In September 2026, Microsoft further consolidated identity security visibility in Microsoft Defender XDR: the “What’s new” page lists the Identity Security dashboard and “Coverage & Maturity” as generally available. The detailed documentation remains cautious and still refers to gradual rollout. For SMEs, this is still a good moment to review the new view because it is designed to surface identity gaps across Entra ID, Active Directory, SaaS applications, and privileged access in one place.
What Microsoft announced in September
The Microsoft Learn page “What’s new in Microsoft Defender XDR” lists “Identity Security dashboard and Coverage & Maturity” as GA for September 2026. Microsoft describes the experience as a central view for identity-related risks and security maturity. It shows how well identities are protected across on-premises, cloud, SaaS, identity provider, and partner environments, where coverage is missing, and which tasks should be handled first.
This doesn’t move daily work away from Microsoft Entra ID or Defender for Identity. Instead, the new view brings together signals and tasks that smaller IT teams would otherwise collect from several portals, sensor lists, Secure Score recommendations, and cloud app connections.
Which identities need attention
Microsoft doesn’t describe identity protection only for user accounts. The Coverage and maturity page covers identity providers, SaaS identities, on-premises Active Directory identities, and PAM and IGA integrations. The Identity inventory documentation adds human and non-human identities, including service accounts, service principals, OAuth applications, and agentic identities.
- Human identities: users from Microsoft Entra ID, Active Directory, and connected SaaS applications.
- Non-human identities: service principals, OAuth apps, on-premises service accounts, and, in preview, AI-agent relationships.
- On-premises identities: Active Directory servers, sensor status, and open health issues.
- Partner and governance links: PAM and IGA integrations where they are detected or connected.
Deadlines, rollout, and prerequisites
Microsoft doesn’t state a retirement deadline or a mandatory immediate change for this update. The important point is accurate wording: the September overview calls the capability GA, while the detailed pages still say that the dashboard and Coverage and maturity page are rolling out gradually and might not yet be visible in every environment. This article therefore refers to September 2026, not to an unsupported exact day.
For “Coverage & Maturity”, Microsoft lists a Microsoft Defender for Cloud Apps or Defender for Identity license and at least the Security Reader role. For the dashboard, Microsoft lists Defender for Identity, Entra ID Identity Protection, and again at least Security Reader; viewing all recommendations can require higher permissions. This is not licensing advice, but a technical prerequisite from Microsoft documentation.
Why this matters for SMEs
In organizations with 10 to 250 seats, identity risk rarely lives in a single product. A few privileged accounts, old local service accounts, unconnected SaaS apps, or missing sensors can be enough to leave protection incomplete. Microsoft’s new view ranks tasks by security impact and effort; up to five top setup tasks are shown at the top of the page.
That helps smaller teams because they don’t have to discover every gap manually. The view doesn’t replace a review of the operating model, though. It shows which sources Defender detects, which connections are active, which actions remain open, and whether health issues exist for sensors or app connectors.
Next steps for review
- In the Defender portal under “Identities”, check whether the dashboard and “Coverage and maturity” are already visible.
- Document coverage scores for Identity providers, SaaS identities, On-premises identities, and PAM/IGA.
- Prioritize top setup tasks by high impact and low effort instead of trying to fix everything at once.
- For on-premises identities, review sensor status, discovered servers, V3 activation, V2 onboarding, and health issues separately.
- Export non-human identities and review highly privileged or unused accounts first.
Official Microsoft sources
- Microsoft Learn: What’s new in Microsoft Defender XDR
- Microsoft Learn: View your identity coverage and maturity
- Microsoft Learn: Identity Security dashboard in Microsoft Defender for Identity
- Microsoft Learn: View the Identity inventory
If you want to review identity coverage and Defender signals through a Microsoft Security Assessment, we can structure sources, roles, sensors, and next actions clearly – without turning that into licensing advice.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
