Defender For Identity PowerShell module updates (version 1.0.0.4)
Analysis / inference: Microsoft released version 1.0.0.4 of the Defender for Identity PowerShell module with new remote domain functionality, dMSA auditing, and bug fixes.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new archive · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Version 1.0.0.4 introduces remote domain support, the SensorType parameter in Test-MDISensorApiConnection, Deleted Objects container permission handling, and dMSA auditing capabilities, alongside fixes for non-English OS audit checks.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis update introduces critical management and auditing capabilities, including support for Delegated Managed Service Accounts (dMSA) and Deleted Objects container permissions, directly impacting AD security hygiene.
Improves administrative visibility into Active Directory security configurations and resolves bugs affecting non-English operating systems and AD Web Services detection logic.
Section 03 · Recommended actions
- Upgrade the Microsoft Defender for Identity PowerShell module to version 1.0.0.4.
- Review and update automated scripts utilizing Test-MDISensorApiConnection to leverage the new SensorType parameter.
- Verify domain object auditing configurations for dMSA support.
- Verify the installed Defender for Identity PowerShell module version is 1.0.0.4 or higher.
- Review DomainObjectAuditing configurations for the newly added dMSA auditing functionality.
- Validate that Test-MDISensorApiConnection correctly resolves endpoint URLs using the new SensorType parameter.