Microsoft Defender for Identity
Also known as MDI
Detection for on-premises Active Directory, watching domain controllers for attacker behavior.
It monitors authentication traffic and directory activity for the techniques that follow an internal foothold: Kerberoasting, DCSync, reconnaissance queries, and lateral movement patterns.
It fills a gap endpoint tooling does not cover, because much of this activity is legitimate protocol usage that only looks wrong in context.
Where this comes up
Microsoft Defender for Identity sits inside our microsoft 365 and cloud work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Active Directory Microsoft's on-premises directory service, running on domain controllers and governing Windows domain authentication. Kerberoasting Requesting service tickets from Active Directory and cracking them offline to recover service account passwords. Lateral movement The stage where an attacker moves from the machine they first landed on toward the systems they actually want. Microsoft Defender Suite Microsoft's bundled security add-on: Entra ID P2, Defender for Endpoint P2, Defender for Office P2, Defender for Identity, and Defender for Cloud Apps.