Defender for Identity sensor updates

February 2026
Defender for Identity sensor updates

New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts:

New alerts related to Entra ID:

• Suspicious user configuration change activity from Entra ID sync application
• Anomalous OAuth device code authentication activity
• Suspicious Graph API request made from Entra ID sync application
• Suspicious sign-in observed from Entra ID sync application
• Suspicious sign in with CSRF speedbump trigger

New alerts related to Active Directory:

• Possible golden ticket attack (suspicious ticket)
• Possible Kerberos key list attack