Sensor v3.x support for additional identity server roles: AD CS, AD FS, and Entra Connect (Preview)
Analysis / inference: Microsoft Defender for Identity sensor version 3.x introduces preview support for deploying sensors on standalone AD FS, AD CS, and Microsoft Entra Connect servers.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Defender for Identity sensor v3.x expanded its compatibility matrix to include eligible servers running AD FS, AD CS, or Microsoft Entra Connect that do not function as domain controllers and currently lack a sensor.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisExpanding Microsoft Defender for Identity sensor v3.x coverage allows security teams to monitor critical ancillary identity infrastructure—specifically AD FS, AD CS, and Microsoft Entra Connect servers—even when those servers are not domain controllers.
Enables extended threat visibility and telemetry ingestion across auxiliary identity infrastructure components that previously lacked standalone sensor support.
Section 03 · Recommended actions
- Review the sensor v3.x prerequisites for non-domain controller identity servers
- Plan evaluation deployments for preview coverage on AD FS, AD CS, and Microsoft Entra Connect infrastructure
- Verify if AD FS, AD CS, or Microsoft Entra Connect servers exist in your environment without domain controller roles
- Review the Defender for Identity sensor v3.x prerequisites documentation for deployment requirements