No open Microsoft Defender for Identity health issues are present in the tenant

Maester checks this too

MT.1059 (Microsoft Defender for Identity health issues should be resolved) checks the same setting. Running both reports it twice.

Overview

Microsoft Defender for Identity health issues are the service’s self-diagnostic surface: open issues such as “Sensor not communicating”, “Domain Synchronizer not running”, and “Workspace is not receiving directory replication traffic” indicate that a sensor either cannot reach the cloud service, cannot capture the network traffic it needs, or cannot read the directory objects it needs to evaluate. Each unresolved health issue narrows detection coverage on the affected scope. When a sensor is degraded, adversary activity against the assets it monitors may proceed without generating the alerts the security operations team expects, undermining the investment in the platform. The risk compounds when multiple sensors report issues simultaneously, because an attacker who moves between monitored segments can cross from one blind spot into another without triggering a detection at any point in the chain. Open health issues must therefore be triaged and resolved as part of routine operations; any open issue at medium or high severity is a coverage gap that requires action.

Remediation

• Microsoft Defender for Identity health issues
• Troubleshoot Microsoft Defender for Identity known issues
• Microsoft Defender for Identity sensor settings

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Defender
Feature	Defender for Identity
Area	Logging and detection
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.