Forum Discussion
Error create instance Defender for identity
Hello guys, I need help.
I am create a intance the Defender for identity but receive mensage: the instance was not created because there is already a security group with the same name as the azure active directory
Any tips on how to solve ?
Thanks
- Deleting the Azure ATP got me a bit further, but then I received the error:
Something went wrong.
MDI instance could not be created. DNS name already in use.
The solution was simple: wait a couple of hours and then refresh the page! - Martin_Schvartzman
Microsoft
This can happen when your tenant was onboarded to MDI in the past, and the workspace was deleted (due to license expiration and retention expiration, or deleted manually through a support ticket).
The error message displayed in the portal contains a link to the instructions on what to do to fix the issue: https://go.microsoft.com/fwlink/?linkid=2246313 - Several users have reported deleting the below three groups to resolve the error message. I had the same issue with my tenant; I fixed the problem by renaming the three groups instead of deleting and recreating them.
Azure ATP {instance name} Administrator
Azure ATP {instance name} Users
Azure ATP {instance name} Viewers- worked at my end.
- I know this is old but just in case anyone has the same problem:
There are 3 default security groups called
Azure ATP {instance name} Administrator
Azure ATP {instance name} Users
Azure ATP {instance name} Viewers
https://learn.microsoft.com/en-us/defender-for-identity/role-groups
These may be empty but need to be deleted for defender for identity to proceed.- Thank you VERY much for posting this!
- Thank you, that helped me out.
Microsoft's error messages should include the details like the name(s) of the groups that need to be deleted so people have clear (not nebulous) direction. Thanks for the clarification.
jnitterauer EVERYTHING microsoft takes 10 times the effort it should. Not listing the names of the conflicting groups, forcing a delay-of-game while admins are forced to find this information is very much on brand for them.
- EliOfekDelete the existing 3 security groups from aad and try again.
