Windows 2019/2022 Microsoft Defender Endpoint and Defender for Identity

Hello,

if you want to deploy Defender for Identity on your Windows Server 2019/2022 environment—even one already onboarded with Microsoft Defender for Endpoint—you must install the separate MDI sensor.

The logs you can send it to a SIEM and also you can see it at Defender for Identity Portal that now is just one https://security.microsoft.com/

See https://learn.microsoft.com/en-us/defender-for-identity/deploy/deploy-defender-identity

Here you can take a look about what audit data you have to enable on your server and what is going to monitor

https://learn.microsoft.com/en-us/defender-for-identity/deploy/event-collection-overview

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Just following up, Do you need more guidance or assistance ?

Hello,

Thank you for posting in Microsoft Q&A.

Based on the description, I understand your question is related to defender.

To deploy Microsoft Defender for Identity (MDI) with Microsoft Defender for Endpoint (MDE) already onboarded, you can consider install the MDI sensor.

Go to the Microsoft Defender portal. Navigate to Settings > Identities > Sensors. Click on Add sensor and download the installer package.

Transfer the installer package to your domain controller. Run the installer with administrative privileges and follow the setup wizard

https://learn.microsoft.com/en-us/defender-for-identity/deploy/install-sensor

Have a nice day.

Best Regards,

Molly

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it