Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Identity vs Trellix Advanced Threat Defense comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 1, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender for Iden...
Ranking in Advanced Threat Protection (ATP)
5th
Average Rating
8.8
Reviews Sentiment
7.0
Number of Reviews
25
Ranking in other categories
Microsoft Security Suite (5th), Identity Threat Detection and Response (ITDR) (3rd)
Trellix Advanced Threat Def...
Ranking in Advanced Threat Protection (ATP)
21st
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
8
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of July 2025, in the Advanced Threat Protection (ATP) category, the mindshare of Microsoft Defender for Identity is 6.9%, down from 7.9% compared to the previous year. The mindshare of Trellix Advanced Threat Defense is 1.9%, up from 1.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Advanced Threat Protection (ATP)
 

Featured Reviews

ROBERT-CHRISTIAN - PeerSpot reviewer
Integration within the ecosystem enhances collaboration and automates functionalities
The integration into the Microsoft Defender ecosystem is the most valuable feature of Microsoft Defender for Identity. It fits very nicely with all the other Defender tools, allowing for excellent collaboration among them. It also fits seamlessly into Microsoft Sentinel SIEM. Furthermore, Microsoft security solutions can save time as they allow the automation of numerous functionalities, and the reporting inside the Microsoft ecosystem is commendable.
HS
Easy to set up and use with a nice interface
The scalability could be better. We'd like them to be better at dealing with script threats. In sandboxing, the time to respond is slower than we would like. We'd like them to be able to process faster. For example, Fortinet, they are doing 18,000 files per hour. For Wildfire, it is elastic. It can support as many files as you get. McAfee doesn't react like that. It does not support interfaces with HTTPS.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."
"All the integration it has with different Microsoft packages, like Teams and Office, is good."
"Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence."
"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."
"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."
"This solution has advanced a lot over the last few years."
"I would rate Microsoft Defender for Identity at nine out of ten."
"The solution’s alerting is fairly efficient."
"I recommend this solution because of its ease of use."
"Provides good exfiltration, and is an all-in-one product."
"The most valuable features are the administration console and its detection and response module."
"It is very scalable."
"Its greatest strength is the DXL client which can rapidly disseminate attack information to all clients via the McAfee Agent instead of going through the ePO server."
"It stops in excess of twenty-five malware events per month, all of which could be critical to the business."
"It is stable and reliable."
 

Cons

"One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents."
"The solution should provide more detailed data regarding anomaly detections."
"The tracking instance needs to be configured appropriately."
"Feedback on sync issues with the Microsoft portal highlighted its slow nature, with syncs sometimes taking eight hours."
"There is no option to remedy an issue directly from the console. If we see an alert, we can't fix it from the console. Instead, we must depend on other Microsoft products, such as MDE. That is a significant drawback. It simply works as a scanner, which can sometimes put enough load on the sensors. Immediate actions should be possible from the dashboard because. It can prevent issues from spreading further."
"One area that needs improvement is the number of alerts generated, leading to alert fatigue."
"They should improve the automation for impossible travel detection. When connected to Wi-Fi and then to VPN, the system sometimes interprets the IP address change as impossible travel."
"One improvement I would recommend is the integration of an admin application within Teams, allowing easy access to attack information on a mobile platform to promptly alert affected users and their friends."
"Lacks remote capabilities not dependent on the internet."
"There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client."
"The initial setup was industry standard complex. It takes awhile and has a lot of planning involved. It could be simplified with product redesign."
"This solution needs to be made "cloud ready"."
"Make the ATD system a part of the whole product and take the whole thing onto the cloud. While it is there already, it is not to the same level as the on-premise version."
"We'd like them to be better at dealing with script threats."
"I would like to see future versions of the solution incorporate artificial intelligence technology."
 

Pricing and Cost Advice

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."
"Our licensing fees for this solution are approximately one million dollars per year."
"The product is expensive, but it is better than the rest of them in the industry."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
861,524 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
13%
Government
7%
Manufacturing Company
7%
Government
17%
Manufacturing Company
14%
Financial Services Firm
13%
Comms Service Provider
11%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Microsoft Defender for Identity?
Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.
What needs improvement with Microsoft Defender for Identity?
For improvement, I need to complete the testing. We are currently in the initial phase. Improvement insights will be shared post the thorough testing phase. We have just started using it a month ag...
What is your primary use case for Microsoft Defender for Identity?
We are performing testing under Microsoft Defender for Identity ( /products/microsoft-defender-for-identity-reviews ). The implementation is very recent, as we started using it about a month ago.We...
What do you like most about McAfee Advanced Threat Defense?
I recommend this solution because of its ease of use.
What needs improvement with McAfee Advanced Threat Defense?
There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client.
What is your primary use case for McAfee Advanced Threat Defense?
We use the solution for client management and security. We used the whole suite for client Firewall, antivirus, and everything provided by Trellix.
 

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
McAfee Advanced Threat Defense
 

Overview

 

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust
Find out what your peers are saying about Microsoft Defender for Identity vs. Trellix Advanced Threat Defense and other solutions. Updated: June 2025.
861,524 professionals have used our research since 2012.