New Defender for Identity health alert for missing domain controller network traffic

Microsoft Defender for Identity now includes a health alert for missing domain controller network traffic, helping administrators detect traffic collection issues affecting visibility. The alert appears in sensor health tabs, requires no pre-rollout action, and guides troubleshooting if triggered after rollout. No impact on end users or compliance.

[What and Why:]

Microsoft Defender for Identity is introducing an updated workspace health alert that helps administrators identify when no network traffic activity is being received from domain controllers through Defender for Identity sensors. This alert is designed to surface traffic collection issues that can reduce visibility, including missing or misconfigured port mirroring, packet capture driver issues, or network traffic that is not reaching the sensor.

After rollout, administrators will see the new health alert in the Sensors health issues tab and the global Health issues experience when Defender for Identity is not receiving the expected domain controller network activity. The alert helps identify potential gaps in Defender for Identity network visibility and traffic collection.

[Rollout Schedule:]

• Available now

[Impact on Your Organization:]

Who is affected:

• Organizations using Microsoft Defender for Identity sensors to monitor domain controller traffic.

Services: Microsoft Defender for Identity

• A new health alert will be displayed when expected domain controller network traffic is not being received by Defender for Identity sensors.
• The alert will appear in the Sensors health issues tab and the global Health issues experience.
• The alert helps administrators identify traffic collection visibility gaps that could affect threat detection and monitoring.
• No changes to end-user experiences are expected.

[Action Required/Recommendations:]

No action is required before the rollout.

If the alert appears after rollout, administrators should:

• Verify that the Defender for Identity sensor service is running.
• Validate that network traffic is flowing between the corporate network and domain controllers.
• Confirm that port mirroring is configured correctly for standalone sensor deployments.
• Verify Npcap or other packet capture driver configurations, where applicable.
• Disable Receive Segment Coalescing (RSC) on the sensor capture network interface card (NIC).

[Compliance Considerations:]

No compliance considerations identified, review as appropriate for your organization.