Expanded identity threat detection

The October announcement introduces the following security alerts, grouped by identity platform.

Microsoft Entra ID

• Suspicious sign-in via Temporary Access Pass

Active Directory

• Kerberos privilege escalation using a diamond ticket
• Malicious Kerberos activity and CVE-2025-33073 exploitation attempt
• Malicious request of Data Protection API (DPAPI) master key
• Possible data exfiltration over DNS
• Suspicious Active Directory Certificate Services (AD CS) certificate request
• Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance abuse (ESC8)
• Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance over RPC (ESC11)
• Suspicious Active Directory Certificate Services (AD CS) misconfigured certificate template abuse (ESC1)
• Suspicious Certificate Authority (CA) certificate and private key theft
• Suspicious Kerberos PKINIT authentication (AS-REQ)
• Suspicious Kerberos ticket authorization data

Other identity providers — Okta

• Anomalous volume of failed Okta authentication attempts
• Multifactor authentication method added for a privileged Okta account
• Okta access or refresh token grant from a risky context
• Okta anomalous privileged account authentication
• Okta consent grant from a risky context
• Password of a privileged Okta account was reset by another account
• Secondary identity provider added in Okta

Sensor v3.x activation without Defender for Endpoint

You can now activate Microsoft Defender for Identity sensor v3.x on eligible domain controllers without first onboarding them to Microsoft Defender for Endpoint. This activation method is now generally available.

Eligibility and scope

• Supported on eligible domain controllers running Windows Server 2019 or later.
• Applies only to new sensor v3.x deployments.
• The domain controller must not have an existing Defender for Identity sensor.