Defender for Identity health issues: every sensor and global alert, with severity and fix

Microsoft Defender for Identity tells you when its own deployment is unhealthy through health issues: a sensor that stopped talking, an expired account password, auditing that's missing on the domain. This quick reference lists every health issue Microsoft documents, with its severity, the tab it appears on, the sensor version it applies to, the usual cause and the fix that makes it close.

How to read these codes#

Open the Microsoft Defender portal and go to Settings › Identities › Health issues (under Deployment). Issues sit on two tabs: Global health issues for domain-level or aggregated problems, and Sensor health issues for a single sensor. Filter by status, name or severity; select an issue for details.

• Status: an issue is Open until Defender for Identity detects that the cause is gone and closes it automatically. Admins with the Azure ATP (workspace name) Administrators role can also close an issue, or suppress it for seven days during planned work such as taking a domain controller offline.
• Daily checks: several configuration checks (auditing, power mode) run once a day per sensor or per domain, so allow up to a day for those to close.
• Sensor version: many issues apply only to the classic sensor (2.x). Sensor v3.x issues are marked 3.x.
• Email alerts: Settings › Identities › Health issues notifications emails recipients when an issue opens (sensor 2.x).

To list open issues across all sensors, call Microsoft Graph (permission SecurityIdentitiesHealth.Read.All):

Connect-MgGraph -Scopes SecurityIdentitiesHealth.Read.All
$uri = "https://graph.microsoft.com/v1.0/security/identities/healthIssues?`$filter=Status eq 'open'"
(Invoke-MgGraphRequest -Method GET -Uri $uri).value | ForEach-Object {
    [pscustomobject]@{
        Issue    = $_.displayName
        Severity = $_.severity
        Type     = $_.healthIssueType
        Sensors  = $_.sensorDNSNames -join ', '
    }
} | Format-Table -AutoSize

Issues already covered step by step in Defender for Identity sensors: installation and health issues are included below for completeness.

Sensor service and version#

Capacity and packet capture#

Directory access and name resolution#

Auditing and integrations#

For sensor 2.x, the DefenderForIdentity PowerShell module checks and applies auditing in one pass. Run it with Domain Admin rights:

Import-Module DefenderForIdentity
New-MDIConfigurationReport -Path "C:\Reports" -Mode Domain -OpenHtmlReport   # what's missing
Set-MDIConfiguration -Mode Domain -Configuration All                          # creates and links GPOs
auditpol.exe /get /category:*                                                 # on a DC, after gpupdate

# On the certificate authority: full CA auditing
certutil -setreg CA\AuditFilter 127
Restart-Service certsvc

Set-MDIConfiguration creates and links Group Policy objects; add -CreateGpoDisabled or -SkipGpoLink to review them first. For NTLM auditing on domain controllers, set Outgoing NTLM traffic to remote servers to Audit all, Audit NTLM authentication in this domain to Enable all, and Audit Incoming NTLM Traffic to Enable auditing for all accounts.

How to verify a fix#

1. Watch the issue's status: it should move to Closed on its own. Allow up to a day for issues checked daily.
2. For service problems on a 2.x sensor, confirm both services run, then read the newest errors:

Get-Service AATPSensor, AATPSensorUpdater | Select-Object Name, Status, StartType
$logs = Get-ChildItem 'C:\Program Files\Azure Advanced Threat Protection Sensor' -Directory |
    Sort-Object LastWriteTime -Descending | Select-Object -First 1
Get-Content (Join-Path $logs.FullName 'Logs\Microsoft.Tri.Sensor-Errors.log') -Tail 30

3. For auditing fixes, confirm the new events (such as 4662, 4776 and 8004) appear in the domain controller's logs, and rerun New-MDIConfigurationReport: nothing should be flagged.
4. Rerun the Graph query above. An empty result means no open health issues.

Errors during installation are in the deployment logs in the installing user's temp folder; Microsoft.Tri.Sensor.Updater-Errors.log covers failed automatic updates.

References#

• Microsoft Defender for Identity health issues (source of the issue tables)
• Configure Windows event auditing
• Troubleshooting the Defender for Identity sensor using the logs