| OS Version | Roles | RODC | Traffic (pkt/s) | Count | Sensor | Sizing (per sensor) | Notes |
|---|---|---|---|---|---|---|---|
| Windows Server 2022 | AD DS | No | Unknown | 4 | v3.x | Run Sizing Tool ↗ | Sizing Tool optional for v3.x — sensor resource usage is managed by MDE |
| WS 2016 or later (v2.x) | AD FS (standalone) | No | Role-based | 2 | v2.x | Minimal | Standalone role server — sensor v2.x required; DSA mandatory |
| WS 2016 or later (v2.x) | AD CS (standalone) | No | Role-based | 2 | v2.x | Minimal | Standalone role server — sensor v2.x required; DSA mandatory |
| WS 2016 or later (v2.x) | Entra Connect (Active) | No | Role-based | 1 | v2.x | Minimal | Standalone role server — sensor v2.x required; DSA mandatory |
| WS 2016 or later (v2.x) | Entra Connect (Staging) | No | Role-based | 1 | v2.x | Minimal | Standalone role server — sensor v2.x required; DSA mandatory |
Sizing = sensor-only resource consumption (not total DC capacity). CPU = non-hyperthreaded cores only. Capacity Planning Guide ↗ | Download MDI Sizing Tool ↗
Account type: Group Managed Service Account (gMSA)
Required DSA credentials: 1
Notes: Single forest — one DSA covers all domains.
New-ADServiceAccount (see documentation script)dsacls.exe LCRPsecpol.msc or GPO) — only required for v2.x; the v2 sensor service impersonates the gMSA DSAklist purge -li 0x3e7Method: Direct access to the dedicated MDI backend via the Internet (TLS encrypted)
<workspace-name>sensorapi.atp.azure.com — TCP 443 outbound (MDI cloud service)crl.microsoft.com, ctldl.windowsupdate.com, www.microsoft.com/pkiops/* — certificate validationsensorpackage-prd.mdi.securitycenter.microsoft.com — TCP 443 (sensor package download)SSL/TLS inspection is NOT supported. MDI uses certificate-based mutual authentication.
Proxy Configuration Guide ↗Recommended approach: PowerShell — DefenderForIdentity module (recommended for v2.x or mixed environments)
Use the DefenderForIdentity PowerShell module to apply all required audit settings via Group Policy. This method works for both v2.x and v3.x sensors and provides a configuration report before applying changes.
Install-Module DefenderForIdentity -Scope CurrentUser
# Review current configuration and gaps:
New-MDIConfigurationReport -Path 'C:\MDIReports' -Mode Domain -OpenHtmlReport
# Apply all required audit settings via Group Policy:
Set-MDIConfiguration -Mode Domain -Configuration All| Category | Subcategory | Event IDs |
|---|---|---|
| Account Logon | Credential Validation | 4776 |
| Account Management | Computer Account Management | 4741, 4743 |
| Account Management | Security Group Management | 4728–4758 |
| Account Management | User Account Management | 4726 |
| DS Access | Directory Service Changes | 5136 |
| DS Access | Directory Service Access | 4662 |
| System | Security System Extension | 7045 |
| NTLM (Group Policy) | Restrict NTLM | 8004 |
-WhatIf to prevent unintended changes. Do not remove -WhatIf unless you have read the full cmdlet documentation, understand exactly what will be changed on the target system, and have obtained the necessary change-management approval. Some of these commands modify system configuration directly on all sensor servers in scope.Set-MDIConfiguration cmdlets shown are pre-populated with -WhatIf. When executed without -WhatIf, these cmdlets create and link Group Policy Objects in your Active Directory domain, which will immediately affect all domain controllers or servers in scope. Do not proceed without fully understanding the cmdlet behavior, reviewing the WhatIf output, and obtaining change-management approval. Always run the -WhatIf version first, review every line of output, then re-run without -WhatIf only when you are certain the changes are correct and approved.Set-MDIConfiguration -Mode Domain -Configuration AdvancedAuditPolicyCAs -SkipGpoLink -WhatIf📖Set-MDIConfiguration -Mode Domain -Configuration EntraConnectAuditing -SkipGpoLink -WhatIf📖All references: Microsoft Learn (learn.microsoft.com) — last verified April 2026.