Review the update and plan any required actions before rollout.
Primary Audience
Why this score?
AT A GLANCE
END USERS
IT ADMINS
ROLLOUT TIMELINE
Late November 2026
📢 Official Microsoft Message Center Announcement
Retired: Microsoft Defender for Identity classic alerts (Remote code execution attempt and pass-the-hash)
Message ID: MC1552387
[What and Why:]
Microsoft Defender for Identity (MDI) is retiring two classic alerts at the end of November 2026: Remote code execution attempt (RCE) and Suspected identity theft (pass-the-hash). This update aligns detection workflows with current Microsoft Defender XDR and endpoint monitoring capabilities.
[Rollout Schedule:]
General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in late November 2026 and expect to complete by late November 2026.
[Impact on Your Organization:]
Who is affected:
– Security teams using classic MDI alert workflows for RCE and pass-the-hash scenarios.
Platforms/Services:
– Microsoft Defender for Identity
– Microsoft Defender XDR services
What will happen:
– The two classic alerts will no longer be available after rollout completes.
– RCE activity can continue to be monitored with a custom detection rule in Advanced Hunting.
– Pass-the-hash monitoring should continue through Microsoft Defender for Endpoint on onboarded devices.
[Action Required/Recommendations:]
Before the end of November 2026:
– Create an Advanced Hunting custom detection rule for RCE scenarios using the published query.
– Confirm pass-the-hash detection coverage through Defender for Endpoint on onboarded devices.
– Review guidance: MDI classic alerts documentation.
– Use the published query: RCE custom detection query.
[Compliance considerations:]
No compliance considerations identified. Review as appropriate for your organization.
Source: Microsoft Message Center • Analysed by MWPro
