The Microsoft Defender for Identity sensor is designed to be installed directly on Domain Controllers (DCs) or Active Directory Federation Services (AD FS) servers. Its primary function is to capture and parse network traffic and Windows events directly from the servers that handle authentication and authorization, such as Kerberos and NTLM authentications, and Active Directory domain changes. Installing the sensor on the Domain Controller allows it to monitor these critical identity-related activities in real-time to detect and investigate advanced threats, compromised identities, and malicious insider actions.

B. Server2, C. Server3, D. Server4, E. Server5: These options are incorrect assuming they are not Domain Controllers or AD FS servers. Installing the sensor on member servers, such as web or database servers, would not provide the necessary visibility into authentication traffic and directory service activity that Defender for Identity requires to function.

1. Microsoft Learn

"Deploy Microsoft Defender for Identity with the Microsoft Defender XDR portal." This document explicitly states the installation target. In the "Prerequisites" section

under "Sensor requirements

" it notes

"This article describes how to install the Microsoft Defender for Identity sensor on domain controllers."

Source: Microsoft. (2024). Install the Microsoft Defender for Identity sensor. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/defender-for-identity/install-sensor

2. Microsoft Learn

"Microsoft Defender for Identity architecture." The architectural diagram and accompanying text clearly show and state that sensors are deployed on Domain Controllers. The text specifies

"Microsoft Defender for Identity sensors are installed directly on your domain controllers or AD FS servers."

Source: Microsoft. (2023). Microsoft Defender for Identity architecture. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/defender-for-identity/architecture

3. Microsoft Learn

"Microsoft Defender for Identity sensor requirements." This page details the prerequisites for the sensor installation

reinforcing that the target servers are Domain Controllers. It lists supported operating systems specifically for Domain Controllers where the sensor can be installed.

Source: Microsoft. (2024). Microsoft Defender for Identity prerequisites. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/defender-for-identity/prerequisites#sensor-requirements