Microsoft Defender for Identity: Activate the Unified Sensor now generally available

Microsoft Defender for Identity’s Unified Sensor is now generally available, enabling identity protections on qualifying domain controllers via the existing Defender for Endpoint agent without extra installation. Activation requires Windows Server 2019+, specific updates, and licensing. It simplifies identity alerts and attack disruption with no downtime. We’re excited to announce the general availability (GA) of the Unified Sensor for Microsoft Defender for Identity. This milestone simplifies the activation of identity protections on qualifying domain controllers by extending the existing Microsoft Defender for Endpoint agent. With just a few clicks, you can enable identity alerts, posture recommendations, and automatic attack disruption—no additional agent installation required. When this will happen General Availability (Worldwide, GCC, GCCH, and DoD): Available now. How this affects your organization Who is affected: Admins managing domain controllers with Microsoft Defender for Endpoint deployed. What will happen: The Unified Sensor can be activated on qualifying domain controllers. Identity-specific alerts and posture recommendations will begin flowing shortly after activation. No downtime is required for domain controllers. Existing licenses, capabilities, and alerts remain unaffected. Activation does not require additional installations. The Unified Sensor v3.x: Cannot be activated on servers with Defender for Identity sensor v2.x already deployed. Does not currently support VPN integration or ExpressRoute. Does not yet offer full functionality for health alerts, posture recommendations, security alerts, or advanced hunting data. What you can do to prepare Review deployment prerequisites to ensure your environment is ready. Go to the Activation page in the Microsoft Defender portal. Review all your eligible domain controllers (those onboarded with Microsoft Defender for Endpoint, version 2019 or above). Activate the new sensor on your domain controllers. Ensure your domain controllers meet the following minimum requirements: Windows Server 2019 or later. June 2025 Cumulative Update or later. Defender for Endpoint must be deployed. Domain controller must not already have Defender for Identity sensor v2.x installed. Server must have at least 2 cores and 6 GB RAM. Power Option should be set to High Performance. Time synchronization across servers must be within five minutes. If using virtualization: For Hyper-V: Disable Dynamic Memory. For VMware: Reserve all guest […]

The post Microsoft Defender for Identity: Activate the Unified Sensor now generally available appeared first on M365 Admin.