Defender for Identity: sensors, scope and who needs it

What it is

Microsoft Defender for Identity is an identity threat detection and response service for hybrid environments. It reads signals from on-premises Active Directory and contributes them to Microsoft Defender XDR, where identity alerts correlate with endpoint, email and cloud app signals into single incidents.

Who it is for

Organisations running Active Directory Domain Services on-premises, or in a hybrid arrangement with Microsoft Entra ID. It protects on-premises AD DS accounts and accounts synchronised into Entra ID.

Who should not buy it

A cloud-only tenant. Defender for Identity works through sensors installed on domain controllers and related identity servers. With no domain controllers there is nowhere to install one. For an environment made up only of Microsoft Entra accounts, Microsoft's guidance is to use Microsoft Entra ID Protection instead. This is the single most common mis-purchase on this product.

Key capabilities

• Detection of privilege escalation, lateral movement and identity-based attack techniques
• Identity security posture assessments that surface exploitable misconfigurations and give remediation paths
• Monitoring of all devices authenticating against Active Directory, including non-Windows and mobile devices
• Multi-forest support, including forests with no trust between them
• Remediation actions on affected identities, executed by the sensor on the domain controller
• Contribution to Microsoft Defender XDR incidents and automatic attack disruption

What it collects

Network traffic to and from domain controllers such as Kerberos and NTLM authentication and DNS queries, Windows security events, Active Directory structure information, and entity information such as names and email addresses. Sensors parse locally and send only the required signals, so there is no port mirroring and no dedicated on-premises appliance.

Requirements

Domain controllers on Windows Server 2016, 2019 with KB4487044, 2022 or 2025. Microsoft .NET Framework 4.7 or later. At least two cores and 6 GB of RAM on the domain controller, and a minimum of 6 GB of free disk space with 10 GB recommended. Outbound access to the Defender for Identity cloud service on port 443. There is a default limit of 30 directory service credentials per workspace, which matters in multi-forest estates.