Skip to content
← Back to the guide

Microsoft Defender for Identity sensor deployment

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

Microsoft Defender for Identity sensor deployment

How to plan and roll out Defender for Identity sensors — DCs, AD FS, Entra Connect, and tuning.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

Where sensors go

MDI deploys lightweight sensors on:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

DC sensor coverage

For domain controllers specifically:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

Performance

Sensors are deliberately lightweight:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Deployment

The typical deployment:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Tuning detections

Out of the box, MDI generates more alerts than steady-state operations need. Initial tuning:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Defender XDR integration

MDI signals flow into Microsoft Defender XDR alongside Defender for Endpoint, Defender for Office 365, and Defender for Cloud Apps. The most valuable detections come from cross-product correlation — a phishing email lea…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

What MDI doesn't replace

MDI detects identity-based attacks against AD and Entra ID. It complements but doesn't replace:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment

Slide 8Download PNG

Auto-generated from Microsoft Defender for Identity sensor deployment. This page is not indexed and isn't part of the guide itself.