MC1552387 - Retired: Microsoft Defender for Identity classic alerts (Remote code execution attempt and pass-the-hash)
Microsoft 365 Message Center announcement MC1552387.
MS Message Center's Summary
Microsoft is retiring two classic alert types within Defender for Identity by late November 2026. Security teams must create custom detection rules for remote code execution activity in Advanced Hunting and verify that pass the hash monitoring is handled via Defender for Endpoint. Administrators should review their current alert configurations and update workflows before the retirement date.
- Administrator impact
- Administrators must create custom detection rules for remote code execution and verify endpoint monitoring coverage.
- End user impact
- No direct end user impact is expected.
- Importance
- 6/10: The retirement of security alerts requires proactive administrative action to maintain threat detection capabilities.
Microsoft Summary
Microsoft Defender for Identity will retire two classic alerts—Remote code execution attempt and pass-the-hash—by late November 2026. Users should create custom detection rules for RCE and rely on Defender for Endpoint for pass-the-hash monitoring. No compliance issues are identified.
- Message Center ID
- MC1552387
- Category
- plan For Change
- Severity
- normal
- Services
- Microsoft Defender XDR
- Tags
- Retirement
- Published
- 2026-11-13
- Last updated
- 2026-11-13
- Expires
- 2026-12-30
- Action required by
- 2026-11-30
[What and Why:] Microsoft Defender for Identity (MDI) is retiring two classic alerts at the end of November 2026: Remote code execution attempt (RCE) and Suspected identity theft (pass-the-hash) . This update aligns detection workflows with current Microsoft Defender XDR and endpoint monitoring capabilities. [Rollout Schedule:] General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in late November 2026 and expect to complete by late November 2026. [Impact on Your Organization:] Who is affected: - Security teams using classic MDI alert workflows for RCE and pass-the-hash scenarios. Platforms/Services: - Microsoft Defender for Identity - Microsoft Defender XDR services What will happen: - The two classic alerts will no longer be available after rollout completes. - RCE activity can continue to be monitored with a custom detection rule in Advanced Hunting. - Pass-the-hash monitoring should continue through Microsoft Defender for Endpoint on onboarded devices. [Action Required/Recommendations:] Before the end of November 2026: - Create an Advanced Hunting custom detection rule for RCE scenarios using the published query. - Confirm pass-the-hash detection coverage through Defender for Endpoint on onboarded devices. - Review guidance: MDI classic alerts documentation . - Use the published query: RCE custom detection query . [Compliance considerations:] No compliance considerations identified. Review as appropriate for your organization.