Microsoft Defender for Identity is a security solution that monitors on-premises Active Directory environments and correlated identity signals to protect against identity-based attacks and threats. The platform uses sensors on domain controllers to collect data on authentication and directory activity, building behavioral baselines for users and entities to detect anomalies such as unusual logons, credential misuse, and lateral movement. It identifies specific attack techniques like Pass-the-Hash, Pass-the-Ticket, and Golden Ticket, as well as reconnaissance and domain dominance activities. The system assesses identity configurations for weaknesses, provides remediation recommendations, and can use honeytoken accounts for decoy-based alerting. Detected activities are presented on an attack timeline to aid in investigation, with prioritized alerts to highlight significant events.
