In short: Microsoft Defender for Identity is Microsoft's identity threat detection service for on-premises Active Directory and hybrid identity. Sensors on domain controllers and AD FS, AD CS and Entra Connect servers feed a cloud service that detects reconnaissance, credential theft, lateral movement and domain takeover, and raises incidents in Microsoft Defender XDR.
What Defender for Identity protects
Ransomware operators rarely stop at one laptop. Once inside, they enumerate Active Directory, harvest credentials, move sideways towards a domain admin and then use that access to push encryption everywhere. Endpoint tools see pieces of this; Defender for Identity is designed to see the identity side of it.
It monitors identity signals from on-premises Active Directory and Microsoft Entra ID, and can also take signals from other identity providers such as Okta through API connectors. It covers human accounts and non-human ones, including service accounts and synchronisation accounts, which are often the weakest link.
Defender for Identity is part of Microsoft Defender XDR, so its alerts are correlated with endpoint, email and cloud app signals into single incidents in the Defender portal.
How it works: sensors and the cloud service
Lightweight sensors run on your identity infrastructure, parse network traffic and Windows events locally, and send only the signals needed to Microsoft's cloud analytics service. Microsoft says to install sensors on:
- Every domain controller, including read-only domain controllers
- AD FS federation servers (not Web Application Proxy servers)
- AD CS servers running the Certification Authority role
- Microsoft Entra Connect servers, both active and staging
There are two sensor versions:
| Sensor | Use on | Notes |
|---|---|---|
| Sensor v3.x | Domain controllers on Windows Server 2019 or later with the September 2026 cumulative update or later; AD FS, AD CS and Entra Connect servers are supported in preview, alongside at least one v3.x sensor on a domain controller | Activated from the Defender portal on servers onboarded to Microsoft Defender for Endpoint, with an onboarding option for eligible servers that are not. Runs as LocalSystem, so no Directory Service account is needed, and caps its own CPU and memory use. Does not support VPN integration or syslog notifications. |
| Sensor v2.x | Domain controllers on Windows Server 2016 or earlier, AD FS, AD CS and Entra Connect servers, or where VPN integration or syslog is needed | Installed package with its own capacity planning, proxy configuration and a recommended Directory Service account. |
Both versions can run in the same workspace, so mixed estates are fine. Sensors on out-of-support versions such as Windows Server 2012 R2 keep reporting, but Microsoft recommends upgrading them because some functionality relies on newer operating system capabilities, and Windows Server 2016 is approaching the end of extended support.
What it detects and what it shows you
Detections are mapped to the stages of an identity attack:
| Attack stage | Examples of what Defender for Identity looks for |
|---|---|
| Reconnaissance | Enumeration of users, group membership, IP addresses and resources |
| Compromised credentials | Brute force, repeated failed authentications, suspicious group membership changes |
| Lateral movement | Attempts to move between machines and towards sensitive accounts |
| Domain dominance | Remote code execution on domain controllers, DCShadow, malicious replication, Golden Ticket activity |
Alongside detection, it gives you identity security posture assessments in Microsoft Secure Score, flagging risky configurations such as unconstrained Kerberos delegation, and lateral movement paths that show how an attacker could get from an ordinary account to a domain admin. Fixing those paths is often the most valuable outcome of a deployment, because it removes the route rather than waiting to detect someone using it.
From the Defender portal you can take response actions on affected identities, such as disabling an account or forcing a password reset, or let an MDR service do it for you out of hours.
Licensing
Microsoft lists the following licences as giving the right to deploy Defender for Identity:
- Microsoft 365 E5 (and A5 and G5)
- Microsoft Defender Suite (formerly Microsoft 365 E5 Security) and the frontline F5 Security and F5 Security + Compliance plans
- Enterprise Mobility + Security E5
- A standalone, per-user Defender for Identity licence
It is not part of Microsoft 365 Business Premium or Microsoft 365 E3 on their own. E3 customers usually get it through the Microsoft Defender Suite, which also brings Defender for Endpoint P2, Defender for Office 365 P2, Defender for Cloud Apps and Entra ID P2. For Business Premium, Microsoft's Defender Suite for Business Premium add-on lists hybrid identity protection among its features. We confirm the right plan for your user count before you buy: ask us for a quote.
Deploying it well
- Run Microsoft's readiness script (Test-MdiReadiness.ps1, also in the Defender portal under Identities > Tools) to check prerequisites.
- Decide sensor versions per server and, for v3.x, onboard servers to Defender for Endpoint or use the onboarding package.
- Configure Windows event auditing so the sensors receive the events detections depend on. For v3.x you can let Defender for Identity configure supported auditing automatically, and recent v3.x sensor versions enable RPC auditing on domain controllers for you.
- Activate or install sensors on every domain controller, then AD FS, AD CS and Entra Connect servers.
- Validate with Microsoft's test steps and check sensor health.
- Work through the posture assessments and lateral movement paths, starting with the highest-impact fixes.
- Agree who responds to alerts, and how quickly, including evenings and weekends.
The last step matters most. A detection at 2am is only useful if someone acts on it.
Defender for Identity or another ITDR tool?
If you are already standardised on Microsoft Defender XDR, Defender for Identity is the natural choice because its alerts land in the same incidents as everything else. If your endpoints run CrowdStrike, SentinelOne, ThreatDown or Sophos, those vendors offer their own identity threat detection, which may fit better with your existing console and managed service. Our ITDR comparison sets the options side by side, and identity security covers the wider set of controls.
Contact us using the form below for a deployment review or a quote.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Microsoft Defender for Identity?
It is a cloud-based security service that detects identity-based attacks against on-premises Active Directory and hybrid identity, using sensors on domain controllers and other identity servers. It was previously known as Azure Advanced Threat Protection (Azure ATP).
Do I need Defender for Identity if I only use Entra ID?
Its main value is for organisations with on-premises Active Directory. For cloud-only tenants, Microsoft Entra ID Protection (with Entra ID P2) and Defender for Cloud Apps cover most identity risk, although Defender for Identity can also take signals from Entra ID and other identity providers.
Where do Defender for Identity sensors go?
On all domain controllers, including read-only domain controllers, plus AD FS federation servers, AD CS servers with the Certification Authority role and Microsoft Entra Connect servers (both active and staging).
Is Defender for Identity included in Business Premium?
Not in Business Premium on its own. It is included in Microsoft 365 E5, the Microsoft Defender Suite (formerly Microsoft 365 E5 Security) and Enterprise Mobility + Security E5, or can be bought standalone. Business Premium customers can look at the Defender Suite for Business Premium add-on, which lists hybrid identity protection; we confirm the exact entitlement before you buy.
Does Defender for Identity slow down domain controllers?
The sensor uses some CPU, memory and disk on top of the domain controller's normal load. Microsoft publishes resource requirements and a capacity planning process for the v2.x sensor, while the v3.x sensor limits its own CPU and memory use and throttles some event processing if it hits that limit. We check headroom before deployment.