Microsoft Defender for Identity Reviews

The main use cases for Microsoft Defender for Identity involve working with security and signing risk aspects. I work with conditional access, though I have not implemented this task yet.

I find the most valuable features in Microsoft Defender for Identity to be the conditional access and the rule-based access control to give users their actual role-based permission to work.

Microsoft security solutions have saved me time, which is why they call it Microsoft solution.

We have deployed Microsoft Defender for Identity logs in our Sentinel. If there is a suspicious sign in, a wrong password, and if the MFA is not satisfied, the trigger gets alerted, and the user will be identified as a risky user. It will prompt the user to change the password. Auto remediation is enabled in Microsoft Defender for Identity, helping in identifying if the user identity is genuine.

Threats to the organization are mitigated instantly. If a user logs from a different IP or Tor Browser, we get notified, block that account, deactivate the user, and request a password change. We have the information about the risky users signed in from non-available IPs or locations displayed on our dashboard using Microsoft Defender for Identity.

We receive an advance report of risky users, allowing us to take preemptive action before an attack causes damage to organization details. This proactive measure offers an advanced security operation.

Microsoft Defender for Identity is used as part of an overall Microsoft Defender security suite. I use it to manage identities, both on-premises and in the cloud, in conjunction with an identity and access management tool, such as SailPoint or Guaranty.

The integration into the Microsoft Defender ecosystem is the most valuable feature of Microsoft Defender for Identity. It fits very nicely with all the other Defender tools, allowing for excellent collaboration among them. It also fits seamlessly into Microsoft Sentinel SIEM. Furthermore, Microsoft security solutions can save time as they allow the automation of numerous functionalities, and the reporting inside the Microsoft ecosystem is commendable.

I have experience with Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for IoT, including Microsoft Defender External Attack Surface Management.

We use Microsoft Defender for Identity with our EMS E5 license which comes with all these components.

We have been using Microsoft Defender for Identity for more than four years.

We are an end user and customer for them.

It is part of the product itself. It is bundled and the product we use internally is completely based on Microsoft solutions for managing a single identity.

We use the comprehensive reporting and intelligent threat analytics features.

Based on the detection of incidents, we can prevent issues, and if there are any identity-related alerts, they are prevented through a conditional access policy.

The primary use case for Microsoft Defender for Identity is to maintain control and privilege inside our organization and revoke rights when they are not needed. The solution is used to keep our organization relatively safe and is utilized extensively across its features available in E3 and E5.

The most valuable features of Microsoft Defender for Identity include its automatic remedies, possibilities for avoiding incidents, the privilege manager, and the generation of logs that facilitate a safer environment. It provides real issues directly to us without fake alerts. The visibility into threats is very good, especially with add-ons like Sentinel.

I am actively working with Microsoft Defender for Identity for tasks involving SQL identity endpoint management and have used it since 2019.

Microsoft Defender for Identity enhances the capability to detect threats effectively and provides comprehensive security by integrating its artificial intelligence algorithms. It acts like a security watchguard with a high level of threat detection parallel to a predator drone.

My personal use case for Microsoft Defender for Identity is that it is amazing. It provides very good and deep analytics about whatever is happening in the on-premises Active Directory. The sensors are very lightweight. It is used in almost every deployment that we are doing for Azure or virtual machines on Azure or even migration of M365 Modern Workplace. We always include Microsoft Defender for Identity for all customers, whether for on-premises or infrastructure as a service.

The most valuable features of Microsoft Defender for Identity are the simulations. Whenever something happens, it provides complete step-by-step process details, including the hierarchy, how it happens in the environment, and the lateral movement, which is amazing.

The main benefits Microsoft Defender for Identity provides to users are comprehensive insights. When customers have Azure AD, they have all the insights by default, using Azure Monitor sign-in logs and everything. However, when they have on-premises Active Directory, they typically have no visibility into user lockouts, wrong attempt patterns, and other issues. Microsoft Defender for Identity fills this gap by providing deep insights for hybrid users in the on-premises Active Directory.

The integration of Microsoft Defender for Identity with MS 365 is exceptional. While we have not tested it along with Sentinel, the security.microsoft.com site provides valuable insights through the portal. The integration process is simple and straightforward.

The reporting and intelligent threat analytics provided by Microsoft Defender for Identity are effective and comprehensive.