MC1193410 – (Updated) Automatic Windows event auditing configuration availability for unified sensors (V3.x)

Product:

Defender, Defender for Identity, Defender XDR, Entra, Microsoft Graph, Purview Audit (Premium), Windows

Platform:

Developer, Online, US Instances, World tenant

Status:

Change type:

Admin impact, Feature update, Updated message

Links:

Details:

Summary:
Microsoft Defender for Identity unified sensors (v3.x) will offer an opt-in feature from mid-January 2026 to automatically configure Windows event-auditing settings, simplifying deployment and ensuring consistent policy enforcement. Admins must enable it via UI or Graph API; rollout completes by end of January 2026.

Details:
Updated January 6, 2026: We have updated the timeline. Thank you for your patience.
[Introduction]
We're introducing a new opt-in feature for automatic event-auditing configuration in Microsoft Defender for Identity unified sensors (v3.x). This enhancement simplifies deployment by automatically applying the required Windows event-auditing settings on sensors, reducing manual post-deployment steps and ensuring consistent policy enforcement across all onboarded sensors.
[When this will happen:]
General Availability (Worldwide, GCC, GCCH, and DoD): The auditing opt-in feature will be available starting mid-January 2026 (previously early January), with rollout expected to complete by end of January 2026 (previously mid-January). Until then, it will remain disabled in the portal.
Related auditing health alerts will also roll out gradually starting mid-January 2026 (previously early January), completing by end of January 2026 (previously mid-January).

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2025-12-09

updated:
2026-01-07

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Automatic Configuration of Windows Event Auditing
If the automatic configuration feature is enabled without proper preparation, it may lead to misconfigured auditing settings, resulting in potential security gaps and compliance issues.
   - roles: IT Admin, Security Analyst
   - references: https://learn.microsoft.com/defender-for-identity/deploy/configure-windows-event-collection, https://learn.microsoft.com/defender-for-identity/deploy/prerequisites-sensor-version-3#configure-windows-event-auditing

Delayed Application of Auditing Settings
The automatic configuration process may take up to 24 hours to apply, which could leave systems vulnerable during this period if the feature is enabled without prior assessment.
   - roles: IT Admin, Compliance Officer
   - references: https://learn.microsoft.com/defender-for-identity/deploy/configure-windows-event-collection, https://learn.microsoft.com/defender-for-identity/health-alerts

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Imagine you are organizing a large event, like a conference, and you have to ensure that every attendee receives the correct materials and information upon arrival. Previously, you might have had to manually check each attendee's details and hand them the appropriate materials, which could be time-consuming and prone to errors if not done consistently.

Now, let's relate this to the IT change in Microsoft Defender for Identity. Microsoft is introducing a new feature that automatically sets up Windows event-auditing settings for its Defender for Identity sensors. Think of this feature as an automated system at your conference that instantly checks each attendee's details and hands them the correct materials without you having to do it manually. This system ensures that every attendee receives the right information consistently and efficiently.

In the IT world, this means that once the feature is enabled, the necessary security settings are automatically applied to new sensors during their setup. For existing sensors, it checks if they are configured correctly and fixes any issues. This reduces the manual work for IT admins and ensures that all sensors are consistently following the same security policies.

However, just like you would need to decide whether to use the automated system at your conference, IT admins need to opt-in to use this new feature. It’s not turned on by default, so no changes will happen unless they choose to enable it. Once enabled, it might take a little time (up to 24 hours) for the changes to apply across all sensors, similar to how an automated system might take a bit of time to process all attendees at a large event.

This change is aimed at simplifying the deployment process and ensuring that security policies are enforced consistently, much like how an automated system at a conference ensures every attendee gets the right materials efficiently.