Defender for Identity has no unresolved health issues

​

What this check verifies

Microsoft Defender for Identity (MDI) monitors your hybrid identity infrastructure and detects advanced threats targeting Active Directory. This check verifies that MDI sensors are deployed and that there are no unresolved health issues that may affect the ability to detect identity-based attacks.

​

Risk

Without deployed MDI sensors or with unresolved health issues, organizations face critical gaps in threat detection. Misconfigured or missing sensors fail to monitor domain controllers, allowing identity-based attacks like Pass-the-Hash, Golden Ticket, or lateral movement to go undetected. Attackers commonly exploit these blind spots to compromise hybrid environments while evading detection.

​

Recommendation

Regularly monitor and resolve Defender for Identity health issues to maintain comprehensive visibility into identity-based threats across your hybrid infrastructure.

​

Remediation

Dashboard steps

1. Navigate to Microsoft Defender XDR portal at https://security.microsoft.com/
2. Go to Settings > Identities > Health issues
3. Review each open health issue and its recommendations
4. Follow the specific remediation steps provided for each issue
5. Verify the issue is resolved and status changes to closed

​

References

• https://learn.microsoft.com/en-us/defender-for-identity/health-alerts
• https://learn.microsoft.com/en-us/graph/api/security-identitycontainer-list-healthissues

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defenderidentity_health_issues_no_open. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks