An opt-in feature for automatic Windows event-auditing configuration in Defender for Identity unified sensors (V3.x) will be available mid-December 2025. It simplifies deployment by auto-applying required settings, affects all sensors in a tenant, requires admin activation, and addresses specific auditing health issues.
Applies to: Microsoft Defender XDR
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).