Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
For complete protection of your on-premises deployment, activate the Defender for Identity sensor v3.x on all eligible servers. Supported server types include domain controllers and AD FS, AD CS, or Microsoft Entra Connect servers that aren't domain controllers. Eligible servers must meet the sensor v3.x prerequisites, including Windows Server 2019 or later. For supported servers running older operating systems, deploy the Defender for Identity sensor v2.x instead.
Note
Activating the Defender for Identity sensor v3.x on AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers is in preview.
Prerequisites
See Microsoft Defender for Identity sensor v3.x prerequisites for system requirements and Sensor version limitations for supported scenarios before activating the Defender for Identity sensor v3.x on eligible servers.
Review the Activation page
The Activation page displays all servers from your device inventory. Defender for Identity detects your servers and their configuration. Each server's activation state shows whether the server is eligible for the v3.x sensor and what action to take.
You can activate eligible domain controllers automatically or manually. AD FS, AD CS, and Microsoft Entra Connect servers that aren't domain controllers currently support manual activation only. Automatic activation and migration aren't currently supported for these servers and will be added in a future update.
To turn on automatic activation for eligible domain controllers, use the Automatic sensor v3.x activation toggle on the Advanced features page (Settings > Identities > Advanced features). Automatic activation applies only to eligible servers onboarded to Defender for Endpoint. It doesn't apply to onboarding without Defender for Endpoint deployment or to migration from sensor v2.x to sensor v3.x.
| Activation state | Next steps |
|---|---|
| Install sensor v2.x | Deploy the Defender for Identity sensor v2.x from the Sensors page. |
| OS upgrade is required | This server is running an unsupported operating system version for the v3.x sensor. Upgrade the server to a supported version. |
| Activate sensor v3.x | The server is already onboarded to Defender for Endpoint. Activate the v3.x sensor. |
Activate the Defender for Identity sensor v3.x
Perform the following steps to activate the Defender for Identity sensor v3.x on an eligible server:
In the Microsoft Defender portal, go to System > Settings > Identities > Activation.
Select the eligible server where you want to activate Defender for Identity, and select Activate. Confirm your selection when prompted.
When v3.x sensor activation for the selected server is complete, a green success banner appears. In the banner, select Click here to see the onboarded servers. The Sensors page opens, where you can check the sensor's health.
Confirm sensor activation
To confirm that the v3.x sensor is working:
- In the Microsoft Defender portal, go to System > Settings > Identities > Sensors.
- Check that the activated server is listed.
Note
The first Defender for Identity sensor v3.x activation in your environment might take up to an hour to show as Running on the Sensors page. Subsequent activations appear within five minutes. Activation doesn't require a restart.