How to detect identity attacks before they cause damage

Attackers rarely start by deploying ransomware or stealing data. More often, they begin with identity reconnaissance, password spraying, token theft, suspicious sign-ins, or abuse of a legitimate user account. The fastest way to reduce damage is to detect those signals early, correlate them across Microsoft 365, endpoints, identities, cloud apps, and email, and respond before the attacker can move laterally. This guide covers the products by their current names, the detection and response sequence, and which Microsoft 365 plan carries which signal.

The products, by their current names

Microsoft Advanced Threat Analytics (ATA) is retired; its job, watching Active Directory for reconnaissance and credential theft, moved to Microsoft Defender for Identity. Azure Active Directory is Microsoft Entra ID, with P1 and P2 plans. Cloud App Security is Microsoft Defender for Cloud Apps. Microsoft 365 Defender is Microsoft Defender XDR, managed in the Microsoft Defender portal at security.microsoft.com, where identity, endpoint, email, collaboration, and cloud app signals land in one correlated incident instead of four consoles.

What modern identity attack detection should include

A current Microsoft security architecture should detect both known attack techniques and abnormal behavior. Microsoft Defender for Identity identifies identity reconnaissance, lateral movement, credential theft techniques, suspicious Kerberos activity, Pass-the-Hash, Pass-the-Ticket, Kerberoasting, abnormal LDAP queries, and risky domain controller activity. Microsoft Entra ID Protection, a P2 feature, adds user risk and sign-in risk detections such as leaked credentials, atypical travel, unfamiliar sign-in properties, and suspicious sign-in patterns. Microsoft Defender for Cloud Apps extends visibility into SaaS usage, risky OAuth apps, impossible travel, unusual downloads, data exfiltration patterns, and session risk.

Defender XDR is the layer on top: unified incidents and alerts, automated investigation and response, advanced hunting with KQL across all of those sources, threat analytics, automatic attack disruption for certain active campaigns, unified role-based access control, and exposure context so an alert on a device also shows its unpatched weaknesses. Microsoft Security Copilot can assist investigations where it is licensed. None of it works without onboarding, policy configuration, alert tuning, and someone who owns the queue.

A modern attack flow: from suspicious sign-in to containment

A typical incident begins with password spraying or username enumeration. Entra ID sign-in logs and risk detections identify failed sign-in patterns, unfamiliar locations, and risky authentication attempts. If the attacker succeeds, Defender XDR correlates the compromised user with endpoint activity, email events, cloud app behavior, and Defender for Identity alerts from Active Directory. Instead of reviewing isolated alerts, the security team investigates a single incident timeline with affected users, devices, mailboxes, apps, evidence, and recommended response actions. Token theft through a phishing proxy looks different in the logs from a password spray; our guide to stolen refresh tokens in Microsoft 365 shows what to look for in Entra sign-in logs.

What responders should do when credentials are suspected to be compromised

When the evidence indicates account compromise, the response should be fast and controlled. Work in this order:

1. Contain the account: disable it or block sign-in, reset the password, revoke refresh tokens so existing sessions die, and require MFA re-registration if the attacker may have added a method.
2. Close the persistence: remove malicious inbox rules and forwarding, revoke consent for suspicious OAuth applications, and check for new devices registered to the account.
3. Contain the device: isolate any endpoint the account used during the window and run a full scan.
4. Check the blast radius: privileged role assignments, group changes, sharing links created, mailbox access, and files downloaded or exfiltrated.
5. Record it: the timeline, the evidence, and what changed, so the post-incident report can be written without reconstructing it later. Our post-incident report walkthrough shows the shape.

Defender XDR automated investigation and response can handle steps 1 to 3 for common cases, and Microsoft Sentinel playbooks make the sequence repeatable.

Prevention still matters: reduce the chance of compromise

Detection is most effective when combined with strong preventive controls. Enforce multifactor authentication and move toward phishing-resistant methods such as passkeys or certificate-based authentication in the order set out in our passkeys rollout guide. Use Conditional Access, starting with the policies every business should have, require compliant or managed devices for sensitive access, apply least privilege, protect administrator roles with Microsoft Entra Privileged Identity Management, review guest access, govern app consent, and work through Microsoft Secure Score and exposure recommendations on a schedule. Every control on that list removes incidents your team would otherwise have to investigate.

Where Microsoft Sentinel fits

Microsoft Defender XDR is the primary portal for Microsoft 365 security investigation and response. Microsoft Sentinel adds SIEM and SOAR for organizations that need long-term log retention, custom correlation across Microsoft and non-Microsoft systems, advanced hunting, automation playbooks, and compliance-driven reporting. Sentinel is metered on your own Azure subscription, so planning should include data ingestion, retention, analytics rules, and automation requirements; Microsoft Sentinel for a 100-user organization walks through the monthly cost and the point at which a managed detection and response service is the better buy.

Which plan carries which detection

Every price below is Microsoft's list price from the October 2026 price list, per user per month on an annual commitment; Microsoft bills the subscription and we sell it at the same price.

Signal	Product	Already included in	On its own
Risky users and risky sign-ins, with risk-based Conditional Access	Microsoft Entra ID Protection	Entra ID P2, Microsoft 365 E5, EMS E5, Microsoft Defender Suite, Defender Suite for Business Premium	Entra ID P2 $10.00; Entra P2 add-on for Microsoft 365 E3 $3.00
Conditional Access and the compliant-device requirement	Microsoft Entra ID P1	Business Premium, Microsoft 365 E3 and E5, EMS E3	Entra ID P1 $7.00
Reconnaissance, lateral movement, and credential theft in Active Directory	Microsoft Defender for Identity	Microsoft 365 E5, EMS E5, Microsoft Defender Suite, Defender Suite for Business Premium	Defender for Identity $5.50
SaaS sessions, OAuth apps, impossible travel, mass downloads	Microsoft Defender for Cloud Apps	Microsoft 365 E5, EMS E5, Microsoft Defender Suite, Defender Suite for Business Premium	Defender for Cloud Apps $3.50
Endpoint detection and response	Defender for Endpoint Plan 2, or Defender for Business for up to 300 users	Business Premium (Defender for Business), Microsoft 365 E5, Microsoft Defender Suite	Defender for Endpoint P2 $5.20; Defender for Business $3.00
Phishing, Safe Links and Safe Attachments, mailbox investigation	Defender for Office 365 Plan 1 or Plan 2	Plan 1 in Business Premium; Plan 2 in Microsoft 365 E5 and the Defender Suite	Plan 1 $2.00; Plan 2 $5.00
SIEM and SOAR across Microsoft and non-Microsoft sources	Microsoft Sentinel	Nothing; metered on your Azure subscription	Not per user

The suites: Microsoft 365 Business Premium $22.00, Microsoft 365 E3 $39.00, Microsoft 365 E5 $60.00, Microsoft Defender Suite $12.00 on top of E3, and EMS E5 $18.00. The Defender Suite for Business Premium add-on, which Microsoft documents as adding Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, and Defender for Cloud Apps to a Business Premium tenant, is $10.00 per user per month on an annual commitment (Microsoft list price, October 2026 price list). Our guides to Entra ID P1 vs P2 and Defender for Identity go deeper on each.

Frequently asked questions

Is Microsoft Advanced Threat Analytics still supported?

No. ATA is retired, and Microsoft Defender for Identity is its replacement: a cloud service fed by sensors on domain controllers, AD FS, and AD CS servers, managed in the Defender portal rather than on an ATA Center server. Tenants still running ATA should plan the sensor rollout rather than another ATA upgrade.

Do I need Entra ID P2 to see risky sign-ins?

Partly. Entra ID Free and P1 show a limited list of risky users and sign-ins with no detail or risk level. The full reports, the risk detection detail, the alerts, and the risk-based Conditional Access policies that respond automatically need Entra ID P2, which Microsoft 365 E5, EMS E5, and the Defender Suite include and which Microsoft 365 E3 tenants add for $3.00 per user per month.

Does Microsoft 365 Business Premium cover this?

It covers the first layer: Entra ID P1 Conditional Access, Defender for Business on devices, Defender for Office 365 Plan 1 on mail, and Intune. Risk-based policies, Defender for Identity for on-premises Active Directory, and Defender for Cloud Apps need the Defender Suite for Business Premium add-on.

What is the first thing to do when an account is compromised?

Kill the sessions: disable sign-in, reset the password, and revoke refresh tokens, in that order, within minutes. Then remove the inbox rules and OAuth consents the attacker left behind. Everything else can wait an hour; those cannot.

Sources

• What is Microsoft Entra ID Protection? — Microsoft Learn, document dated 30 October 2025, checked 2026-10-11 through the MicrosoftDocs source on GitHub (capabilities by license)
• Microsoft Entra licensing — Microsoft Learn, 18 June 2026, checked 2026-10-11 (which suites include P1 and P2)
• What is Conditional Access? — Microsoft Learn, 27 April 2026, checked 2026-10-11
• Add Microsoft Defender Suite for Business Premium to your subscription — Microsoft Learn, 24 September 2025, checked 2026-10-11
• Microsoft Defender for Business — Microsoft product page, checked 5 October 2026 for our Defender for Business guide (the 300-user limit)
• Microsoft US commercial price list, October 2026: every list price above

Key takeaways

• Microsoft Advanced Threat Analytics is retired; Microsoft Defender for Identity is the replacement for detecting on-premises and hybrid identity attack techniques.
• Microsoft Defender XDR is the central investigation experience for correlated Microsoft 365 security incidents, with automated investigation and attack disruption for common cases.
• Microsoft Entra ID Protection, a P2 feature, detects risky users and risky sign-ins and drives risk-based Conditional Access policies.
• Microsoft Defender for Cloud Apps adds SaaS activity, OAuth app, session, and data exfiltration visibility.
• Business Premium carries the first layer; the Defender Suite for Business Premium, Microsoft 365 E5, or the Defender Suite on E3 carries the rest.
• Detection works better with prevention in place: MFA, phishing-resistant authentication, Conditional Access, least privilege, PIM, device compliance, and app governance.

If you are not sure your tenant would catch any of this, Defender XDR Incident Readiness and Automated Response ($3,500 per project) sets up the incident workflow, automated investigation, and the response playbooks, and Microsoft Defender for Identity Implementation ($2,900 per project) puts the sensors on your domain controllers. Both are quoted in writing before work begins. Clients who license through us get Risky Users and Risky sign-ins monitoring at no charge. Book a 30-minute call with your current plan and we will tell you which layer you are missing.