Microsoft Defender for Identity: Automatic activation and Windows auditing for eligible licensed organizations

[What and why]

Microsoft is simplifying onboarding for Microsoft Defender for Identity by automatically configuring Defender for Identity for eligible licensed organizations that have not yet created a Defender for Identity workspace. This change helps organizations deploy identity threat detection and protection with less manual setup.

[Rollout schedule]

• Worldwide: Beginning in mid-October 2026 and expected to complete in mid-November 2026

[Impact on your organization]

Who is affected

• Licensed organizations that do not currently have a Microsoft Defender for Identity workspace configured.
• Organizations with eligible identity servers already onboarded to Defender for Endpoint.

What will happen

• Microsoft will automatically create the required Defender for Identity workspace configuration.
• Automatic activation of Defender for Identity v3.x sensors will be enabled.
• Automatic Windows auditing will be enabled.
• Supported servers include:
  • Domain Controllers
  • AD FS servers
  • AD CS servers
  • Microsoft Entra Connect servers

The change will be enabled automatically for eligible organizations. After enablement, administrators can disable the toggles in the Microsoft Defender portal under Settings > Identities > Advanced features.

[Action required and recommendations]

No action is required.

After Microsoft automatically enables these settings, administrators can disable them in the Microsoft Defender portal if needed:

• Go to Settings > Identities > Advanced features.
• Disable the relevant toggles.
• Update your organization’s onboarding and security documentation if you maintain internal deployment guidance for Defender for Identity.
• Inform your security operations team about the automatic onboarding behavior.

[Compliance considerations]

No compliance considerations identified, review as appropriate for your organization.