Identities from old On-Prem Active Directory domain still visible in Defender Portal

Kalel 140 Reputation points
2026-10-12T10:39:41.2333333+00:00

Good day. We previously had an On-Prem Active Directory domain that has since been shutdown/decommissioned back in March 2026. However, the Defender portal still show these accounts and domain. It's possible proper clean-up / decommission to remove from Defender may have not been completed. The Domain Controllers no longer listed in Defender Identities. Is there some other location where you actually configure the On-Prem domain in Defender portal that we need to remove or say no longer exists? Even under Settings \ Identities, we have a notification that that 4 domain controllers are ready for Onboarding even though the domain and servers no longer exit.

Thx in advance for any help given.

Microsoft Security | Microsoft Defender | Microsoft Defender for Identity
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Rauh, Alexander 330 Reputation points
    2026-10-13T21:04:04.7933333+00:00

    Hello Kalel,

    There is no separate domain setting to remove. The Sensor Management tab you see is built from servers that were discovered in the Device Inventory, so the 4 "ready" DCs are only leftover Defender for Endpoint device records, not an MDI domain configuration. The entries and the data will be kept for 180 days (read here), so the entries should disappear on their own.

    Can you check for me: Assets --> Devices (the 4 DCs) and tell me what Health State and Last seen say?

    Best Regards

    Alex

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-12T10:39:58.9066667+00:00

    There is no separate place to remove an on-premises domain itself from Defender for Identity. The relevant cleanup point in the Microsoft Defender portal is the On-premises area, especially Sensor management.

    For a decommissioned domain, the supported cleanup actions in the context are:

    1. Go to Microsoft Defender portal > On-premises > Sensor management.
    2. Look for any remaining sensor entries tied to the old domain controllers.
    3. If any old or orphaned sensors still appear, select the domain controller entry and choose Delete.
      • This is the documented action for orphaned sensors when a domain controller was deleted without uninstalling the sensor first.
    4. If the old domain controllers are already gone from Identities, also review Settings > Identities > Health issues for any lingering deployment issues.

    About the message that 4 domain controllers are ready for onboarding: the domain page and deployment health experience use domain controller discovery and sensor deployment coverage. A domain can still appear in Defender views when Defender for Identity still has visibility of the domain and sees domain controllers without sensors, which is why the portal can show onboarding readiness or incomplete coverage.

    To investigate what Defender still knows about that old domain:

    1. Open the Identity dashboard and select the domain from Active Directory protected domains, if it is still listed.
    2. Or use the global search bar to search for the old domain name.
    3. On the domain Overview tab, review:
      • Deployment Health for coverage and deployment issues
      • Domain details and Properties
      • Active Recommendations

    If no sensor entries remain in Sensor management, the provided documentation does not describe a separate manual domain-removal configuration elsewhere in Defender for Identity.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.