check before: 2025-12-15
Product:
Defender, Defender for Identity, Defender XDR, Entra, Microsoft Graph, Purview Audit (Premium), Windows
Platform:
Developer, Online, US Instances, World tenant
Status:
Change type:
Admin impact, New feature, Updated message
Links:
Details:
Summary:
An opt-in feature for automatic Windows event-auditing configuration in Defender for Identity unified sensors (V3.x) will be available mid-December 2025. It simplifies deployment by auto-applying required settings, affects all sensors in a tenant, requires admin activation, and addresses specific auditing health issues.
Details:
Updated November 19, 2025: We have updated the timeline. Thank you for your patience.
[Introduction]
We're introducing a new opt-in feature for automatic event-auditing configuration in Defender for Identity unified sensors (V3.x). This enhancement simplifies deployment by allowing admins to automatically apply the required Windows event-auditing settings on their sensors. It reduces manual post-deployment steps and ensures consistent policy enforcement across all onboarded sensors.
[When this will happen:]
General Availability (Worldwide, GCC, GCCH, and DoD): The auditing opt-in feature will be available starting mid-December 2025 (previously mid-November), with rollout expected to complete within the same timeframe.
General Availability (Worldwide, GCC, GCCH, and DoD): The related auditing health alerts will be released gradually by mid-January 2026 (previously mid-December).
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-11-18
updated:
2025-11-20
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
XXXXXXX ... free basic plan only
Direct effects for Operations**
Automatic Event Auditing Configuration
If the automatic event auditing configuration is enabled without proper preparation, it may lead to misconfigured auditing settings, resulting in potential security gaps and compliance issues.
- roles: IT Admin, Security Officer
- references: https://learn.microsoft.com/defender-for-identity/deploy/prerequisites-sensor-version-3, https://learn.microsoft.com/defender-for-identity/health-alerts
User Experience Impact
Users may experience disruptions or inconsistencies in security monitoring if the automatic configuration is not properly communicated or if existing sensors are misconfigured, leading to potential security incidents.
- roles: End User, IT Support
- references: https://learn.microsoft.com/defender-for-identity/deploy/prerequisites-sensor-version-3, https://learn.microsoft.com/defender-for-identity/health-alerts
Configutation Options**
XXXXXXX ... paid membership only
Data Protection**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2025-11-20 | MC MessageTagNames | New feature, Admin impact | Updated message, New feature, Admin impact |
| 2025-11-20 | MC Summary | Defender for Identity unified sensors (V3.x) will offer an opt-in feature from mid-Nov 2025 to automatically configure Windows event-auditing settings, simplifying deployment and ensuring consistent policies. Admins must enable this feature manually; it applies to all sensors and addresses specific auditing health issues. | An opt-in feature for automatic Windows event-auditing configuration in Defender for Identity unified sensors (V3.x) will be available mid-December 2025. It simplifies deployment by auto-applying required settings, affects all sensors in a tenant, requires admin activation, and addresses specific auditing health issues. |
| 2025-11-20 | MC Last Updated | 11/18/2025 00:56:49 | 2025-11-19T18:36:40Z |
| 2025-11-20 | MC Messages | [Introduction]
We're introducing a new opt-in feature for automatic event-auditing configuration in Defender for Identity unified sensors (V3.x). This enhancement simplifies deployment by allowing admins to automatically apply the required Windows event-auditing settings on their sensors. It reduces manual post-deployment steps and ensures consistent policy enforcement across all onboarded sensors. [When this will happen:] General Availability (Worldwide, GCC, GCCH, and DoD): The auditing opt-in feature will be available starting mid-Nov 2025, with rollout expected to complete within the same timeframe. General Availability (Worldwide, GCC, GCCH, and DoD): The related auditing health alerts will be released gradually by mid-December 2025. | Updated November 19, 2025: We have updated the timeline. Thank you for your patience.
[Introduction] We're introducing a new opt-in feature for automatic event-auditing configuration in Defender for Identity unified sensors (V3.x). This enhancement simplifies deployment by allowing admins to automatically apply the required Windows event-auditing settings on their sensors. It reduces manual post-deployment steps and ensures consistent policy enforcement across all onboarded sensors. [When this will happen:] General Availability (Worldwide, GCC, GCCH, and DoD): The auditing opt-in feature will be available starting mid-December 2025 (previously mid-November), with rollout expected to complete within the same timeframe. General Availability (Worldwide, GCC, GCCH, and DoD): The related auditing health alerts will be released gradually by mid-January 2026 (previously mid-December). |
| 2025-11-20 | MC Title | Automatic Windows event auditing configuration now available for unified sensors (V3.x) | (Updated) Automatic Windows event auditing configuration now available for unified sensors (V3.x) |
| 2025-11-20 | MC End Time | 01/30/2026 09:00:00 | 2026-02-23T09:00:00Z |
Last updated 2 weeks ago ago
