Microsoft Defender for Identity
Cloud-based security solution that uses on-premises Active Directory signals to detect advanced threats.
What is Microsoft Defender for Identity?
Defender for Identity monitors Active Directory traffic to detect identity-based attacks including credential theft, lateral movement, and domain dominance. It identifies reconnaissance activities, compromised credentials, and suspicious behaviors that indicate advanced persistent threats. Integration with Microsoft 365 Defender provides cross-domain correlation.
In Microsoft 365
Defender for Identity sensors deploy on domain controllers and AD FS servers. It detects Pass-the-Hash, Pass-the-Ticket, Kerberoasting, and other AD attacks. Alerts integrate with Microsoft 365 Defender for unified incident management.
Examples
- 1Detection of NTLM relay attack
- 2Identification of suspicious service creation
- 3Alert on reconnaissance using SAMR protocol
Related TrueConfig Controls
These controls help implement and verify microsoft defender for identity in your Microsoft 365 environment.