Automatic migration from Defender for Identity Sensor v2 to v3.x and gMSA changes
Microsoft has enhanced Defender for Identity with the introduction of the new v3.x sensor, designed to simplify onboarding and streamline configura...
Read Article →Microsoft Defender for Identity Security Posts
Discover the latest insights, best practices, and security research related to Microsoft Defender for Identity.
Search Defender for Identity Posts
Filter Posts
Posts
Identity threat detection and response: Linking accounts
Intro This blog post covers a Defender for Identity feature that hasn’t received much attention. Despite flying under the radar, it’s a...
Read Article →Automatic Windows event auditing configuration for Defender for Identity V3.x sensor
Defender for Identity is crucial for capturing events, alerting on MDI threats, and collecting information from on-premises systems through the ins...
Read Article →MDI-configurator v1.0 is out !
A user-friendly graphical interface for managing Microsoft Defender for Identity (MDI) configurations using PowerShell. This PowerShell script prov...
Read Article →Defender for Identity — Automatic Windows event auditing configuration
Defender for Identity — Automatic Windows event auditing configurationOne of the most common issues we encounter during Defender for Identity asses...
Read Article →Microsoft Defender for Identity Recommended Actions: Ensure that all privileged accounts have the configuration flag
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Change password for KRBTGT account
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Change password of built-in domain Administrator account
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Built-in Active Directory Guest account is enabled
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: GPO can be modified by unprivileged accounts
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Remove non-admin accounts with DCSync permissions
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Remove local admins on identity assets
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Remove access rights on suspicious accounts with the Admin SDHolder permission
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Shedding Light on Dormant Sensitive Accounts
Microsoft Defender for Identity identifies users flagged as sensitive and provides additional insights, such as whether these accounts are inactive...
Read Article →Microsoft Defender for Identity Recommended Actions: GPO assigns unprivileged identities to local groups with elevated privileges
Identity leverages Secure Score with twenty-seven recommended actions. In a series of blog posts, I will go through all twenty-seven recommended ac...
Read Article →Microsoft Defender for Identity Recommended Actions: Unsafe permissions on the DnsAdmins group
Microsoft Secure Score helps organizations get insights into security posture based on security-related measurements. Microsoft Defender for Identi...
Read Article →Defender for Identity – Unveiling Enhanced Visibility – New Service Account Monitoring Capabilities
Last Updated on April 13, 2025 by Michael Morten Sonne Introduction Service accounts are often the unsung heroes… The post Defender for Ident...
Read Article →Microsoft Defender for Identity – New posture recommendations focusing on Active Directory
Last Updated on January 21, 2025 by Michael Morten Sonne Introduction Here at my blog, im committed to… The post Microsoft Defender for Ident...
Read Article →Microsoft Defender for Identity – Expands support to servers with Microsoft Entra Connect
Last Updated on June 2, 2025 by Michael Morten Sonne Intoduction What is Microsoft Defender for Identity Microsoft… The post Microsoft Defend...
Read Article →Microsoft Defender for Identity – How to manually remove a malfunctioning sensor that can’t be installed, uninstalled or removed
Last Updated on September 28, 2024 by Michael Morten Sonne Introduction Microsoft Defender for Identity (MDI) is designed… The post Microsoft...
Read Article →Analyzing MDE Network Inspections
Introduction Defender for Identity is a very important sensor to detect threats in an Active Directory environment. Therefore, it is important to m...
Read Article →Microsoft Defender for Identity – Updated Advanced Settings Page
Last Updated on February 24, 2024 by Michael Morten Sonne Intoduction Introducing the Updated Advanced Settings Page for… The post Microsoft ...
Read Article →Microsoft Defender for Identity – What is it, how to install it and setup requirements
Last Updated on September 26, 2024 by Michael Morten Sonne Intoduction What is Defender for Identity Microsoft Defender… The post Microsoft D...
Read Article →Microsoft Defender for Identity Deployment Guide
Deployment guide for Microsoft Defender for Identity.
Read Article →How to manually remove a malfunctioning MDI sensor, which cannot be removed through add/remove programs?
Microsoft Defender for Identity (MDI) has a built-in process that handles continues updates. I had a situation, where this process ... Read more
Read Article →How to implement Defender for Identity and configure all prerequisites
Microsoft Defender for Identity MDI (previously called Azure Advanced Threat Protection or Azure ATP) is a Microsoft security solution that capture...
Read Article →Use Microsoft Defender for Identity Response Actions for on-premises AD accounts
Microsoft announced recently the public availability of the native response actions in Defender for Identity. Security teams can now directly impac...
Read Article →Protecting against Lateral Movement with Defender for Identity and monitor with Azure Sentinel
Lateral movement refers to the techniques that a cyber attacker uses, after gaining initial access, to move deeper into a network in search of sens...
Read Article →