Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Identity vs Microsoft Defender for IoT comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender for Iden...
Ranking in Microsoft Security Suite
4th
Average Rating
8.8
Reviews Sentiment
6.8
Number of Reviews
28
Ranking in other categories
Advanced Threat Protection (ATP) (8th), Identity Threat Detection and Response (ITDR) (3rd)
Microsoft Defender for IoT
Ranking in Microsoft Security Suite
24th
Average Rating
7.4
Reviews Sentiment
6.6
Number of Reviews
5
Ranking in other categories
IoT Security (5th), Operational Technology (OT) Security (6th)
 

Mindshare comparison

As of January 2026, in the Microsoft Security Suite category, the mindshare of Microsoft Defender for Identity is 6.0%, down from 7.5% compared to the previous year. The mindshare of Microsoft Defender for IoT is 1.0%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Microsoft Security Suite Market Share Distribution
ProductMarket Share (%)
Microsoft Defender for Identity6.0%
Microsoft Defender for IoT1.0%
Other93.0%
Microsoft Security Suite
 

Featured Reviews

RK
Cloud Security & Governance at a financial services firm with 10,001+ employees
Protect on-premises and hybrid environments with advanced threat detection and seamless integration
Our Active Directory implementation is a hybrid one. The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks. It identifies lateral movements, privilege escalations, and alerts on potential attacks. The tool is also used for security posture assessment. The seamless integration with other Microsoft solutions within our Microsoft-centric environment is also a major advantage.
AA
Principale Systems Architect at a manufacturing company with 10,001+ employees
Effective network monitoring with identified documentation improvements needed
The documentation for Microsoft Defender for IoT is lacking. There are no clear steps or guidance, and updates are frequent, which adds to the confusion. More detailed documentation with video instructions for tasks would be helpful. The system capabilities are not well-documented either. Importing device names and maintaining a list can be cumbersome, as it requires manual input for a large number of devices. The backup and restore process is limited to GUI for backup but lacks a GUI for restore, though future updates might address this. Sentinel documentation is also poor, with limited guidance available.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution offers excellent visibility into threats."
"We use AD Connect to sync on-premises AD to Azure AD, and so far, it has been effective."
"The most valuable features of Microsoft Defender for Identity include real-time information for threat detection, its inclusion of behavioral analytics, and vulnerability management."
"I would rate Microsoft Defender for Identity at nine out of ten."
"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."
"In the security portfolio that we manage, Microsoft Defender for Identity is very important because it is the professional service that we sell the most."
"It is easy to set up. Based on the number of devices you would like to set up, you can use scripts, Group Policy, etc. It takes five minutes to set up."
"I recommend Microsoft Defender for Identity because it is easy to implement."
"I believe it is best suited for cloud services and is unmatched by other cloud security solutions."
"It is manageable and integrates with other Microsoft products, which is crucial for me."
"I find Microsoft Defender very effective in vulnerability management and it provides good attack reduction, making it a next-generation protection solution."
"As a cybersecurity consultant, the best part of Microsoft Defender for IoT is the capability to integrate with other tools such as Microsoft Sentinel and receive real-time alerts from the product."
"The graphics and analysis in Microsoft Defender for IoT are very representative."
"Some advantages of Microsoft Defender for IoT are that it's easy to install on any OS, and you can create any custom use cases easily."
"Mainly, it is manageable and integrates with other Microsoft products, which is crucial for me."
 

Cons

"One improvement I would recommend is the integration of an admin application within Teams, allowing easy access to attack information on a mobile platform to promptly alert affected users and their friends."
"The technical support needs significant improvement. Documentation for more minor issues in the form of guides or walkthroughs could help to resolve this issue. The number of tickets raised would decrease, removing some pressure from the support team and making it easier to clear the remaining tickets."
"The areas of Microsoft Defender for Identity that can be improved include its cost, which is quite expensive when integrated into Sentinel. Additionally, there is room for improvement in its integration with non-Microsoft applications and systems."
"We observe a lot of false positives. Sometimes, when we go for a coffee break, we lock our screens. Locking the screen has a separate Windows event ID and sometimes I see it is detected as a failed login."
"Fixing the solution isn't very seamless."
"The solution could improve how it handles on-premises Android-related attacks."
"When the data leaves the cloud, there are security issues."
"And when you are working in a priority IP address, Identity is not able to know that those IPs are from the company. It sees that the IPs are from Taiwan or from Hong Kong or from India, even though they are internal IPs, resulting in a lot of false positives."
"Microsoft Defender for IoT is not scalable. If you want to monitor another industrial network, you need an additional server, making it less scalable."
"The only improvement I see is that some detection explanations are vaguely provided by Microsoft, resulting in generic IoT detections that alert me to an issue yet don't specify what's wrong."
"Customer service and support from Microsoft are costly. The execution by engineers is expensive, and the service is neither free nor toll-free, making it less accessible for customers."
"There are a few limitations with Microsoft Defender for IoT. We raised concerns with the product team because they don't capture all the information regarding command execution or processes executed on certain endpoints."
"The documentation for Microsoft Defender for IoT is lacking. There are no clear steps or guidance, and updates are frequent, which adds to the confusion."
"The primary area that needs improvement is compatibility with the latest IoT technologies."
"The only improvement I see is that some detection explanations are vaguely provided by Microsoft, resulting in generic IoT detections that alert me to an issue yet don't specify what's wrong."
 

Pricing and Cost Advice

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
Information not available
report
Use our free recommendation engine to learn which Microsoft Security Suite solutions are best for your needs.
881,114 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Computer Software Company
12%
Manufacturing Company
8%
Comms Service Provider
7%
Manufacturing Company
15%
Computer Software Company
14%
Energy/Utilities Company
7%
Financial Services Firm
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise4
Large Enterprise14
No data available
 

Questions from the Community

What needs improvement with Microsoft Defender for Identity?
I really would have to sit down to think about how Microsoft Defender for Identity can be improved. I didn't take stock in what needs to be improved because I appreciated having the tools right the...
What is your primary use case for Microsoft Defender for Identity?
My main use cases for Microsoft Defender for Identity include Conditional Access, checking risky users, remediating risky users, and user sign-ins. I can easily remediate or determine what the user...
What advice do you have for others considering Microsoft Defender for Identity?
I don't really use Microsoft Defender for Identity a lot because my new role doesn't allow me to take time to do so. I don't really use the threat intelligence feature of Microsoft Defender for Ide...
What needs improvement with Microsoft Defender for IoT?
I don't think I have any recommendation on improvements for Microsoft Defender for IoT because we don't use it too extensively. There are a few limitations with Microsoft Defender for IoT. We raise...
What is your primary use case for Microsoft Defender for IoT?
Clients mainly use Microsoft Defender for IoT for unfamiliar sign-in attempts and Microsoft Defender EDRs. We are using use cases for unfamiliar sign-in and malicious activity, such as user sign-in...
 

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
Azure Defender for IoT
 

Overview

 

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Information Not Available
Find out what your peers are saying about Microsoft Defender for Identity vs. Microsoft Defender for IoT and other solutions. Updated: December 2025.
881,114 professionals have used our research since 2012.