Microsoft Defender for Identity auto-activation and auto-auditing automatic enablement
Rollout
Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".
What the notice says
Microsoft's text, with its sections, lists and tables; source markup removedWhat and Why
Microsoft Defender for Identity will automatically enable auto-activation and auto-auditing for eligible tenants using Defender for Identity sensor v3.x. Auto-activation helps activate eligible servers that are already onboarded to Microsoft Defender for Endpoint, and auto-auditing helps configure the required Windows event auditing.
This update supports enterprise-ready security operations by helping organizations complete Defender for Identity sensor activation and auditing setup with less manual configuration.
Rollout Schedule
- General Availability, Worldwide: We will begin rolling out in late October 2026 and will roll out gradually.
- Before enablement begins, a banner will appear in the Microsoft Defender portal under Settings > Identities > Sensor management.
Impact on Your Organization
Who is affected
- Organizations using Microsoft Defender for Identity sensor v3.x.
- Security administrators who manage Microsoft Defender for Identity sensors and Microsoft Defender XDR settings.
- Servers already onboarded to Microsoft Defender for Endpoint that are eligible for Defender for Identity sensor activation.
Platforms/Services
- Microsoft Defender for Identity.
- Microsoft Defender XDR portal.
- Microsoft Defender for Endpoint.
What will happen
- Auto-activation will help activate eligible servers that are already onboarded to Microsoft Defender for Endpoint.
- Auto-auditing will help configure the required Windows event auditing for Defender for Identity.
- A banner will be shown in the Microsoft Defender portal before enablement starts.
- Admins can use the banner to opt out during the limited opt-out period.
- After the opt-out period ends and rollout starts, admins can still manually change the toggle status at any time in Settings > Advanced features.
Action Required/Recommendations
- Review the banner in the Microsoft Defender portal if your organization wants to opt out before gradual rollout starts.
- Review your current Defender for Identity sensor activation and Windows event auditing configuration.
- Update internal security operations or deployment guidance if it references manual activation or auditing steps for Defender for Identity sensor v3.x.
- For special cases related to the feature or opt-out, contact the Defender for Identity support team.
- Learn more about sensor activation: https://learn.microsoft.com/en-us/defender-for-identity/deploy/activate-sensor.
- Learn more about automatic Windows event auditing: https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection.
Compliance considerations
| Does the change include an admin control and, can it be controlled through Entra ID group membership? | The feature includes or affects admin controls, policies, permissions, roles, authentication, or management settings as described in this message. Review the linked documentation or admin center controls for group-based configuration support. |
|---|
What changed
Between the versions this installation saw, newest firstThis installation has seen one version of this notice, first on 22 Oct 2026. Later changes will show here.
Linked documentation
Microsoft pages the notice links toRelated public evidence
No related evidence found in this installation's recent collection. This does not establish that no announcement exists.
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- Versions before 22 Oct 2026: this installation first saw the notice after Microsoft posted it.
- 2 linked pages have not been read yet.
- Some history or links were left out of the website export to keep it within its size limits.