MDI Auditing and configuration check

Question

Hi allIs there any utility or Powershell script which verify that all the required auditing settings for MDI have been setup. I'm troubleshooting/evaluating an MDI deployment and I'm seeing differentials betwen AD and the MDI logs.&nbsp;&nbsp;As an example I have user objects created in the last 30 days but zero events indicating such in the IdentityEvents table. Of course this could just be me being dense, I don't have access to the either the legacy portal or the configuration settings in the new portal.&nbsp;&nbsp;Anyone got any ideas?&nbsp; &nbsp;&nbsp;

thalpius · Answer

I happen to released a configuration checker today which you can use. There's a release as well on my GitHub or you can check my code to be sure it doesn't do anything malicious and compile it yourself using VS Community Edition 🙂

Here's the link to the repo:
https://github.com/thalpius/Microsoft-Defender-for-Identity-Configuration-Checker

peterjoinobits · Answer

And as an add on. Is there any KQL query I can run to verify the last time an NDI Sensor actually connected. Sort of equivalent to a heart beat sensor in Log Analytics

Forum Discussion

MDI Auditing and configuration check

2 Replies

Resources