Microsoft Defender for Identity: New recommendations for Microsoft Secure Score

We’re updating Microsoft Secure Score improvement actions of Microsoft Defender for Identity to ensure a more accurate representation of security posture. With this rollout, we are adding two new Microsoft Defender for Identity posture recommendations regarding Entra Connect accounts that will be added as Microsoft Secure Score improvement actions:

• Remove unsafe permissions on Microsoft Entra Connect accounts
• Replace Enterprise or Domain Admin Account for AD DS (Active Directory Domain services) Connector account

Your score will be updated accordingly.

When this will happen:

Public Preview: We will begin rolling out mid-January 2025 and expect to complete by late January 2025.

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out mid-February 2025 and expect to complete by late February 2025.

Note: To provide the recommendation as quickly as possible, we will introduce it to your environment at the earliest opportunity, rather than on the regular monthly schedule.

How this will affect your organization:

These new security posture reports are related to Entra Connect server and will be available only if your tenant has a Defender for Identify sensor installed on the Entra Connect server. This update is available by default.

What you need to do to prepare:

This rollout will happen automatically by the specified date with no admin action required before or after the rollout. Your score will be updated accordingly.

Review your current configuration to determine the impact for your organization. You may want to notify your admins about this change and update any relevant documentation.

Microsoft recommends reviewing the improvement actions listed in Microsoft Secure Score. We will continue to add suggested security improvement actions on an ongoing basis.