I just learned about this, but Defender for Identity relies on certain event logs. We should make sure that WELA and Yamato Security's guide also recommends to enable these logs: https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection
There is also a powershell script that might be good to use as a reference. @fukusuket