# No open Microsoft Defender for Identity health issues are present in the tenant
Microsoft Defender for Identity health issues are the service's self-diagnostic surface: open issues such as "Sensor not communicating", "Domain…
Source: https://maester.dev/docs/tests/ZTA.41018
:::note[Maester checks this too]
[MT.1059](/docs/tests/MT.1059) (Microsoft Defender for Identity health issues should be resolved) checks the same setting. Running both reports it twice.
:::
## Overview
Microsoft Defender for Identity health issues are the service's self-diagnostic surface: open issues such as "Sensor not communicating", "Domain Synchronizer not running", and "Workspace is not receiving directory replication traffic" indicate that a sensor either cannot reach the cloud service, cannot capture the network traffic it needs, or cannot read the directory objects it needs to evaluate. Each unresolved health issue narrows detection coverage on the affected scope. When a sensor is degraded, adversary activity against the assets it monitors may proceed without generating the alerts the security operations team expects, undermining the investment in the platform. The risk compounds when multiple sensors report issues simultaneously, because an attacker who moves between monitored segments can cross from one blind spot into another without triggering a detection at any point in the chain. Open health issues must therefore be triaged and resolved as part of routine operations; any open issue at medium or high severity is a coverage gap that requires action.
## Remediation
- [Microsoft Defender for Identity health issues](https://learn.microsoft.com/en-us/defender-for-identity/health-alerts)
- [Troubleshoot Microsoft Defender for Identity known issues](https://learn.microsoft.com/en-us/defender-for-identity/troubleshooting-known-issues)
- [Microsoft Defender for Identity sensor settings](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-sensor-settings)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Identity threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Defender for Identity |
| Area | Logging and detection |
| Licence | ATA |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.