Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Identity vs Microsoft Purview Data Lifecycle Management comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender for Iden...
Ranking in Microsoft Security Suite
4th
Average Rating
8.8
Reviews Sentiment
6.8
Number of Reviews
28
Ranking in other categories
Advanced Threat Protection (ATP) (8th), Identity Threat Detection and Response (ITDR) (3rd)
Microsoft Purview Data Life...
Ranking in Microsoft Security Suite
29th
Average Rating
8.0
Reviews Sentiment
6.1
Number of Reviews
4
Ranking in other categories
Email Archiving (9th), Document Management Software (2nd), Data Governance (26th)
 

Mindshare comparison

As of January 2026, in the Microsoft Security Suite category, the mindshare of Microsoft Defender for Identity is 6.0%, down from 7.5% compared to the previous year. The mindshare of Microsoft Purview Data Lifecycle Management is 1.2%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Microsoft Security Suite Market Share Distribution
ProductMarket Share (%)
Microsoft Defender for Identity6.0%
Microsoft Purview Data Lifecycle Management1.2%
Other92.8%
Microsoft Security Suite
 

Featured Reviews

RK
Cloud Security & Governance at a financial services firm with 10,001+ employees
Protect on-premises and hybrid environments with advanced threat detection and seamless integration
Our Active Directory implementation is a hybrid one. The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks. It identifies lateral movements, privilege escalations, and alerts on potential attacks. The tool is also used for security posture assessment. The seamless integration with other Microsoft solutions within our Microsoft-centric environment is also a major advantage.
RK
Cloud Security & Governance at a financial services firm with 10,001+ employees
A comprehensive data management solution shows potential for improvement while providing strong integration with existing infrastructure
One of the requirements is to have data leak policies and data access policies. This is very critical to enforce data governance standards, which relate to data classification, access control, data protection, and retention. It covers the entire lifecycle, helping us to protect, detect, and classify the documents. Challenges are mostly related to the security products onboarded into the bank; they have challenges in terms of those products complying with the internal standards. Sometimes, we cannot just use the DLP across the state. For example, using Microsoft products has been easy to adopt, such as OneDrive and SharePoint on-premise, but it becomes a challenge when it comes to AWS, as data also exists in S3 buckets. Testing is still ongoing, but it will eventually be done. The time it takes to scan is one issue; when we raise high-volume issues and tickets related to scanning failures, it relates to permission errors, which are technical challenges. These take time because we have high volume tickets in terms of connectivity, scanning failures, and related matters. There are also frequent change requests, especially regarding scoping or rescoping due to complexities, creating several challenges. In both organizations I work with, there are gaps, and there is no enterprise-wide data classification available. However, there are pockets of implementations for various products. Some agencies are using it, but otherwise, there's no product existing across the enterprise. Microsoft Purview Data Lifecycle Management is definitely a good solution, but there is significant room for improvement from a product perspective. Reporting is another area that needs improvement.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution offers excellent visibility into threats."
"It automates routine testing and helps automate the finding of high-value alerts."
"The most valuable features of Microsoft Defender for Identity include real-time information for threat detection, its inclusion of behavioral analytics, and vulnerability management."
"This solution has advanced a lot over the last few years."
"The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks."
"The most valuable aspect is its connection to Microsoft Sentinel and Defender for Endpoint, and giving exact timelines for incidents and when certain events occured during an incident."
"I recommend Microsoft Defender for Identity because it is easy to implement."
"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."
"The automatic data labeling is compelling, and we are investigating its use."
"The UI is the most valuable feature."
"Purview's built-in functionality provides immediate access to reports, streamlining the entire process."
"The impact of Microsoft Purview Data Lifecycle Management on my unified data catalog has improved a lot; the improvements I see are in the lineage, the discovery, and the labeling."
"The system is stable; I haven't encountered any worldwide stability issues unlike other office products."
 

Cons

"When the data leaves the cloud, there are security issues."
"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."
"One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents."
"The documentation provided by Microsoft is often seen as a waste of time."
"Fixing the solution isn't very seamless."
"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."
"They should improve the automation for impossible travel detection. When connected to Wi-Fi and then to VPN, the system sometimes interprets the IP address change as impossible travel."
"One improvement I would recommend is the integration of an admin application within Teams, allowing easy access to attack information on a mobile platform to promptly alert affected users and their friends."
"The time it takes to scan is one issue; when we raise high-volume issues and tickets related to scanning failures, it relates to permission errors, which are technical challenges."
"I think labeling could use a lot more AI assistance. AI implementation into labeling would be beneficial."
"Microsoft Purview Data Lifecycle Management can be challenging to implement due to its complexity and dense documentation, making it difficult to get started."
"Microsoft's Purview Data Lifecycle Management preview features can be unreliable, hindering their usefulness."
"Microsoft Purview Data Lifecycle Management can be challenging to implement due to its complexity and dense documentation, making it difficult to get started."
 

Pricing and Cost Advice

"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."
"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"The service operates on a pay-as-you-go basis, charging an extra one cent per field of metadata scanned in our data."
report
Use our free recommendation engine to learn which Microsoft Security Suite solutions are best for your needs.
881,114 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Computer Software Company
12%
Manufacturing Company
8%
Comms Service Provider
7%
Computer Software Company
13%
Government
12%
Manufacturing Company
9%
Financial Services Firm
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise4
Large Enterprise14
No data available
 

Questions from the Community

What needs improvement with Microsoft Defender for Identity?
I really would have to sit down to think about how Microsoft Defender for Identity can be improved. I didn't take stock in what needs to be improved because I appreciated having the tools right the...
What is your primary use case for Microsoft Defender for Identity?
My main use cases for Microsoft Defender for Identity include Conditional Access, checking risky users, remediating risky users, and user sign-ins. I can easily remediate or determine what the user...
What advice do you have for others considering Microsoft Defender for Identity?
I don't really use Microsoft Defender for Identity a lot because my new role doesn't allow me to take time to do so. I don't really use the threat intelligence feature of Microsoft Defender for Ide...
What is your experience regarding pricing and costs for Microsoft Purview Data Lifecycle Management?
We opted for Purview Data Lifecycle Management due to its significant cost advantage over competitors. At a 95 percent price reduction, it was a clear winner. The service operates on a pay-as-you-g...
What needs improvement with Microsoft Purview Data Lifecycle Management?
I think labeling could use a lot more AI assistance. AI implementation into labeling would be beneficial.
What is your primary use case for Microsoft Purview Data Lifecycle Management?
My major use case for Microsoft Purview Data Lifecycle Management is for the classification of data.
 

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
Microsoft Information Governance, Microsoft Purview Records Management
 

Overview

 

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Information Not Available
Find out what your peers are saying about Microsoft Defender for Identity vs. Microsoft Purview Data Lifecycle Management and other solutions. Updated: December 2025.
881,114 professionals have used our research since 2012.