Huntress Managed ITDR vs Microsoft Defender for Identity comparison

Huntress Managed ITDR vs. Microsoft Defender for Identity

Download the complete report

Helped 850,028 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Huntress Managed ITDR

Ranking in Identity Threat Detection and Response (ITDR)

11th

Average Rating

10.0

Reviews Sentiment

9.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Microsoft Defender for Iden...

Ranking in Identity Threat Detection and Response (ITDR)

1st

Average Rating

8.8

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Advanced Threat Protection (ATP) (5th), Microsoft Security Suite (7th)

Featured Reviews

Kevin

Business Owner at Royal IT

Peace of mind in identifying compromises in your M365 tenants

Huntress Managed ITDR examines various signals from the M365 tenants. If anything suspicious is identified, their SOC analysts can take a closer look and subsequently take action. It's a comprehensive solution covering endpoints and cloud tenants, offering peace of mind. I recognized its benefits immediately, as it provides protection against M365 identity compromises, like admin account breaches.

Read full review

Sachin Vinay

Assistant Manager-Networks at Amrita

Easily detects advanced attacks based on user behavior

The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud. Identity harvesting is the most common threat. Legacy Microsoft solutions and Amazon face the same issues in the cloud. Users don't implement other security mechanisms in the cloud. In an on-premise environment, we would have multiple security devices like firewalls and several layers of security. Cloud users are less bothered because cloud features are there and only need to be configured. Microsoft Defender for Cloud is the best solution because all threats are completely visible, and it has a great dashboard. The dashboard displays each threat and score, so we can identify the threat rating and act efficiently to avoid compromising user identities. We have a single sign-on feature on the cloud. If we lose a single set of identities, it can compromise the entire organization, including cloud and on-premise. The same identities are being used everywhere. The user activity has to be completely visible on the dashboard, and it has to generate a pattern. It will notify us if there is any security breach. It is a complete monitoring set. Minor changes in the user identity can lead to data leakage. If a password is changed in the cloud, it will be reflected automatically in the on-premise. This minor change will trigger an alert in Microsoft Defender for Identity. It ensures that each cloud identity is well protected from spoofing. It has a comprehensive database of well-known spoofing techniques, enabling us to provide cloud identity protection completely. It has a vast scope because it is completely single sign-on. In the emerging industry, we use single sign-on because users need to authenticate, but it's challenging to remember multiple passwords. Once your user signs in, you can access all the data. An identity compromise would lead to various issues and affect the data on-premises. Defender maintains a constantly updated database with the latest signatures, attack models, and threats. If it detects one threat, it will monitor the suspicious event and give us frequent alerts. Identity protection is vital because we use an identity mechanism for everything, including firewall-related activities. The exact identity used in the cloud is used in the most complex firewalls. We require an excellent migration technique to regain this user credential if something gets compromised. Blocking this requires a massive set of procedures. Microsoft Defender comprehensively monitors identity and provides frequent alerts regarding any issue, so we don't need to think of anything else. Defender's bidirectional sync capabilities are helpful because we need to sync data from multiple directions, including tenant-to-tenant, on-premise-to-cloud, and cloud-to-cloud syncing. As a university, we have multiple tenants, so we need to sync or access data across platforms. That way, everything is more secure, and Microsoft Defender for Cloud also provides ample security for cloud transfers. The bidirectional sync capabilities are flawless—10 out of 10. Our on-premise Active Directory is perfectly synced with the Azure AD. Everything is synced with on-premise, and changes are reflected in minutes. If a problem with identity is addressed on the cloud, the fix will be mirrored on-premise and vice versa. Microsoft Defender for Cloud and Identity are bundled. If we have these two solutions, we don't need to worry about anything else or third-party antivirus. Microsoft Defender for Identity acts as a link to all the Microsoft security features that require identity-based validation. Microsoft Defender instantly provides identity security for all our applications, and users need not worry about typing their passwords. Even in situations with less complex encryption mechanisms, users don't need to worry about typing in their passwords. Defender will check and monitor if there are any flaws in that, and it will let us know if there are any issues. We're a Microsoft shop, so everything works together. If one feature isn't working, everything will be affected. If Defender isn't working, half of our Microsoft security features will be dead. Without identity security, user data can easily be compromised, and data can fall into the hands of intruders or other hackers. The solutions have to complement each other. If anything got wrong, the entire setup would have flaws. Microsoft security has a legacy security mechanism. A while back, we might have gone with Defender for Endpoint, but Microsoft has also grown into the face of the cloud. The same Defender solution is completely maintaining cloud security. We can imagine Microsoft's vast scale and how Defender can protect the cloud environment from vulnerabilities and attacks. We are definitely delighted with Microsoft products. The dashboard features are fantastic because it provides a comprehensive overview. It has a great alert mechanism and log inspector that tracks when users access various servers. With this kind of identity validation, we can control which servers the users can access. We have total visibility from the dashboard. We can track identity usage even if there are no issues. That is an essential advantage.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Huntress Managed ITDR examines various nulls from the M365 tenants. If anything suspicious is identified, their SOC analysts can take a closer look and subsequently take action."

"The centralized management with the EDR and ITDR is beneficial."

"I rate the overall solution as a ten out of ten."

"The initial setup was very easy."

"Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence."

"The most valuable aspect is its connection to Microsoft Sentinel and Defender for Endpoint, and giving exact timelines for incidents and when certain events occured during an incident."

"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."

"The most valuable features of Microsoft Defender for Identity include real-time information for threat detection, its inclusion of behavioral analytics, and vulnerability management."

"It is easy to set up. Based on the number of devices you would like to set up, you can use scripts, Group Policy, etc. It takes five minutes to set up."

"The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks."

"Defender for Identity has not affected the end-user experience."

"The solution’s alerting is fairly efficient."

More Microsoft Defender for Identity pros

Cons

"More in-depth reporting could be beneficial for the solution."

"The product needs further maturity, with some improvements in the user interface."

"More in-depth reporting could be beneficial for the solution."

"The product needs further maturity, with some improvements in the user interface."

"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."

"One improvement I would recommend is the integration of an admin application within Teams, allowing easy access to attack information on a mobile platform to promptly alert affected users and their friends."

"Defender for Identity gives us visibility, but we often get false positives from Azure that take us down the garden path. We go through 30 incidents each day and most of those are false positives or benign positive alerts. Occasionally, we get true positive alerts."

"The areas of Microsoft Defender for Identity that can be improved include its cost, which is quite expensive when integrated into Sentinel. Additionally, there is room for improvement in its integration with non-Microsoft applications and systems."

"When the data leaves the cloud, there are security issues."

"Microsoft should look at what competing vendors like CrowdStrike and Broadcom are doing and incorporate those features into Sentinel and Defender. At the same time, I think the intelligence inside the product is improving fast. They should incorporate more zero-trust and hybrid trust approaches. They need to build up threat intelligence based on threats and methods used in attacks on other companies."

"One area that needs improvement is the number of alerts generated, leading to alert fatigue."

"And when you are working in a priority IP address, Identity is not able to know that those IPs are from the company. It sees that the IPs are from Taiwan or from Hong Kong or from India, even though they are internal IPs, resulting in a lot of false positives."

More Microsoft Defender for Identity cons

Pricing and Cost Advice

Information not available

"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."

"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."

"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."

"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."

See which vendors are best for you

Use our free recommendation engine to learn which Identity Threat Detection and Response (ITDR) solutions are best for your needs.

See recommendations

850,028 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

30%

Insurance Company

25%

University

Retailer

Computer Software Company

15%

Financial Services Firm

13%

Government

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

What is your experience regarding pricing and costs for Huntress Managed ITDR?

The pricing of ITDR is reasonable.

What needs improvement with Huntress Managed ITDR?

More in-depth reporting could be beneficial for the solution.

What is your primary use case for Huntress Managed ITDR?

I use Huntress Managed ITDR for 365 protection, monitoring log run events, security, and abnormal logons.

What do you like most about Microsoft Defender for Identity?

Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.

What needs improvement with Microsoft Defender for Identity?

There is room for improvement in delivering knowledge to technical users, especially regarding what we can gain from the solution and how to apply it. The documentation provided by Microsoft is oft...

What is your primary use case for Microsoft Defender for Identity?

The primary use case for Microsoft Defender for Identity is to maintain control and privilege inside our organization and revoke rights when they are not needed. The solution is used to keep our or...

Proofpoint Identity Threat Defense vs Huntress Managed ITDR

Comparisons

Compared 46% of the time

Microsoft Defender for Endpoint vs Huntress Managed ITDR

Compared 34% of the time

CrowdStrike Falcon vs Huntress Managed ITDR

Compared 20% of the time

More Huntress Managed ITDR Competitors

Microsoft Entra ID Protection vs Microsoft Defender for Identity

Compared 27% of the time

Microsoft Purview Insider Risk Management vs Microsoft Defender for Identity

Compared 11% of the time

CrowdStrike Falcon vs Microsoft Defender for Identity

Compared 8% of the time

BloodHound Enterprise vs Microsoft Defender for Identity

Compared 7% of the time

Microsoft Defender for Endpoint vs Microsoft Defender for Identity

Compared 6% of the time

More Microsoft Defender for Identity Competitors

Product Reports

Identity Threat Detection and Response (ITDR)

Download Huntress Managed ITDR product report

Microsoft Defender for Identity

Download Microsoft Defender for Identity product report

Also Known As

No data available

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity

Overview

Huntress Managed ITDR delivers robust threat detection and response capabilities tailored to IT infrastructure, enhancing security measures for managed service providers.

This ITDR provides a comprehensive approach to identifying and mitigating advanced cyber threats. It focuses on proactive threat hunting and remediation, designed specifically for IT environments that require constant vigilance. The platform offers a suite of intelligent tools that streamline the process of monitoring and defending against security challenges, ensuring protection for sensitive data and networks.

What are the key features of Huntress Managed ITDR?

Threat Detection and Analysis: Continuously monitors network activities to detect threats in real-time, providing detailed analysis for quick response.
Proactive Remediation: Offers step-by-step remediation guidance to ensure immediate action against identified threats.
Security Alerting: Sends timely alerts to keep users informed about potential security incidents, enabling swift decisions.
Detailed Reporting: Generates comprehensive reports with insights into threat patterns and vulnerabilities to aid in strategic planning.

What benefits and ROI can users expect?

Reduced Incident Response Time: Automation and alerts help minimize the time spent on responding to threats.
Improved Cybersecurity Posture: With continuous monitoring, users can enhance their security measures.
Operational Efficiency: Automating threat detection allows IT teams to focus more on strategic initiatives.
Cost Savings: Mitigates costly data breaches by identifying threats before they escalate.

Huntress Managed ITDR is implemented across industries like finance and healthcare, where data sensitivity and regulation compliance are crucial. In such environments, it plays a critical role in safeguarding data integrity and ensuring that cybersecurity standards are met.

Huntress

Microsoft Defender for Identity integrates with Microsoft tools to monitor user activity, providing advanced threat detection and analysis using AI. It enhances proactive threat response and security visibility, making it essential for securing on-premises and cloud environments like Active Directory.

Microsoft Defender for Identity offers comprehensive monitoring and AI-driven user behavior analysis. It detects threats through real-time alerts and identifies lateral movements and entity tagging, ensuring robust security management. With excellent visibility via its dashboard, it supports customized detection rules and seamlessly integrates with SIEM platforms. While SecureScore and SecureScan provide robust environment security, there is room for improvement in cloud security, on-premises application integration, and remediation capabilities. Azure integration is limited, and the administrative interface could be more user-friendly. Users experience frequent false positives, affecting threat detection efficiency.

What key features stand out in Microsoft Defender for Identity?

Integration with Microsoft Tools: Ensures comprehensive protection across environments.
AI-driven Behavior Analysis: Uses artificial intelligence to analyze user actions.
Real-time Threat Detection: Provides immediate alerts to potential threats.
Lateral Movement Identification: Detects unusual lateral access among users.
Dashboards with Visibility: Offers insights into security issues with customization options.
SIEM Integration: Works seamlessly with security information and event management systems.

What benefits should users look for when reviewing Microsoft Defender for Identity?

Enhanced Threat Prioritization: Helps in effective identification and tackling of threats.
Improved Proactive Responses: Facilitates a prompt and efficient response mechanism.
Security Across Environments: Protects both on-premises and cloud-based infrastructures.
Optimized Conditional Access: Manages policies to enhance security protocol efficacy.

In specific industries such as education and finance, Microsoft Defender for Identity is crucial for securing on-premises Active Directory and Azure Active Directory environments. It effectively detects suspicious activities and manages conditional access policies, offering user and entity behavior analytics, endpoint detection and response capabilities. This helps prevent unauthorized access and strengthens overall security, making it an invaluable asset for organizations aiming to safeguard their digital infrastructure.

Microsoft

Sample Customers

Information Not Available

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.

Huntress Managed ITDR vs. Microsoft Defender for Identity