Microsoft Defender for Identity vs Palo Alto Networks VM-Series comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Microsoft Defender for Iden...
Ranking in Advanced Threat Protection (ATP)
6th
Average Rating
9.0
Number of Reviews
13
Ranking in other categories
Microsoft Security Suite (8th), Identity Threat Detection and Response (ITDR) (1st)
Palo Alto Networks VM-Series
Ranking in Advanced Threat Protection (ATP)
11th
Average Rating
8.6
Number of Reviews
53
Ranking in other categories
Firewalls (11th)
 

Mindshare comparison

As of June 2024, in the Advanced Threat Protection (ATP) category, the mindshare of Microsoft Defender for Identity is 6.7%, down from 10.2% compared to the previous year. The mindshare of Palo Alto Networks VM-Series is 0.7%, down from 1.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Advanced Threat Protection (ATP)
Unique Categories:
Microsoft Security Suite
7.1%
Identity Threat Detection and Response (ITDR)
35.1%
Firewalls
0.9%
 

Featured Reviews

Reynaldo Ruiz Flores - PeerSpot reviewer
Jun 1, 2023
The solution is easy to implement and helps us identify issues like weak or reused passwords
Defender for Identity provides intelligent authentication through conditional access policies and monitors user behavior. Defender looks at things like password changes and application use One of our users had the same password for every personal and company account. That was a problem because…
AW
Apr 19, 2023
Many features are optimized for troubleshooting real-time scenarios, saving a lot of time
I like the UI. Most things are accessible from the user interface and it is quite user-friendly. With respect to both VM-based firewalls and physical firewalls, it's easy to create updates. They have a centralized Palo Alto Customer Support Portal and if we require any licenses, such as a next-generation firewall license, we can easily download and integrate them with this solution. We can also schedule periodic updates. That is quite user-friendly. In terms of functionality, we are using IPSec tunneling and Palo Alto's WildFire feature. We use the security policies, Panorama, and Prisma Cloud as well. We use Panorama to manage our security policy model across on-prem and public cloud environments. It plays a key role with respect to centralized management, for physical enterprise firewalls and cloud-based firewalls. It gives you centralized control over all the infrastructure. Unified policies can be pushed from that centralized place with templates. When you deploy VM-Series Firewalls, they are quite flexible. You just have to select the instances, storage, security policies, and firewall rules. Within minutes, you can deploy the firewalls. We are also able to adjust firewall sizing on the fly, which is important. Initially, we decided on a firewall based on the throughput assumptions. But in peak hours or during a peak month for traffic, we need to scale the firewalls. That should be automatically done. AWS and Azure provide very good features and, by using them, within a second it automatically scales, based on the incoming traffic.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Defender for Identity has not affected the end-user experience."
"One of our users had the same password for every personal and company account. That was a problem because she started receiving phishing emails that could compromise all of her accounts. Defender told us that the user was not changing their password."
"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."
"All the integration it has with different Microsoft packages, like Teams and Office, is good."
"This solution has advanced a lot over the last few years."
"The feature I like the most about Defender for Identity is the entity tags. They give you the ability to identify sensitive accounts, devices, and groups. You also have honeytoken entities, which are devices that are identified as "bait" for fraudulent actors."
"The feature I like most is that you can create your own customized detection rules. It has a lot of default alerts and rules, but you can customize them according to your business needs."
"Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence."
"Centralized management is valuable because it allows us to configure settings in one location and apply them across all three locations."
"The initial setup was straightforward."
"It has a good performance which helps you with the stability of your virtual environment."
"The solution strengthens our IT posture."
"In the newer version, there are 3850s, all of them are scalable. They fit better into the medium or small businesses."
"The filtering feature is good."
"The VM-Series scalability is fast and easy to implement, improving our security posture as our Azure network grows."
"The most valuable features of the solution are its stability, ease of implementation, ease of operation, and security."
 

Cons

"An area for improvement is the administrative interface. It's basic compared to other administrative centers. They could make it more user-friendly and easier to navigate."
"The tracking instance needs to be configured appropriately."
"One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents."
"The solution could be better at using group-managed access and they could replace it with broad-based access controls."
"Defender for Identity gives us visibility, but we often get false positives from Azure that take us down the garden path. We go through 30 incidents each day and most of those are false positives or benign positive alerts. Occasionally, we get true positive alerts."
"We observe a lot of false positives. Sometimes, when we go for a coffee break, we lock our screens. Locking the screen has a separate Windows event ID and sometimes I see it is detected as a failed login."
"When the data leaves the cloud, there are security issues."
"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."
"There's room for improvement in terms of integration with the load balancer. It isn't like Fortinet, which has a load balancer built into its firewall. It is effortless to integrate within the load balancer-plus-firewall solution."
"They made only a halfhearted attempt to put in DLP (Data Loss Prevention)."
"The utilization monitoring and GUI have room for improvement."
"The implementation should be simplified."
"The product could provide protection above Layer 3, which gets into the application layer and provides better visibility into those aspects of application security."
"At the beginning of the implementation, we had some difficulties with the scripts, but Palo Alto Networks support together with a local partner finally fixed it."
"Palo Alto Networks VM-Series is a complex product to work with."
"The only minor issue we've faced is with the app's ID configuration, which requires specific matching for application filtering."
 

Pricing and Cost Advice

"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"The pricing and licensing of this product on AWS should be from $1.28/hr or $4,500.00/yr. Then, it would be a good price for the performance that it delivers."
"There is a need to make payments toward a yearly subscription-based model in which you need to add modules that you want to use in your company."
"AWS is available as a AMI that you can purchase from the AWS Marketplace. Therefore, you need to purchase the licensing, since it is per AMI. Then, you deploy it on a regular EC2. Then, for on-premise, you can use both Palo Alto's software and hardware."
"Initially, pricing was high. Later on, we were able to negotiate the pricing and get something that fits our budget."
"Palo Alto can be as much as two times the price of competing products that have twice the capabilities."
"Because the solution was getting deployed on AWS, it was the best place to go and it was available there."
"The solution is expensive. I rate its pricing a three out of ten."
"The license fee is slightly high."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
787,779 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
14%
Government
8%
Manufacturing Company
7%
Computer Software Company
16%
Financial Services Firm
11%
Manufacturing Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Microsoft Defender for Identity?
Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.
What needs improvement with Microsoft Defender for Identity?
One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents. Currently, it is mandatory to install the agent on the on-premises e...
What is your primary use case for Microsoft Defender for Identity?
Microsoft Defender for Identity is like a personal security guard for our organization's identity. It keeps a close eye on how we use our identities across both on-premises and Azure Active Directo...
Features comparison between Palo Alto and Fortinet firewalls
In the best tradition of these questions, Feature-wise both are quite similar, but each has things it's better at, it kind of depends what you value most. PA is good at app control, web filtering a...
How does Azure Firewall compare with Palo Alto Networks VM Series?
Both products are very stable and easily scalable. The setup of Azure Firewall is easy and very user-friendly and the overall cost is reasonable. Azure Firewall offers a solid threat awareness, can...
 

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
No data available
 

Overview

 

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Warren Rogers Associates
Find out what your peers are saying about Microsoft Defender for Identity vs. Palo Alto Networks VM-Series and other solutions. Updated: May 2024.
787,779 professionals have used our research since 2012.