Security
Microsoft Defender for Identity
An identity threat detection and response solution that monitors identity signals to uncover compromised credentials, lateral movement, privilege escalation, and insider threats.
Product
Microsoft Defender for IdentityMicrosoft Defender for Identity uses signals from on-premises Active Directory and supported hybrid identity infrastructure to detect reconnaissance, credential compromise, lateral movement, privilege escalation, and malicious insider activity. Its identity alerts enrich Microsoft Defender XDR incidents with the affected users, devices, directory relationships, and attack paths.
How it works
- Sensors and supported integrations collect authentication and directory activity.
- Behavioral analytics establish context around users, devices, groups, privileges, and normal activity.
- Detection analytics identify suspicious reconnaissance, credential theft, abnormal authentication, lateral movement, and privilege escalation.
- Identity security posture assessments highlight risky configurations and weaknesses.
- User timelines and related evidence support detailed investigations.
- Identity alerts are correlated with endpoint, email, and cloud application signals in Microsoft Defender XDR.
A problem it solves
An attacker compromises a help-desk account, searches for privileged users, and attempts to move from an employee workstation to a critical server. Microsoft Defender for Identity detects the reconnaissance and lateral movement patterns, identifies the accounts and devices involved, and helps the security team reconstruct the attack path.