Microsoft 365 Alert – Service Degradation – Microsoft Defender XDR – Some admins may see alerts for sensor connectivity issues in Microsoft Defender for Identity – ONGOING

19/05/2026 09:15:00 AM

NHSmail Reference: INC46830338

Microsoft Reference: DZ1315691

Issue Status: ONGOING

Issue Description: Users may see alerts for sensor connectivity issues in Microsoft Defender for Identity.

More info: This issue specifically affects some Microsoft Defender for Identity V3 sensors, with alerts surfaced in the Microsoft Defender portal.

Admins may see health alerts indicating disconnected sensors, and newly deployed V3 sensors may fail to start.

Sensors continue to send data, so there’s no data loss. However, because sensors are disconnected from configuration, delays may occur in AD sync operations.

Current Update: 19/05/2026 11:08:00 AM–Microsoft has determined that a certificate change is causing authentication issues within a core section of the Microsoft Defender for Identity service, leading to sensor disconnections and resulting in impact. To mitigate impact, they are deploying a fix which is expected to reconnect all sensors.

Scope of impact: Your organization is affected by this event, and some admins relying on Microsoft Defender for Identity V3 sensor data may be impacted. This information may be updated as their investigation continues.

Root cause: A certificate change is causing authentication issues within a core section of the Microsoft Defender for Identity service, leading to sensor disconnections.

Next update by: Tuesday, May 19, 2026, at 11:30 AM UTC