Microsoft Defender for Identity introduces a new opt-in post-deployment configuration for unified sensors (v3.x) enabling RPC monitoring via the Unified Sensor RPC Audit tag. Rollout starts late September 2025, enhancing advanced identity detections with visibility in device inventory. No action needed unless enabling the feature.
Applies to: Microsoft Defender XDR
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).