MC1187390 – M365 Change Digest

One-line summary

Defender for Identity adds RPC Configuration Health Alert for v3.x sensors, enabling proactive misconfiguration detection and advanced identity detections via the Unified Sensor RPC Audit tag.

Similar updates

Details

Summary

Microsoft Defender for Identity will roll out a new RPC Configuration Health Alert for v3.x sensors starting January 2026. It monitors RPC settings, improves detection accuracy, and uses the Unified Sensor RPC Audit tag for configuration enforcement and visibility in Device Inventory and Advanced Hunting.

Body (from Message Center)

Updated November 19, 2025: We have updated the timeline. Thank you for your patience.

[Introduction]

We’re introducing a new Remote Procedure Call (RPC) Configuration Health Alert for sensors v3.x in Microsoft Defender for Identity. This capability proactively monitors RPC configuration across your environment, helping administrators quickly identify and remediate misconfigurations that could impact detection accuracy or security posture. Additionally, applying the Unified Sensor RPC Audit tag enables advanced identity detections, improving security visibility and unlocking additional detection capabilities.

[When this will happen:]

General availability (Production, GCC, GCCH): We will begin rolling out early January 2026 (previously early December 2025) and expect to complete by mid-January 2026 (previously mid-December 2025).

[How this affects your organization:]

Who is affected: Admins managing Microsoft Defender for Identity v3.x sensors.
What will happen:
- A new health alert will monitor RPC configuration status on v3.x sensors.
- Applying the Unified Sensor RPC Audit tag will enforce configuration on existing and future v3.x sensors that match rule criteria.
- The tag will be visible in Device Inventory and Advanced Hunting, providing transparency and auditing capabilities.
- This feature improves detection accuracy and overall security coverage.

[What you can do to prepare:]

To apply the RPC Audit tag on your v3.x sensors:

In the Microsoft Defender portal, navigate to: System > Settings > Microsoft Defender XDR > Asset Rule Management.
Select Create a new rule.
Enter a Rule name and Description, then set conditions using Device name, Domain, or Device tag. Ensure the Defender for Identity v3.x sensor is deployed on targeted devices.
Add the tag Unified Sensor RPC Audit.
Review and submit the rule.

For more details, refer to Microsoft Defender for Identity documentation.

[Compliance considerations:]

No compliance considerations identified; review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-01-01T00:00:00Z",
    "ai_actions": [
      "Review and apply Unified Sensor RPC Audit tag to v3.x sensors",
      "Create Asset Rule Management rules as needed"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Defender for Identity adds RPC Configuration Health Alert for v3.x sensors, enabling proactive misconfiguration detection and advanced identity detections via the Unified Sensor RPC Audit tag.",
    "ai_topics": [
      "Defender"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "Microsoft Defender for Identity will roll out a new RPC Configuration Health Alert for v3.x sensors starting January 2026. It monitors RPC settings, improves detection accuracy, and uses the Unified Sensor RPC Audit tag for configuration enforcement and visibility in Device Inventory and Advanced Hunting."
    },
    "id": "MC1187390",
    "importance": 4,
    "is_major_change": false,
    "last_modified": "2025-11-19T17:30:54Z",
    "ms_products": [
      "Defender"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Defender XDR"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "New feature",
      "Admin impact"
    ],
    "title": "Unified sensor (v3.x) \u2013 new Remote Procedure Call (RPC) configuration health alert for Microsoft Defender for Identity"
  }
}