Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Defender XDRMedium
A Microsoft 365 administrator is configuring Microsoft Defender for Identity in a hybrid environment. The organization has several domain controllers (DCs) running Windows Server 2016 and a mix of Windows Server 2019 and 2022. To ensure comprehensive identity threat detection, the administrator needs to deploy Defender for Identity sensors. Which type of sensor should be installed directly on all domain controllers?
- AMicrosoft Defender for Identity standalone sensor
- BMicrosoft Defender for Identity network sensor
- CMicrosoft Defender for Identity proxy sensor
- DMicrosoft Defender for Identity lightweight sensor
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Defender for Identity lightweight sensor
The lightweight sensor is designed to be installed directly on domain controllers, capturing network traffic and Windows events without requiring dedicated hardware or port mirroring, making it ideal for comprehensive identity threat detection in a hybrid environment.
Why the other options are wrong
- A. A standalone sensor is deployed on a dedicated server and requires port mirroring, which is not the recommended or most efficient approach for DCs.
- B. A network sensor (or standalone sensor with network capabilities) typically requires port mirroring and is not installed directly on the DCs themselves.
- C. A proxy sensor is not a standard Defender for Identity sensor type; it might refer to a network proxy for sensor communication.
Defender for Identity Lightweight Sensor
The Microsoft Defender for Identity lightweight sensor is an agent installed directly on domain controllers or AD FS servers to monitor network traffic and Windows events for identity-based threats, offering comprehensive coverage without needing port mirroring.
- Installed directly on domain controllers/AD FS.
- Monitors network traffic and Windows events.
- Requires minimal resources.
- Eliminates need for port mirroring.
Memory trick: Sensors come in lightweight for DCs and standalone for networks.