ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 272/272 feeds/APIs · 469/469 docs · 7/9 advisories · checked 14:23 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC1162274 Stay informedNew featureAdmin impact

New post-deployment configuration for unified sensors (preview)

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Microsoft Defender XDR
Microsoft 365 admin center

Rollout

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

What the notice says

Microsoft’s text, safely structured

Introduction

We’re introducing a new post-deployment configuration option for unified sensors (V3.x) in Microsoft Defender for Identity (preview). This update enhances security and enables advanced identity detections by allowing admins to apply the new Unified Sensor RPC Audit tag to domain controllers onboarded with the unified sensor (v3.x). This tag activates Remote Procedure Call (RPC) monitoring using the Windows Filtering Platform (WFP), which is required for advanced identity detections.

When this will happen

Preview (Worldwide): Rollout will begin in late September 2025 and is expected to complete by mid-October 2025.

Preview (GCC, GCCH, and DoD): Rollout will begin in late September 2025 and is expected to complete in late October 2025.

How this affects your organization

  • Who is affected: This configuration option applies only to devices running the unified sensor (v3.x).
  • What will happen:
    • A new configuration option will be available in Asset rule management.
    • Admins can apply the Unified Sensor RPC Audit tag to onboarded domain controllers running the unified sensor (v3.x).
    • Devices with this tag will have WFP-based RPC monitoring enabled.
    • Once applied, the configuration is enforced on existing and future devices that match the rule criteria.
    • Tagged devices will appear in Device inventory for visibility and auditing.
    • This feature is opt-in and not enabled by default.

What you can do to prepare

  • No action is required unless you want to enable the feature.
  • If needed, enable the new configuration option by creating an asset management rule to apply the tag.
  • Communicate this change to your security and compliance teams.

Learn more: Microsoft Defender for Identity sensor v3.x prerequisites (Preview)

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.

What changed

Between archive captures, newest first

The archive supplies one version of this notice.

Learn more

Links from the notice and their documentation checks

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
  • 2 linked pages have not been read yet.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 27 Oct 14:23 UTC · 272 of 272 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.