Quest Identity Defense Reviews

Quest Identity Defense serves as our primary tool to monitor privileged and tier two and tier one level identities and identify risk configurations, investigate suspicious changes, and improve our identity security posture. We use it as a Privileged Access Management tool. It gives our security team better visibility into what is happening inside the identity environment and helps us protect our Active Directory and Microsoft Entra ID environment.

A specific example of how we used Quest Identity Defense for one of those tasks involved monitoring the privileged accounts and their access. We have just-in-time access for most of the critical user roles. Recently, when we noticed an unexpected change involving a privileged Active Directory account, we used Quest Identity Defense to investigate the activity and determine what changes had been made, which account performed the action, and whether the affected object was considered a critical or tier-zero asset. The centralized audit information made the investigation much quicker because we did not have to manually correlate activity across multiple sources. After confirming that the change was not part of an administrative activity, we escalated it to the L3 level of the team, and they remediated the threat.

Quest Identity Defense offers the best features by providing one place where we can find all the critical identities that we have in Microsoft Entra ID as well as the Active Directory. The most valuable aspects are the tier-zero asset identification, identity posture assessment, and real-time auditing, threat detection, and investigation capabilities. The ability of Quest Identity Defense to prioritize the critical Active Directory and Entra ID objects is very useful. I also find the security assessment useful for identifying misconfiguration, weaknesses, and the related risk. The auditing capability provides useful context around the changes, including who made what change.

The biggest positive impact Quest Identity Defense has had on our organization has been the visibility into our identity environments and better prioritization of identity and related risk. Instead of looking at Active Directory security issues as isolated configuration problems, we can identify critical identities and focus our attention on the areas that could have a greater security impact. It has also made investigations more efficient because the audit information provides additional context around the identity changes. This reduces the amount of manual investigation required to determine what happened and which account did what change. Another benefit is that it helped us with the communication between security, identity, and the infra team. When we identify a risk configuration or suspicious changes, we can provide more specific information about the affected identity.

The navigation part is pretty well-designed and not a clunky kind of dashboard or any navigation tools that we have. The platform has a lot of information on security capabilities, but new users may need some time to understand the assessments, findings, and investigation workflows. If the dashboard and reporting also provided more customization, it would be useful to have greater flexibility to create specific views for SOC analysts and administrators.

Making any remediation workflows more streamlined would be beneficial. Once a risky configuration or identity issue is identified, it would be helpful to have more direct guidance for resolving the issue and tracking it end-to-end. That would help us considerably.

Quest Identity Defense is very specifically focused on one area of cybersecurity, which is identity management and tier-zero protection, Active Directory, endpoint, and Entra ID security assessment, auditing, and threat investigation. It provides useful context around identity-related activity and helps security teams take a more proactive approach. I gave it a nine only because there is still room for improvement around usability or customization, making some of the more advanced capabilities easier to use and to understand the tool. Overall, I consider it a strong solution for organizations that need deeper security and threat detection capabilities for hybrid environments.

I have been working in the cyber security field for around three years.

Quest Identity Defense is stable and a really great tool for Privileged Access Management identity management. For any organization that is looking for a stable and reliable solution for identity management, Quest Identity Defense would be the best tool for them. The platform handles the identity and audit information reliably, and we have not experienced any problems that would prevent the security team from using it as part of its normal workflow. Stability is particularly important for identity threat detection because the platform needs to continuously monitor changes and activities around critical identities.

Quest Identity Defense is a very easy, adaptable tool, which is very good. It is well-suited for an organization where the identity environment is continuously growing, particularly when there are multiple Active Directory domains, Microsoft Entra ID, and a large number of custom domains involved in a single tree or forest of Active Directory, and a large number of user groups and privileged identities. One advantage is that the security team can maintain a centralized view of identity risk rather than managing each directory environment independently. As the environment grows, this becomes increasingly useful. I worked in a very large environment, and they needed something for identity management. Quest Identity Defense really stands out from many security products.

The customer support is very great. From the time of implementation until now, if we face any requirement or any trouble, they are very helpful. Whenever we raise a support case, they assist with it as soon as possible. An analyst is held responsible for it until closure. For any assistance regarding configuration, troubleshooting, or understanding any specific finding, dashboard, report, or any critical technicalities we are facing, they are very helpful.

Previously, we were not using any solution. We used to manage identity from Active Directory and Microsoft Entra ID. Later, we were introduced to this product by management, and it really made our job very easy. Because we were in a large environment, we needed something specifically for identity management because there were so many critical objects and accounts involved in the environment. We directly adopted this solution.

We deployed Quest Identity Defense using the public cloud.

Regarding the purchasing and integration part, I was not involved. Those were all decisions made by higher-level management. We received SaaS support in a hybrid identity environment in the Azure environment.

Quest Identity Defense is a return on investment. It is mainly focused on one part of cybersecurity, which is Privileged Access Management and Privileged Identity Management. It is time-saving for both the infra and the security team. The biggest improvement has been in the identity security investigation. Previously, an analyst would spend 30 to 40 minutes collecting information from different sources to understand unexpected Active Directory changes and identify the account and all the involved entities. With Quest Identity Defense providing the relevant identity and audit context in one place, that helped considerably. Within 10 to 15 minutes, we were able to gather all the artifacts that are related.

Regarding the licensing and setup cost, I was not involved. The implementation team was responsible for that. When we looked at the pricing part, it was reasonable for any enterprise that wants an identity security solution which has great visibility into the organization-specific environment. When you are in a very large environment and have both on-premises and cloud environments, Quest Identity Defense would be a best fit for your identity management. It is very simple, quick to adapt, and a very useful, user-understandable tool.

Most of the decisions, licensing, and purchasing were made from a higher level of management. When they looked for other options, they considered Microsoft Defender for Identity, the DSP solution, and Tenable Identity Exposure. Their focus was mainly on Active Directory and Microsoft Entra ID visibility, identity threat detection, and privileged or tier-zero asset protection and security posture assessment. With these requirements, they found Quest Identity Defense stood out from all the tools because of its combination of identity posture assessment, tier-zero visibility, auditing, threat detection, and investigation capabilities in a single platform.

If you are in a large environment, or if you are small but have a hybrid environment, and you are looking for one solution for identity management where you do not want to waste much time between the infra team and the security team, and you want to make it very straightforward for both teams and manage all the identities and critical identities in one single platform and one single panel, Quest Identity Defense would be the best solution that you can opt for. Identifying your critical and privileged identities, especially the tier-zero assets, and seeing how efficiently the product discovers the relationships, security weaknesses, and suspicious activities in your environment really stands out from any other identity protection product out there in the market. I would also recommend involving both the SOC and the identity team during the evaluation. The SOC will be focused on detection and investigation, while the identity team will usually be responsible for addressing the underlying configuration and access licenses so that they can understand the tool completely from beginning to end. We are the consumer and client for this vendor. I have given this product a rating of nine out of ten.