Question on Microsoft Defender for Identity Sensor Version

Question

Question on Microsoft Defender for Identity Sensor Version

Kalel 140

While viewing the Microsoft Defender for Identity, I have one domain controller that is showing "Ready for Migration". However, when I click into it, there is no additional information letting me know exactly what that is referring to. Is that to migrate to the version 3.x sensor? If so, any impact to the Domain Controller I should be aware of if I click on Migrate?

User's image

Thx in advance for any assistance given.

0 comments

1 answer

Your answer

Answer 1

Konstantinos Lianos 425 Student Ambassador

Hello Kalel,

Yes,“Ready for migration” means that server is eligible to migrate from the Defender for Identity v2.x sensor to the v3.x sensor. In the portal, the Migration state column is specifically about v2.x → v3.x migration. Once it finishes, that state changes to Up to date, which means the server is now running sensor v3.x. That is separate from Sensor status, which only shows the update/configuration state of the currently installed sensor.

If you click Migrate, Microsoft says the migration is done directly from the Defender portal and typically takes up to 20 minutes. During that time, the v2.x sensor continues running until v3.x is ready, so monitoring stays in place without interruption and without data duplication.

So in normal circumstances, the impact to the domain controller should be low. Microsoft’s current guidance does not describe downtime for the migration itself. The only restart-related note I found is for the cleanup afterward: once migration is complete, the old v2.x software remains installed but disabled, and uninstalling that old v2.x sensor later might require a server restart.

Derek Morgan II 0 Reputation points

2026-05-04T15:58:32.5266667+00:00
Adding to what @Konstantinos Lianos covered — a few operational notes from running this migration:

Pre-flight on that DC:

Audit policy — confirm advanced auditing on the domain root is still emitting 4662s for the replication GUIDs MDI uses for DCSync detection. v3.x can apply this for you (Automatic Windows event auditing runs every 24h), but it's worth verifying the SACL is in place beforehand.

DSA permissions — your gMSA still needs read access to the Deleted Objects container (LCRP via dsacls). Easy to lose if directory permissions get reorganized.

NNR health — check Settings → Identities → Sensors → [your DC] and look for any "Name resolution failure" health alerts before clicking migrate.

One thing worth confirming on your end: is this DC running the classic v2.x sensor, or is it MDE-onboarded with MDI activated on the SENSE agent? v3.x is delivered by the MDE sensor itself — there's no separate MDI installer. The migration flow only applies to DCs that currently have the v2.x classic sensor; MDE-onboarded DCs activated directly for v3.x never enter the migration path.

Post-migration: the v2.x service is disabled but the "Azure Advanced Threat Protection Sensor" software stays installed. Plan a maintenance window to uninstall it (a restart may be needed).

Share via

Question on Microsoft Defender for Identity Sensor Version

1 answer

Your answer