Microsoft Defender for Identity

Microsoft Defender for Identity is a cloud-based security solution that helps safeguard on-premises Active Directory from advanced threats, compromised identities, and insider actions. It continuously monitors user, device, and resource activities, leveraging behavioral analytics to establish baselines and detect anomalies in real time. Security teams receive prioritized alerts, insights into lateral movement paths, and clear incident timelines to accelerate investigation and response. Defender for Identity integrates with Microsoft 365 Defender to correlate signals across identities, endpoints, email, and apps, strengthening overall detection and protection. Deploy lightweight sensors on domain controllers to capture relevant signals with minimal overhead and maintain privacy with role-based access and auditing. Protect identities proactively and reduce risk with data-driven detection and actionable guidance.

Source: Microsoft product documentation and overview.