MC1234542 High Major change
Retirement of “Suspected identity theft (pass-the-ticket)” classic alert
Summary AI-generated
The classic 'Suspected identity theft (pass‑the‑ticket)' alert in Defender for Identity will be retired between March 18-22, 2026; use the 'Pass-the-Ticket (PtT) attack' XDR detector instead.
Suggested actions AI-generated
- Update alert triage and automation for new XDR detector ID
- Notify security and ops teams about alert retirement
- Update internal documentation
- Review XDR Alert Tuning documentation
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1187386 Microsoft Defender for Identity alerts transitioning to XDR-based detection platform
- MC1254554 Upcoming retirement of select threat detections in Microsoft Defender for Cloud Apps
- MC1217649 Endpoint DLP-sensitive data alerting retiring in Defender; use Purview DLP
- MC1465771 Microsoft Defender XDR: DLP alerts will be set as behaviors by default
- MC1228325 (Public Preview) New built in alert tuning rules for Microsoft Defender for Endpoint in Microsoft Defender XDR
- MC1187397 Microsoft Defender for Endpoint: Threat actor attribution information will be removed from alert page
Original post from Microsoft
[Introduction]
To streamline our alert catalog and focus investment on our unified Microsoft Defender XDR detection capabilities, we’re retiring the “Suspected identity theft (pass‑the‑ticket)” classic alert (External ID: 2018). This retirement aligns with our move toward consolidated XDR alerting and improved detection fidelity.
We recommend using the “Pass‑the‑Ticket (PtT) attack” alert (Detector ID: xdr_PassTheTicketAttack), where ongoing development and enhancements will continue.
[When this will happen]
We’ll retire the classic alert between March 18, 2026 and March 22, 2026.
[How this affects your organization]
Who is affected:
- Organizations using Microsoft Defender for Identity within Microsoft Defender XDR services.
- Security operations teams and administrators who rely on classic alerting.
What will happen:
- The “Suspected identity theft (pass‑the‑ticket)” classic alert (External ID: 2018) will stop generating new alerts after retirement.
- Existing historical alerts will remain accessible in your environment.
- The “Pass‑the‑Ticket (PtT) attack” XDR detector (ID: xdr_PassTheTicketAttack) will continue to operate and should be used going forward.
- No changes will be made to user experiences outside security operations.
[What you can do to prepare]
No admin action is required for this change, but we recommend the following to ensure continuity in your security workflows:
- Update alert triage processes, workflows, and automation to reference the XDR detector IDs.
- Reconfigure alert exclusions or tuning rules using XDR Alert Tuning.
- Notify security and operations teams of the upcoming retirement.
- Update internal documentation to reference the new alert name and detector ID.
- Review Microsoft documentation for configuring XDR Alert Tuning.
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Additional details from Microsoft
- Summary
- The “Suspected identity theft (pass-the-ticket)” classic alert will retire between March 18-22, 2026, replaced by the “Pass-the-Ticket (PtT) attack” XDR alert. Existing alerts remain accessible. No admin action is required, but update workflows, alert tuning, and documentation accordingly. No compliance issues noted.