Microsoft Defender for Identity

1. Active Directory focused detection. The detections around threats like lateral movement of credential theft were strong and gave us visibility we didn't have previously, to the point where we found real bad actors threats within the first month as a result. 2. Good context within Microsoft Defender XDR. Alerts come in with timelines and excellent context which enables faster triage without the pain points of engaging in raw log hunting. 3. Integration with the rest of the Microsoft Security stack made correlation clean and reduced much of the tool and context switching that came come from having disparate tools.

The best feature is the strong identity-based threat detection. The behavioral analytics engine does an excellent job of detecting attacks such as Pass-the-Hash, Golden Ticket attacks, as well as identifying suspicious lateral movement. The attack timeline and entity mapping make it very easy to understand how an incident unfolded and can significantly speed up investigations. Another positive for MDI is its seamless integration with the Microsoft Security Ecosystem, embedded within Defender XDR, a truly unified experience can be achieved across endpoints, email, cloud apps and identities. Finally, its very low maintenance once setup. From an admin perspective, its heavily reliant on simple sensor deployment on domain controllers with minimal infrastructure maintenance and updates.

Its seamless integration with Microsoft's security ecosystem provides visibility into on-prem and cloud environments. Its capability to analyze massive number of signals on a daily basis allows org to quickly identify and detect complex identity-based attacks and features like automated response can perform the pre-defined response for such attacks without human intervention.

1. Initial setup can be painful if you don't have a solid understanding of your Active Directory topology, otherwise it's far too easy to scope sensors improperly or even misread alerts. 2. While detection is strong, the native one-click remediation actions are quite a bit lighter than what I've seen from other tools. Manual playbooks or custom created automated remediations are still required. 3. Pricing was reasonable given the number of identities and DCs we were working with, but it's still something to consider if you still have a small AD footprint still.

One of the biggest drawbacks is the lack of use outside of Microsoft environments. While this is great within our Microsoft stack, we are left looking at other vendors for Identity protection among many of our other platforms. Also, during setup and onboarding, the platform can become very noisy with a lot of false-positive alerts. You will find that a lot of time needs to be allocated to tuning alerts in the early days to make best use of your analysts time. Finally, the flexibility and granular controls you would expect from a Microsoft solution are not present here. This is very much an off-the-shelf product with little room to customise if your environment has a particular niche.

If the service is not configured properly, it can create an overwhelming number of alerts that can lead to many false-positive alerts. Although it integrates seamlessly with Microsoft services and platforms, it has limited integration capability with third parties.