Automatic Windows event auditing configuration for sensors v3.x is now generally available
Analysis / inference: Microsoft Defender for Identity has released general availability for automatic Windows event auditing configuration on v3.x sensors.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Automatic Windows event-auditing configuration for sensors version 3.x has reached General Availability, dynamically applying required audit settings to new sensors and remediating misconfigurations on existing ones.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisEnsures that domain controllers monitored by Microsoft Defender for Identity have the required event auditing settings consistently applied, reducing blind spots caused by missing configuration.
Reduces administrative overhead by eliminating manual audit policy configuration tasks for newly deployed sensors.
Section 03 · Recommended actions
- Review Defender for Identity sensor versions to ensure they are updated to v3.x.
- Verify that automated auditing adjustments do not conflict with local compliance baselines or Group Policy Objects.
- Verify that Defender for Identity sensor version 3.x is deployed across domain controllers.
- Confirm whether automatic Windows event-auditing configuration is actively managing audit policies.