Stopped Ingesting Microsoft Defender for Identity

Incident Report for Expel, Inc.

Monitoring

As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device have coverage and alerts are being processed.

We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench).

Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.

Posted Apr 28, 2025 - 10:34 EDT

This incident affects: Alert ingestion.