Microsoft Defender for Identity vs Stellar Cyber Open XDR comparison

Microsoft Defender for Identity vs. Stellar Cyber Open XDR

Download the complete report

Helped 869,202 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Microsoft Defender for Iden...

Ranking in Identity Threat Detection and Response (ITDR)

3rd

Average Rating

8.8

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Advanced Threat Protection (ATP) (5th), Microsoft Security Suite (3rd)

Stellar Cyber Open XDR

Ranking in Identity Threat Detection and Response (ITDR)

21st

Average Rating

0.0

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (49th), User Entity Behavior Analytics (UEBA) (22nd), Endpoint Detection and Response (EDR) (62nd), Network Traffic Analysis (NTA) (19th), Security Orchestration Automation and Response (SOAR) (24th), Network Detection and Response (NDR) (20th), Extended Detection and Response (XDR) (35th)

Mindshare comparison

As of October 2025, in the Identity Threat Detection and Response (ITDR) category, the mindshare of Microsoft Defender for Identity is 14.6%, down from 22.2% compared to the previous year. The mindshare of Stellar Cyber Open XDR is 1.3%, down from 2.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Identity Threat Detection and Response (ITDR) Market Share Distribution
Product	Market Share (%)
Microsoft Defender for Identity	14.6%
Stellar Cyber Open XDR	1.3%
Other	84.1%

Identity Threat Detection and Response (ITDR)

Featured Reviews

Peter Arabomen

Security Engineer at Fidelity Bank Plc

Has supported hybrid identity management while integrating well with cloud directory services

The only challenge I have with Microsoft Defender for Identity is the latency. I may not put that entirely on Microsoft, because latency could be network related. At times when trying to authenticate, the prompt is delayed. We tried implementing passwordless authentication, especially for on-premises workloads, but we haven't been able to achieve that. Passwordless authentication is part of the identity functionalities, particularly when it comes to enforcing passwordless for on-premises workloads. In terms of improvements, you can't create OUs on Azure AD. Regarding giving users privileges on what they can do across different OUs, I haven't seen that feature on Microsoft Defender for Identity. Microsoft Defender for Identity needs to be able to plug into third-party applications that are not Microsoft. For instance, with a human resource application used to manage users and leave requests, when staff leaves the organization, they are first exited from that application before AD. Integration between Azure AD and third-party applications would allow automatic syncing when removing staff. The initial setup of Microsoft Defender for Identity is not hard. However, setup is one thing, and getting value from the application end-to-end is another. It can be set up and running from the first day but not functioning optimally. Initially, when we did the setup, it wasn't optimal. Over time, with continuous improvement, which we're still doing, we've gotten to a comfortable level, but there's still room for improvement.

Read full review

Hrishiraj Bhattacharjee

Founder & CEO at Team Karimganj

Correlates incidents, allows for quicker identification and helps prioritize investigations

The only challenge is, and that’s where we come into play, it’s a pretty high-tech platform. So, it’s difficult for small and medium-sized organizations to manage it on their own. It’s a very complex system. It requires a lot of expertise. All my guys who work on it have gone through certification from Stellar itself. There are three different certifications that you need to complete. Only then are you certified by Stellar to work on it. It’s a very complex platform. Not everyone can use it. A simple IT engineer or system admin won’t be able to handle it because it’s quite complex. You need to have an understanding of the industry, the subject, and the tool. So, just purchasing this tool or license and then using it on your own would be very difficult to configure and manage on a day-to-day basis. The pricing model is not suitable for small and medium companies, particularly small companies. The minimum pricing model they have is suitable for companies with more than one thousand users. So, if someone has 50 to 100 users, like typical small companies, it’s difficult for them because the cost involved is high. Stellar would charge you for those thousand users, but you do not need all those users. So what are they going to do? I guess Stellar does not want to target small companies directly and maybe relies on resellers and MSPs like us to sell it. So, that is something I would recommend changing. Otherwise, it’s a great tool, but because of the pricing model, small companies are unable to leverage the advantage of this beautiful tool. So, the pricing model should be suitable for small and medium businesses. The product currently has vulnerability monitoring and everything. But if they could also do something about vulnerability management and maybe patch management, that would be nice.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We do not see any issues with the stability of Microsoft Defender for Identity. I can say it is 100% stable."

"The most valuable aspect is its connection to Microsoft Sentinel and Defender for Endpoint, and giving exact timelines for incidents and when certain events occured during an incident."

"We use AD Connect to sync on-premises AD to Azure AD, and so far, it has been effective."

"It automates routine testing and helps automate the finding of high-value alerts."

"One of our users had the same password for every personal and company account. That was a problem because she started receiving phishing emails that could compromise all of her accounts. Defender told us that the user was not changing their password."

"This solution has advanced a lot over the last few years."

"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."

"I would rate Microsoft Defender for Identity at nine out of ten."

More Microsoft Defender for Identity pros

"It can integrate with almost any cybersecurity tool available in the market."

"Stellar Cyber Open XDR offers these functionalities at a more affordable price, making it easier for me to position it with price-sensitive customers."

Cons

"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."

"The solution could be better at using group-managed access and they could replace it with broad-based access controls."

"Defender for Identity gives us visibility, but we often get false positives from Azure that take us down the garden path. We go through 30 incidents each day and most of those are false positives or benign positive alerts. Occasionally, we get true positive alerts."

"There is no option to remedy an issue directly from the console. If we see an alert, we can't fix it from the console. Instead, we must depend on other Microsoft products, such as MDE. That is a significant drawback. It simply works as a scanner, which can sometimes put enough load on the sensors. Immediate actions should be possible from the dashboard because. It can prevent issues from spreading further."

"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."

"One improvement I would recommend is the integration of an admin application within Teams, allowing easy access to attack information on a mobile platform to promptly alert affected users and their friends."

"The tracking instance needs to be configured appropriately."

"Feedback on sync issues with the Microsoft portal highlighted its slow nature, with syncs sometimes taking eight hours."

More Microsoft Defender for Identity cons

"I would rate the stability at about five to six. The platform requires some fine-tuning, especially when integrating data sources and creating connectors."

"Support is an issue because they have a limited number of resources."

Pricing and Cost Advice

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."

"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."

"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."

"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."

"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."

"It’s a single license platform."

See which vendors are best for you

Use our free recommendation engine to learn which Identity Threat Detection and Response (ITDR) solutions are best for your needs.

See recommendations

869,202 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

15%

Financial Services Firm

12%

Manufacturing Company

Comms Service Provider

Manufacturing Company

13%

Computer Software Company

11%

Comms Service Provider

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	7
Midsize Enterprise	3
Large Enterprise	14

No data available

Questions from the Community

What do you like most about Microsoft Defender for Identity?

Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.

What needs improvement with Microsoft Defender for Identity?

What is your primary use case for Microsoft Defender for Identity?

I've used Microsoft Defender for Identity primarily for provisioning users on Azure AD and Microsoft authentication. For hybrid scenarios, I integrate on-premises AD to Azure AD. We use AD Connect ...

What is your experience regarding pricing and costs for Stellar Cyber Open XDR?

Pricing is a major benefit of Stellar Cyber Open XDR. I rate it between three and four on the cost scale. It offers functionalities at a significantly lower cost than rival products, enabling me to...

What needs improvement with Stellar Cyber Open XDR?

I am currently evaluating Stellar Cyber Open XDR in terms of their support. I do not see any major areas for improvement as of now. Their support is good, and the team is small, enabling them to ca...

What is your primary use case for Stellar Cyber Open XDR?

I use Stellar Cyber Open XDR ( /products/stellar-cyber-open-xdr-reviews ) as a 24/7 security monitoring tool, especially for customers with large and medium networks. It eliminates the need for a d...

Microsoft Entra ID Protection vs Microsoft Defender for Identity

Comparisons

Compared 17% of the time

Microsoft Purview Insider Risk Management vs Microsoft Defender for Identity

Compared 16% of the time

CrowdStrike Falcon vs Microsoft Defender for Identity

Compared 13% of the time

BloodHound Enterprise vs Microsoft Defender for Identity

Compared 7% of the time

Microsoft Defender for Endpoint vs Microsoft Defender for Identity

Compared 6% of the time

More Microsoft Defender for Identity Competitors

Wazuh vs Stellar Cyber Open XDR

Compared 16% of the time

Sentinel vs Stellar Cyber Open XDR

Compared 8% of the time

Lumu vs Stellar Cyber Open XDR

Compared 6% of the time

Elastic Security vs Stellar Cyber Open XDR

Compared 5% of the time

CrowdStrike Falcon vs Stellar Cyber Open XDR

Compared 5% of the time

More Stellar Cyber Open XDR Competitors

Product Reports

Microsoft Defender for Identity

Download Microsoft Defender for Identity product report

Extended Detection and Response (XDR)

Download Stellar Cyber Open XDR product report

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity

No data available

Overview

Microsoft Defender for Identity integrates with Microsoft tools to monitor user activity, providing advanced threat detection and analysis using AI. It enhances proactive threat response and security visibility, making it essential for securing on-premises and cloud environments like Active Directory.

Microsoft Defender for Identity offers comprehensive monitoring and AI-driven user behavior analysis. It detects threats through real-time alerts and identifies lateral movements and entity tagging, ensuring robust security management. With excellent visibility via its dashboard, it supports customized detection rules and seamlessly integrates with SIEM platforms. While SecureScore and SecureScan provide robust environment security, there is room for improvement in cloud security, on-premises application integration, and remediation capabilities. Azure integration is limited, and the administrative interface could be more user-friendly. Users experience frequent false positives, affecting threat detection efficiency.

What key features stand out in Microsoft Defender for Identity?

Integration with Microsoft Tools: Ensures comprehensive protection across environments.
AI-driven Behavior Analysis: Uses artificial intelligence to analyze user actions.
Real-time Threat Detection: Provides immediate alerts to potential threats.
Lateral Movement Identification: Detects unusual lateral access among users.
Dashboards with Visibility: Offers insights into security issues with customization options.
SIEM Integration: Works seamlessly with security information and event management systems.

What benefits should users look for when reviewing Microsoft Defender for Identity?

Enhanced Threat Prioritization: Helps in effective identification and tackling of threats.
Improved Proactive Responses: Facilitates a prompt and efficient response mechanism.
Security Across Environments: Protects both on-premises and cloud-based infrastructures.
Optimized Conditional Access: Manages policies to enhance security protocol efficacy.

In specific industries such as education and finance, Microsoft Defender for Identity is crucial for securing on-premises Active Directory and Azure Active Directory environments. It effectively detects suspicious activities and manages conditional access policies, offering user and entity behavior analytics, endpoint detection and response capabilities. This helps prevent unauthorized access and strengthens overall security, making it an invaluable asset for organizations aiming to safeguard their digital infrastructure.

Microsoft

Stellar Cyber Open XDR delivers an advanced, unified security solution designed for real-time threat detection and intelligent response, reducing complexity by integrating multiple tools into a single interface.

Stellar Cyber Open XDR aggregates security data from many sources to provide comprehensive threat detection and response capabilities. It offers a streamlined, user-friendly experience, allowing teams to efficiently manage incidents. By automating routine security tasks, it enhances operational efficiency and increases visibility across the entire network infrastructure.

What are the key features of Stellar Cyber Open XDR?

Open Integration: Connects with existing security tools for seamless data aggregation and correlation.
AI-Powered Analytics: Uses artificial intelligence to predict, detect, and respond to threats with high accuracy.
Automated Incident Response: Accelerates the fighting-back process through intelligent automation.
Comprehensive Dashboards: Offers clear visibility into security metrics through customizable dashboards.

What benefits or ROI should users expect?

Improved Threat Detection: Recognizes threats faster, allowing quick response to reduce potential damage.
Increased Efficiency: Reduces manual work by automating repetitive tasks, saving time for IT teams.
Cost Reduction: Consolidates security tools, decreasing overall expenditure on multiple solutions.
Enhanced Collaboration: Allows diverse security teams to work together more effectively with shared insights.

Stellar Cyber Open XDR is implemented across various industries, including finance, healthcare, and retail, offering tailored security strategies suited to industry-specific challenges. Organizations can take advantage of this integrated approach to align security operations with industry regulations efficiently.

Stellar Cyber

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.

Sumitomo Chemical USA, PlastiPak Packaging, University of Denver, Large California State Agency, Large Midwestern American City

Microsoft Defender for Identity vs. Stellar Cyber Open XDR