4.4.5. Microsoft Defender for Identity
💡 First Principle: Defender for Identity monitors on-premises Active Directory Domain Services signals specifically — the identity infrastructure that Defender for Cloud Apps and Defender for Endpoint don't cover — to catch attack techniques like lateral movement and domain-dominance attempts that specifically target on-prem identity infrastructure.
It analyzes domain controller traffic and signals for suspicious activity such as reconnaissance (an attacker mapping out the network), lateral movement (moving from one compromised machine toward higher-value systems), and domain-dominance techniques (attempting to gain control over the entire on-prem AD forest) — attacks that specifically exploit the on-premises identity layer covered back in Phase 2.2.4 and Phase 3.1.3's hybrid identity.
⚠️ Exam Trap: Defender for Identity specifically protects on-premises Active Directory signals — this is distinct from Defender for Cloud Apps (which protects SaaS application usage) and from Entra ID Protection (Phase 3.4.4, which protects the cloud identity layer itself).
Reflection Question: An attacker compromises a low-privilege on-prem workstation and begins probing the network to find a path toward the domain controller. Which Defender product is purpose-built to detect this specific pattern, and why does it need visibility into on-premises AD to do so?
