4.4.5. Microsoft Defender for Identity
💡 First Principle: Defender for Identity is best known for monitoring on-premises Active Directory Domain Services signals — using sensors on domain controllers and related identity servers, infrastructure that Defender for Cloud Apps and Defender for Endpoint don't cover — to catch attack techniques like lateral movement and domain-dominance attempts that target on-prem identity infrastructure. It now also takes in identity signals from Microsoft Entra ID and other identity providers such as Okta, so it covers hybrid identity attacks end to end.
It analyzes domain controller traffic and signals for suspicious activity such as reconnaissance (an attacker mapping out the network), lateral movement (moving from one compromised machine toward higher-value systems), and domain-dominance techniques (attempting to gain control over the entire on-prem AD forest) — attacks that specifically exploit the on-premises identity layer covered back in Phase 2.2.4 and Phase 3.1.3's hybrid identity.
⚠️ Exam Trap: Defender for Identity's hallmark is detecting attacks on on-premises Active Directory — this is distinct from Defender for Cloud Apps (which protects SaaS application usage) and from Entra ID Protection (Phase 3.4.4, which protects the cloud identity layer itself).
Reflection Question: An attacker compromises a low-privilege on-prem workstation and begins probing the network to find a path toward the domain controller. Which Defender product is purpose-built to detect this specific pattern, and why does it need visibility into on-premises AD to do so?
