RECENTProduct updateAction required
Continued rollout of new health alert: Sensor v3.x RPC audit misconfigured
Analysis / inference: Microsoft is continuing the gradual rollout of the Sensor v3.x RPC Audit Misconfigured health alert to identify missing or misconfigured Enhanced RPC auditing.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft is continuing the gradual deployment of a health alert that identifies v3.x sensors lacking proper Enhanced RPC auditing configuration.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisWhy it matters
Ensures advanced identity detections function correctly by verifying that Enhanced RPC auditing configuration is properly applied across v3.x sensors.
Operational impact
SOC and identity engineering teams will see new health alerts if sensors are missing required RPC auditing configurations needed for advanced detections.
Section 03 · Recommended actions
- Review active Microsoft Defender for Identity health alerts for Sensor v3.x RPC Audit Misconfigured warnings.
- Follow documentation to configure Enhanced RPC auditing on v3.x sensors where misconfigurations are identified.
What to check
- Verify if your Microsoft Defender for Identity v3.x sensors have the Sensor v3.x RPC Audit Misconfigured health alert triggered.
- Check whether Enhanced RPC auditing is missing or incorrectly configured on your v3.x sensors.
Affected scope
ProductsDefender for Identity