check before: 2026-01-01
Product:
Defender, Defender for Identity, Defender XDR
Platform:
Online, US Instances, World tenant
Status:
Change type:
Admin impact, New feature, Updated message
Links:
Details:
Summary:
Microsoft Defender for Identity will roll out a new RPC Configuration Health Alert for v3.x sensors starting January 2026. It monitors RPC settings, improves detection accuracy, and uses the Unified Sensor RPC Audit tag for configuration enforcement and visibility in Device Inventory and Advanced Hunting.
Details:
Updated November 19, 2025: We have updated the timeline. Thank you for your patience.
[Introduction]
We're introducing a new Remote Procedure Call (RPC) Configuration Health Alert for sensors v3.x in Microsoft Defender for Identity. This capability proactively monitors RPC configuration across your environment, helping administrators quickly identify and remediate misconfigurations that could impact detection accuracy or security posture. Additionally, applying the Unified Sensor RPC Audit tag enables advanced identity detections, improving security visibility and unlocking additional detection capabilities.
[When this will happen:]
General availability (Production, GCC, GCCH): We will begin rolling out early January 2026 (previously early December 2025) and expect to complete by mid-January 2026 (previously mid-December 2025).
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-11-18
updated:
2025-11-20
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
XXXXXXX ... free basic plan only
Direct effects for Operations**
RPC Configuration Health Alert Implementation
Without proper preparation, the rollout of the new RPC Configuration Health Alert may lead to misconfigurations that could compromise detection accuracy and security posture, resulting in potential security vulnerabilities.
- roles: IT Administrators, Security Analysts
- references: https://learn.microsoft.com/defender-for-identity/
Unified Sensor RPC Audit Tag Application
If the Unified Sensor RPC Audit tag is applied without adequate planning, it may lead to unintended enforcement of configurations that disrupt existing workflows or device operations, negatively impacting user experience.
- roles: IT Administrators, End Users
- references: https://learn.microsoft.com/defender-for-identity/
Configutation Options**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2025-11-20 | MC Last Updated | 11/18/2025 00:49:38 | 2025-11-19T18:30:54Z |
| 2025-11-20 | MC Messages | [Introduction]
We're introducing a new Remote Procedure Call (RPC) Configuration Health Alert for sensors v3.x in Microsoft Defender for Identity. This capability proactively monitors RPC configuration across your environment, helping administrators quickly identify and remediate misconfigurations that could impact detection accuracy or security posture. Additionally, applying the Unified Sensor RPC Audit tag enables advanced identity detections, improving security visibility and unlocking additional detection capabilities. [When this will happen:] General availability (Production, GCC, GCCH): We will begin rolling out early December 2025 and expect to complete by mid-December 2025. | Updated November 19, 2025: We have updated the timeline. Thank you for your patience.
[Introduction] We're introducing a new Remote Procedure Call (RPC) Configuration Health Alert for sensors v3.x in Microsoft Defender for Identity. This capability proactively monitors RPC configuration across your environment, helping administrators quickly identify and remediate misconfigurations that could impact detection accuracy or security posture. Additionally, applying the Unified Sensor RPC Audit tag enables advanced identity detections, improving security visibility and unlocking additional detection capabilities. [When this will happen:] General availability (Production, GCC, GCCH): We will begin rolling out early January 2026 (previously early December 2025) and expect to complete by mid-January 2026 (previously mid-December 2025). |
| 2025-11-20 | MC Summary | Microsoft Defender for Identity introduces a new RPC Configuration Health Alert for v3.x sensors, rolling out December 2025. It monitors RPC settings, improves detection accuracy, and enables the Unified Sensor RPC Audit tag for enhanced security visibility and auditing via Device Inventory and Advanced Hunting. | Microsoft Defender for Identity will roll out a new RPC Configuration Health Alert for v3.x sensors starting January 2026. It monitors RPC settings, improves detection accuracy, and uses the Unified Sensor RPC Audit tag for configuration enforcement and visibility in Device Inventory and Advanced Hunting. |
| 2025-11-20 | MC MessageTagNames | New feature, Admin impact | Updated message, New feature, Admin impact |
| 2025-11-20 | MC End Time | 01/14/2026 09:00:00 | 2026-02-23T09:00:00Z |
Last updated 2 months ago ago
