Forum Discussion

TomHaz's avatar
TomHaz
Copper Contributor
Jan 19, 2026
Solved

Very High Increase in CPU activity after Update Microsoft Defender for Identity sensor

All our servers that are running this sensor (DCs, Certificate servers, AD Connect servers) showed a massive increase in average CPU utilization from virtually straight after the sensor was automatic...
microsoft 365 defender
Sensor
  • EliOfek's avatar
    EliOfek
    Jan 20, 2026

    Hi,
    Ack on that.
    We spotted the issue. in some sensors a thread might hog between 0 to 100% of a single core.
    We are working on a fix.
    Note that the sensor has a job limiter which should make sure to leave at least 15% of CPU free at all times,
    It will limit CPU usage down to 10% of total machine if needed (with the price of dropping traffic) , so if you are really hitting 100% CPU please check if there is something else that is also consuming the CPU which was not expected.

TomHaz's avatar
TomHaz
Copper Contributor
Jan 19, 2026

The automatic update to version 2.254.19112.470 took place around 11.45pm UK time on January 12th 2026.

Sorry - that install date was in the title but I had to delete it - then I couldn't edit the post to add it back in.

EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Jan 20, 2026

Hi,
Ack on that.
We spotted the issue. in some sensors a thread might hog between 0 to 100% of a single core.
We are working on a fix.
Note that the sensor has a job limiter which should make sure to leave at least 15% of CPU free at all times,
It will limit CPU usage down to 10% of total machine if needed (with the price of dropping traffic) , so if you are really hitting 100% CPU please check if there is something else that is also consuming the CPU which was not expected.

Resources