What and Why:
Microsoft Defender for Identity (MDI) is retiring two classic alerts at the end of November 2026: Remote code execution attempt (RCE) and Suspected identity theft (pass-the-hash). This update aligns detection workflows with current Microsoft Defender XDR and endpoint monitoring capabilities.
Rollout Schedule:
General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in late November 2026 and expect to complete by late November 2026.
Impact on Your Organization:
Who is affected:
- Security teams using classic MDI alert workflows for RCE and pass-the-hash scenarios.
Platforms/Services:
- Microsoft Defender for Identity
- Microsoft Defender XDR services
What will happen:
- The two classic alerts will no longer be available after rollout completes.
- RCE activity can continue to be monitored with a custom detection rule in Advanced Hunting.
- Pass-the-hash monitoring should continue through Microsoft Defender for Endpoint on onboarded devices.
Action Required/Recommendations:
Before the end of November 2026:
- Create an Advanced Hunting custom detection rule for RCE scenarios using the published query.
- Confirm pass-the-hash detection coverage through Defender for Endpoint on onboarded devices.
- Review guidance: MDI classic alerts documentation.
- Use the published query: RCE custom detection query.
Compliance considerations:
No compliance considerations identified. Review as appropriate for your organization.