Microsoft Defender for Identity sensors are installed and healthy on AD FS, AD CS, and Microsoft Entra Connect servers

Overview

Active Directory Federation Services, Active Directory Certificate Services, and Microsoft Entra Connect form the identity backbone that extends a customer’s on-premises directory into the cloud: AD FS issues federated authentication tokens for cloud applications, AD CS issues the certificates that machines and users present across the forest, and Microsoft Entra Connect synchronizes on-premises accounts and credential material into Microsoft Entra ID. A threat actor who reaches any of these servers operates at the same trust level as the directory itself — capable of issuing forged authentication artifacts, enrolling certificates as arbitrary users, or replaying synchronized credentials into cloud sessions — and that activity blends in with the legitimate, signed identity traffic these servers produce by design. Host-level antivirus and network monitoring catch only the noisiest stages of such attacks; the argument that the existing domain controller sensors and perimeter controls are enough does not hold, because the abusive actions originate on the federation, certificate, and synchronization servers themselves, not on the domain controllers downstream. The high-fidelity signals that distinguish legitimate federation, certificate issuance, and directory replication from their abusive look-alikes are produced by the Microsoft Defender for Identity sensor running locally on each of these roles, so ensuring an MDI sensor is installed, current, and healthy on every AD FS, AD CS, and Entra Connect server extends identity-aware detection to the components that originate identity itself, and the workspace’s sensor inventory becomes the auditable record that this coverage is in place rather than assumed.

Remediation

• Plan AD FS, AD CS, and Microsoft Entra Connect sensors
• Install the Microsoft Defender for Identity sensor
• Configure Microsoft Defender for Identity sensor settings
• Microsoft Defender for Identity health alerts
• Troubleshoot known issues

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Defender
Feature	Defender for Identity
Area	Logging and detection
ATT&CK	T1606.002 SAML Tokens, T1649 Steal or Forge Authentication Certificates, T1556.007 Hybrid Identity
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.