Microsoft Defender for Identity alerts transitioning to XDR-based detection platform
On September 18, 2025, the following Microsoft Defender for Identity classic alerts will be moved to the MDI XDR detection platform. This transition is part of our ongoing effort to enhance detection capabilities across the environment. The move to XDR enables:
- Improved detection logic helping to reduce false positives.
- Enhanced performance
MDI Classic Alerts moving to MDI XDR alerts
Alert title | External ID |
|---|---|
Active Directory attributes Reconnaissance using LDAP | 2210 |
User and IP address reconnaissance | 2012 |
Account enumeration reconnaissance | 2003 |
Suspected brute-force attack (LDAP) | 2004 |
Suspicious network connection over Encrypting File System Remote Protocol | 2416 |
New MDI XDR Alerts
Alert Title | Detector ID |
|---|---|
Active Directory attributes Reconnaissance using LDAP | xdr_LdapSensitiveAttributeReconnaissanceSecurityAlert |
User and IP address reconnaissance (SMB) | xdr_SmbSessionEnumeration |
Account enumeration reconnaissance in AD FS | xdr_AccountEnumerationHintSecurityAlertAdfs |
Account enumeration in reconnaissance in Kerberos | xdr_AccountEnumerationHintSecurityAlertKerberos |
Account enumeration reconnaissance in NTLM | xdr_AccountEnumerationHintSecurityAlertNtlm |
Suspected brute-force attack (LDAP) | xdr_LdapBindBruteforce |
Suspicious network connection over Encrypting File System Remote Protocol | xdr_SuspiciousConnectionOverEFSRPC |
Action Required
- If you are using any of the MDI classic Alert IDs in your workflows or automation, please update them to use the corresponding Detector IDs listed above.
- If you have defined alert exclusions in the MDI settings, you will need to reconfigure those exclusions using XDR Alert Tuning rules.