Microsoft expanded the documentation for Microsoft Defender for Identity in September 2026: sensor v3.x can now be planned not only for domain controllers, but also for identity servers running AD FS, AD CS, and Microsoft Entra Connect. Microsoft describes a preview path for activating the v3.x sensor on domain controllers without first onboarding them to Defender for Endpoint. For SMEs with hybrid identity, this is a useful point to review sensor coverage before blind spots remain around Active Directory, certificate services, or Entra Connect.
What Microsoft changed in September
The Microsoft Learn page “What’s new – Microsoft Defender for Identity” lists three September 2026 updates: sensor v3.x onboarding without a Microsoft Defender for Endpoint deployment as preview, sensor v3.x support for additional identity server roles, and a combined “Sensor management” tab in the on-premises identity settings. The related how-to pages were updated on 9 and 10 September and describe activation, prerequisites, and management.
The operational message is straightforward: Defender for Identity is meant to make more identity-critical systems directly visible. Domain controllers remain central, but AD FS, AD CS, and Microsoft Entra ID Connect servers are also security-relevant because they influence sign-in, certificates, and synchronization.
Which servers need attention now
Microsoft lists domain controllers as supported server types for sensor v3.x, as well as servers that aren’t domain controllers and run one of these roles: Active Directory Federation Services, Active Directory Certificate Services, or Microsoft Entra Connect. For these additional roles, activation is in preview according to Microsoft; manual activation and automatic Windows event auditing are supported, while automatic activation and migration aren’t currently supported.
- Domain controllers remain the minimum baseline; if you deploy v3.x only on AD FS, AD CS, or Entra Connect servers, Microsoft says you also need at least one v3.x sensor on a domain controller.
- Eligible servers must run Windows Server 2019 or later and have the July 2026 or later cumulative update installed.
- Servers that already have sensor v2.x installed aren’t candidates for parallel v3.x activation; migration readiness needs a separate check.
- For domain controllers, Microsoft also documents preview onboarding without a prior Defender for Endpoint deployment.
Deadlines and prerequisites without exaggeration
Microsoft doesn’t state a hard retirement deadline for this September update. There are still concrete prerequisites to verify before activation: operating system level, July 2026 update, existing sensor state, network connectivity to Defender service endpoints, memory allocation for virtual machines, and the required administrator permissions. The documentation also calls out limitations: sensor v3.x doesn’t support VPN integration, doesn’t support syslog notifications, and has limitations with Azure ExpressRoute.
For smaller IT teams, that matters. A sensor rollout isn’t just a portal click-through; it touches domain controllers, certificate services, and synchronization servers. Before activation, teams should know which systems are production-critical, where maintenance windows are available, and who will review health alerts.
What changes for accounts and updates
Microsoft describes a different operating model for sensor v3.x than for older sensors. The v3.x sensor uses LocalSystem to read Active Directory data and to perform remediation actions. Directory Service Accounts or gMSA accounts aren’t used by v3.x for those purposes. In mixed environments, however, legacy DSA or gMSA configurations can still be validated at workspace level and generate health alerts as long as v2.x sensors still require them.
Updates also work differently: sensor v3.x is delivered as a Microsoft Defender for Endpoint component through Windows Update. The delayed sensor update option documented for v2.x sensors doesn’t apply to v3.x. That makes it sensible to look at sensor versions and server patch processes together.
Next steps for SMEs
- Export the sensor list from “Sensor management” and mark domain controllers, AD FS, AD CS, and Entra Connect servers.
- For each server, check Windows version, July 2026 update level, migration state, sensor status, service status, and open health issues.
- Test prerequisites with Microsoft’s
Test-MdiReadiness.ps1script before activating production identity servers. - Turn on automatic sensor v3.x activation only deliberately for eligible domain controllers; plan additional roles separately.
- Document who reviews health alerts and how the team responds to “Disconnected”, “Start failed”, or “Not Configured”.
Official Microsoft sources
- Microsoft Learn: What’s new – Microsoft Defender for Identity
- Microsoft Learn: Deploy the Microsoft Defender for Identity sensor v3.x
- Microsoft Learn: Activate the Microsoft Defender for Identity sensor v3.x
- Microsoft Learn: Manage and update Microsoft Defender for Identity sensors
If you want to review hybrid identity through a Microsoft Security Assessment or Defender operations check, we can assess sensor coverage, roles, and operating processes in a structured way – without turning that into licensing advice.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
