
148
### Delayed sensor update
149
+
>[!NOTE]
150
+
>This feature is supported only by the Defender for Identity sensor version 2.x.
146
151
147
152
Given the rapid speed of ongoing Defender for Identity development and release updates, you may decide to define a subset group of your sensors as a delayed update ring, allowing for a gradual sensor update process. Defender for Identity enables you to choose how your sensors are updated and set each sensor as a **Delayed update** candidate.
Copy file name to clipboardExpand all lines: ATPDocs/uninstall-sensor.md
+12-9Lines changed: 12 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Uninstall the sensor
3
3
description: This article describes how to uninstall the Microsoft Defender for Identity sensor from domain controllers.
4
-
ms.date: 07/02/2025
4
+
ms.date: 07/07/2025
5
5
ms.topic: how-to
6
6
ms.reviewer: rlitinsky
7
7
---
@@ -22,21 +22,24 @@ Deactivating Defender for Identity capabilities from your domain controller does
22
22
23
23
## Delete a sensor
24
24
25
+
### For sensor v3.x
25
26
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Identities** > **Sensors**.
26
-
1. Select the domain controller where you want to deactivate Defender for Identity capabilities, select **Delete**, and confirm your selection.
27
+
2. Select the domain controller where you want to deactivate Defender for Identity capabilities, select **Delete**, and confirm your selection.
27
28
28
-
29
+
:::image type="content" source="media/screenshot-that-shows-how-to-delete-a-sensor.png" alt-text="Screenshot that shows how to delete a sensor." lightbox="media/screenshot-that-shows-how-to-delete-a-sensor.png":::
29
30
30
-
## Uninstall a sensor v2.x from a domain controller
31
+
>[!NOTE]
32
+
>This action removes the v3.x sensor and stops monitoring on that domain controller.
31
33
32
-
The following steps describe how to uninstall a sensor v2.x from a domain controller.
33
-
34
-
1. Sign in to the domain controller with administrative privileges.
35
-
1. From the Windows **Start** menu, select **Settings** > **Control Panel** > **Add/ Remove Programs**.
36
-
1. Select the sensor installation, select **Uninstall**, and follow the instructions to remove the sensor.
34
+
## Delete and uninstall a sensor v2.x from a domain controller
37
35
38
36
> [!IMPORTANT]
39
37
> We recommend removing the sensor from the domain controller before demoting the domain controller.
38
+
>
39
+
1. Sign in to the domain controller with administrative privileges.
40
+
2. From the Windows **Start** menu, select **Settings** > **Control Panel** > **Add/ Remove Programs**.
41
+
3. Select the sensor installation, select **Uninstall**, and follow the instructions to remove the sensor.
42
+
4. After uninstallation is complete, go to the Microsoft Defender portal > Settings > Identities > Sensors, select the domain controller, and choose Delete.
Copy file name to clipboardExpand all lines: ATPDocs/vpn-integration.md
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,17 @@
1
1
---
2
2
title: VPN integration | Microsoft Defender for Identity
3
3
description: Learn how to collect accounting information by integrating a VPN for Microsoft Defender for Identity in Microsoft Defender XDR.
4
-
ms.date: 08/31/2023
4
+
ms.date: 07/10/2025
5
5
ms.topic: how-to
6
6
#CustomerIntent: As a Defender for Identity user, I want to learn how to collect accounting information from VPN solutions.
7
7
ms.reviewer: martin77s
8
8
---
9
9
10
10
# Defender for Identity VPN integration in Microsoft Defender XDR
11
11
12
+
>[!NOTE]
13
+
>This feature is currently supported only by the Defender for Identity sensor version 2.x.
14
+
12
15
Microsoft Defender for Identity can integrate with your VPN solution by listening to RADIUS accounting events forwarded to Defender for Identity sensors, such as the IP addresses and locations where connections originated. VPN accounting data can help your investigations by providing more information about user activity, such as the locations from where computers are connecting to the network, and an extra detection for abnormal VPN connections.
13
16
14
17
Defender for Identity's VPN integration is based on standard RADIUS Accounting ([RFC 2866](https://tools.ietf.org/html/rfc2866)), and supports the following VPN vendors:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/anomaly-detection-policy.md
-7Lines changed: 0 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,13 +25,6 @@ Anomalies are detected by scanning user activity. The risk is evaluated by looki
25
25
26
26
Based on the policy results, security alerts are triggered. Defender for Cloud Apps looks at every user session on your cloud and alerts you when something happens that is different from the baseline of your organization or from the user's regular activity.
27
27
28
-
In addition to native Defender for Cloud Apps alerts, you'll also get the following detection alerts based on information received from Microsoft Entra ID Protection:
29
-
30
-
* Leaked credentials: Triggered when a user's valid credentials have been leaked. For more information, see [Microsoft Entra ID's Leaked credentials detection](/azure/active-directory/identity-protection/concept-identity-protection-risks#user-risk).
31
-
* Risky sign-in: Combines a number of Microsoft Entra ID Protection sign-in detections into a single detection. For more information, see [Microsoft Entra ID's Sign-in risk detections](/azure/active-directory/identity-protection/concept-identity-protection-risks#sign-in-risk).
32
-
33
-
These policies appear on the Defender for Cloud Apps policies page and can be enabled or disabled.
34
-
35
28
> [!IMPORTANT]
36
29
> Starting June 2025, Microsoft Defender for Cloud Apps began transitioning anomaly detection policies to a dynamic threat detection model. This model automatically adapts detection logic to the evolving threat landscape, keeping detections current without manual configuration or policy updates. As part of these improvements to overall security, and to provide more accurate and timely alerts, several legacy policies have been disabled:
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/network-requirements.md
+22-7Lines changed: 22 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,9 +8,23 @@ ms.topic: reference
8
8
# Network requirements
9
9
10
10
>[!IMPORTANT]
11
+
> **Important notice for GCC and Gov customers**
11
12
>
12
-
> **Take Immediate Action by April, 29 2025**, to ensure optimal service quality and prevent the interruption of some services. Update your firewall rules to allow outbound traffic on port 443 for the following IP addresses: 13.107.228.0/24, 13.107.229.0/24, 13.107.219.0/24, 13.107.227.0/24, 150.171.97.0/24. Alternatively, if you currently allow outbound traffic based on Azure service tags, please add the new Azure service tag, ‘AzureFrontDoor.MicrosoftSecurity’ to your allowlist. This tag will be adjusted to reflect the above range by April 28, 2025.
13
-
> This change only affects commercial customers of Microsoft Defender for Cloud Apps. Customers connected to the Gov US1 or GCC datacenters won't be affected.
13
+
> To prevent service disruption in Microsoft Defender for Cloud Apps, take immediate action by August 25, 2025.
14
+
> Update your firewall configuration as follows:
15
+
>
16
+
> Allow outbound traffic on port 443 to the following IP ranges:
17
+
>
18
+
> -`51.54.53.136/29`
19
+
> -`51.54.114.160/29`
20
+
> -`62.11.173.176/29`
21
+
>
22
+
> If you use Azure service tags for outbound traffic, add the Azure Gov service tag `AzureFrontDoor.MicrosoftSecurity` tag to your firewall allowlist.
23
+
>
24
+
> Add the following endpoint to your firewall allowlist on port 443:
> For portal access, instead of a wildcard (\*), you can choose to open only your specific tenant URL. For example, based on the screenshot above you can open: `contoso.us.portal.cloudappsecurity.com`. To determine your tenant URL, see the earlier section [View your data center](#view-your-data-center), and look for **API URL**.
@@ -151,8 +166,8 @@ To enable Defender for Cloud Apps to connect to your SIEM, add **outbound port 4
0 commit comments