Install Microsoft Defender for Identity Sensor on All Domain Controllers

Microsoft Defender for Identity (MDI) monitors domain controller traffic and Active Directory signals to detect suspicious activity such as reconnaissance, pass-the-hash, DCSync attacks, and lateral movement. Coverage gaps occur when the sensor is not deployed on every domain controller, leaving blind spots attackers can exploit undetected.

Steps to implement

• Verify Microsoft Defender for Identity licensing (Microsoft 365 E5 or standalone MDI license) is available for the tenant.
• Create or confirm the MDI instance in the Microsoft Defender portal and configure directory service account or gMSA for sensor communication.
• Download the sensor installer for each domain controller, including read-only domain controllers (RODCs) and AD FS servers where applicable.
• Install the sensor on every domain controller, ensuring outbound connectivity to the MDI cloud service (port 443) is allowed.
• Validate sensor health status in the Defender portal and resolve any configuration or connectivity issues.
• Integrate MDI alerts with your SIEM/SOC workflow and review detected identity security posture recommendations regularly.
• Maintain sensor deployment as new domain controllers are provisioned, adding this step to your DC build checklist.