Microsoft Defender for Identity: Temporary limitation for Sensor Extended RPC Audit on Windows Server 2025

[What and Why:]

Following the publication of MC1309738, we want to inform you of a temporary limitation that applies to a subset of customers. The new Sensor Extended RPC Audit device tag is currently not supported on Microsoft Defender for Identity v3.x sensors running on Windows Server 2025 domain controllers.

[Rollout Schedule:]

General Availability (Worldwide): We plan to provide a fix for this issue by late July 2026.

[Impact on Your Organization:]

Who is affected: Organizations using Microsoft Defender for Identity v3.x sensors on Windows Server 2025 domain controllers

Platforms/Services:

• Microsoft Defender for Identity
• Active Directory domain controllers

What will happen:

• Applying the Sensor Extended RPC Audit device tag on Windows Server 2025 domain controllers running a v3.x sensor will not enable extended RPC auditing at this time.
• Sensors running on all other supported Windows Server versions are not affected and will continue to function as described in MC1309738.
• There is no impact to existing sensor functionality or detections.

[Action Required / Recommendations:]

• No action is required.
• If you manage Windows Server 2025 domain controllers:
  • Be aware that the new tag will not take effect until a future sensor update.
  • Continue using existing Defender for Identity monitoring and alerts as normal.
• We will enable support for this tag in a future v3.x sensor update and provide an additional Message center notice when it becomes available.

[Compliance considerations:]

Extended RPC audit logging is not enabled on Windows Server 2025 domain controllers until a future update.