Summary
Microsoft Defender for Identity is introducing an updated workspace health alert that helps administrators identify when no network traffic activity is being received from domain controllers through Defender for Identity sensors. This alert is designed to surface traffic collection issues that can reduce visibility, including missing or misconfigured port mirroring, packet capture driver issues, or network traffic that is not reaching the sensor.
Microsoft 365 Message Center ID: MC1455017
Last Modified: August 15, 2026
Category: Message Center
Tags: New feature, Admin impact
Status: Launched
Products & Platforms: Microsoft Defender XDR
After rollout, administrators will see the new health alert in the Sensors health issues tab and the global Health issues experience when Defender for Identity is not receiving the expected domain controller network activity. The alert helps identify potential gaps in Defender for Identity network visibility and traffic collection.
Rollout Schedule
Available now
Impact on Your Organization
Who is affected
Organizations using Microsoft Defender for Identity sensors to monitor domain controller traffic.
Services
Microsoft Defender for Identity
- A new health alert will be displayed when expected domain controller network traffic is not being received by Defender for Identity sensors.
- The alert will appear in the Sensors health issues tab and the global Health issues experience.
- The alert helps administrators identify traffic collection visibility gaps that could affect threat detection and monitoring.
- No changes to end-user experiences are expected.
Action Required/Recommendations
No action is required before the rollout.
If the alert appears after rollout, administrators should:
- Verify that the Defender for Identity sensor service is running.
- Validate that network traffic is flowing between the corporate network and domain controllers.
- Confirm that port mirroring is configured correctly for standalone sensor deployments.
- Verify Npcap or other packet capture driver configurations, where applicable.
- Disable Receive Segment Coalescing (RSC) on the sensor capture network interface card (NIC).
Compliance Considerations
No compliance considerations identified, review as appropriate for your organization.