Automatic sensor v3.x activation and Windows auditing by default
Analysis / inference: Microsoft Defender for Identity is rolling out automatic sensor v3.x activation and default Windows auditing for eligible servers based on licensing and onboarding dates.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft Defender for Identity now automatically creates workspaces, activates v3.x sensors on eligible identity-role servers, and turns on Windows auditing by default for new Defender for Endpoint customers onboarded on or after September 13, 2026, while rolling out a gradual notice-and-enablement process with an opt-out option for existing customers.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisMicrosoft Defender for Identity is introducing automated workspace creation, v3.x sensor activation, and default Windows auditing for eligible servers, which changes default configurations for both new and existing environments.
Eligible identity-role servers onboarded to Defender for Endpoint will have the Defender for Identity sensor capability activated and Windows auditing enabled automatically unless existing customers explicitly opt out during the notice window.
Section 03 · Recommended actions
- Monitor the Defender portal Sensor management tab for upcoming automatic enablement notifications
- Evaluate organizational readiness for automatic v3.x sensor activation and default Windows auditing
- Select Opt out in the Defender portal prior to the expiration of the notice period if automatic enablement is not desired
- Check the Sensor management tab of the On-premises settings page in the Defender portal for pending automatic enablement notices
- Verify whether your organization's initial Defender for Endpoint onboarding date falls on or after September 13, 2026
- Review current Windows event auditing and MDI sensor coverage on identity-role servers