Microsoft Defender for Identity: What It Covers, the Licensing Paths, and When a 50 to 500 Person Organization Needs It
If your users still sign in to an on-premises Active Directory domain, the attack that takes the company down will run through a domain controller, and nothing in Microsoft 365 watches that server unless you put a sensor on it. Microsoft Defender for Identity is that sensor. This article explains what it detects, what it is not (it is not Entra ID Protection), the licensing paths with October 2026 list prices, what you need in place before the sensor goes on, and the one question that decides whether a 50 to 500 person organization needs it.
What Defender for Identity watches, and what it detects
Defender for Identity is a cloud service fed by sensors installed on your identity servers. Microsoft's documentation describes it as "fully integrated with Microsoft Defender XDR" and as using "data from across your environment, including domain controllers, Active Directory Federation Services (AD FS), and Active Directory Certificate Services (AD CS)" (Microsoft Learn, What is Microsoft Defender for Identity, source file dated August 2023).
Microsoft groups the detections by stage of the attack. Reconnaissance: enumeration of user names, group membership, device IP addresses and resources. Compromised credentials: brute force, repeated failed authentications, suspicious group membership changes. Lateral movement: Pass the Ticket, Pass the Hash, Overpass the Hash. Domain dominance: remote code execution on a domain controller, DCShadow, malicious replication, Golden Ticket activity (same source).
Two features matter beyond the alerts. Lateral Movement Paths are visual maps of how an attacker who owns a low-privilege account can reach a sensitive one, built from where privileged credentials are cached and who holds local administrator rights (Microsoft Learn, Understand and investigate Lateral Movement Paths, source file dated May 2023). Identity security posture assessments feed Microsoft Secure Score with findings such as unconstrained Kerberos delegation, legacy protocols in use and dormant privileged accounts; in most first deployments they produce the longer to-do list.
The sensors extend to the servers around the domain controllers. Microsoft's guidance covers AD FS federation servers (not the Web Application Proxy servers), AD CS servers that run the Certification Authority role, and Microsoft Entra Connect servers, both active and staging (Microsoft Learn, Configure sensors for AD FS, AD CS, and Microsoft Entra Connect, source file dated November 2024).
What Defender for Identity is not
It is not Entra ID Protection. Entra ID Protection scores risk on cloud sign-ins and cloud accounts (leaked credentials, anonymous IP addresses, impossible travel) and is an Entra ID P2 feature (Microsoft Learn, Microsoft Entra licensing, June 2026). Defender for Identity watches the on-premises directory. A hybrid tenant needs both; a cloud-only tenant with no domain controllers needs only the first.
It is not Defender for Endpoint. Endpoint watches the workstation and server operating system for malware and attacker tooling; Defender for Identity watches authentication and directory activity.
It is not a hardening tool. It will tell you that a service account has unconstrained delegation and that an administrator's credentials are cached on a shared workstation; fixing those is work in Active Directory, which is why our Active Directory Security Assessment and Hardening usually follows the deployment. And it does not protect a domain nobody uses: if you have already retired on-premises Active Directory, skip it.
The licensing paths and the October 2026 list prices
Microsoft's Defender for Identity prerequisites page lists the licenses that carry the product: Enterprise Mobility + Security E5 (EMS E5 or A5), Microsoft 365 E5 (E5, A5 or G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security + Compliance, and a standalone Defender for Identity license; both F5 options require Microsoft 365 F1 or F3 or Office 365 F3 plus EMS E3 (Microsoft Learn, Defender for Identity prerequisites, licensing include dated September 2023). Microsoft has since renamed Microsoft 365 E5 Security to the Microsoft Defender Suite and lists a Defender Suite FLW for frontline workers (Microsoft Learn, Microsoft Entra licensing inclusion list, January 2025). Licenses are per user, and every user whose account the sensor protects needs one.
The Commercial annual-term prices are per user per year on Microsoft's list; divide by 12 for the monthly figure. The standalone Microsoft Defender for Identity license is $66.00 per user per year, so $66.00 ÷ 12 = $5.50 per user per month on an annual term (Microsoft list price, October 2026 price list). The same list carries a Microsoft Defender for Identity F1 SKU for frontline workers at $44.40 per year, $3.70 per month. The bundles that include it:
- Enterprise Mobility + Security E5: $216.00 per year, $18.00 per user per month, with Entra ID P2, Intune Plan 1, Information Protection P2 and Defender for Cloud Apps; see EMS E3 vs E5.
- Microsoft 365 E5: $720.00 per year, $60.00 per user per month.
- Microsoft Defender Suite, formerly Microsoft 365 E5 Security, the step-up for Microsoft 365 E3 users: $144.00 per year, $12.00 per user per month.
- The frontline step-up, listed as "Microsoft Defender Suite Add-on FLW" under Microsoft 365 F1: $96.00 per year, $8.00 per user per month.
All of the above are Microsoft list prices from the October 2026 price list, Commercial segment, annual term; the month-to-month standalone SKU is $6.60. Business Premium tenants have a further option: the list carries a "Microsoft Defender Suite for Microsoft 365 Business Premium" at $120.00 per year, $10.00 per month, which Microsoft's Entra licensing documentation lists as carrying Entra ID P2; confirm the Defender for Identity service plan appears on your tenant before you rely on it for that purpose.
Which path is right follows from what you hold. Microsoft 365 E5 users already have it. Microsoft 365 E3 users add the Defender Suite if they also want Defender for Endpoint P2 and Entra ID P2, or the $5.50 standalone license if they only want the sensor's coverage. A tenant that wants to cover only its 40 administrators and finance staff buys 40 standalone licenses, not a suite for everyone, and that is the purchase we quote most often in this size band.
Prerequisites: sensors, service account, portal
From Microsoft's prerequisites page (source file dated August 2023) and the Directory Service Account guidance (dated January 2024):
Portal and roles. The workspace is created in the Microsoft Defender portal under Settings, Identities, and creating it needs at least the Security Administrator role. Alerts, lateral movement paths and assessments appear in the Defender XDR incident queue alongside Endpoint and Office 365 signals. Our Defender XDR Incident Readiness and Automated Response service tunes that queue once the sensors are in.
Sensors. One on every domain controller, including read-only domain controllers, running Windows Server 2016 or later with at least 2 cores, 6 GB of RAM and 6 GB of disk (10 GB recommended); virtual machines must have their memory fully reserved. The sensor needs outbound TCP 443 to the Defender for Identity cloud service, directly or through a proxy that does not perform SSL inspection, plus internal access for name resolution and the SAM-R queries that build lateral movement paths. Microsoft publishes a Test-MdiReadiness.ps1 script that checks all of this before you install.
Service account. The sensor runs as LocalService, but Microsoft recommends a Directory Service Account with read access to every object in the monitored domains, as a group Managed Service Account (gMSA) so that Active Directory rotates its password. A Directory Service Account is required, not optional, for sensors on AD FS, AD CS and Entra Connect servers, for the SAM-R calls that calculate lateral movement paths, and for reading the Deleted Objects container. An AD FS sensor additionally needs db_datareader on the AD FS configuration database on every federation server.
Auditing. Every sensor depends on the Windows audit events Microsoft lists being enabled on its server; missing audit settings are the most common reason a fresh deployment reports fewer detections than expected.
When a 50 to 500 person organization needs it
The deciding question is whether an on-premises Active Directory still authenticates your users. If the answer is yes, you need it, because Microsoft 365's cloud security has no view of that domain and the domain holds the credentials that unlock everything else. The size of the organization does not change the answer; it changes only how many sensors there are.
The cases where the answer is yes: a hybrid tenant with Entra Connect synchronizing from a domain that still has member servers, file servers or line-of-business applications bound to it; any site that still runs AD FS for Microsoft 365 or SAML applications (the federation server is the token mint, and our AD FS to Entra ID migration article explains why it is a liability); an internal certificate authority used for Wi-Fi, VPN or smart cards; and a Windows Server estate you are keeping for years, whatever the end-user devices do.
The cases where the answer is no: a cloud-only tenant with Entra joined devices and no domain controllers, or a domain that exists only because nobody has turned it off. Spend the money on Entra ID P2 and Conditional Access instead.
Frequently asked questions
Does Defender for Identity need a sensor on every domain controller?
Yes. Microsoft's guidance is a sensor on every domain controller, including read-only domain controllers, because each one authenticates users and an unmonitored one is a blind spot. AD FS, AD CS and Entra Connect servers get sensors as well.
Does it replace Entra ID Protection?
No. Entra ID Protection scores cloud sign-ins and needs Entra ID P2. Defender for Identity watches on-premises Active Directory. Hybrid tenants need both, and Microsoft 365 E5, EMS E5 and the Microsoft Defender Suite include both.
Is there anything to install on workstations?
No. The sensor goes on domain controllers and the identity servers around them. Workstation coverage is Defender for Endpoint's job; see Defender for Business vs Defender for Endpoint.
Sources
- Microsoft Learn source files on GitHub (MicrosoftDocs/ATADocs), opened 2026-10-05: "What is Microsoft Defender for Identity?", ms.date 08/27/2023; "Prerequisites, Microsoft Defender for Identity", ms.date 08/28/2023, with its "licenses" and "server-requirements" includes, ms.date 09/26/2023; "Configure sensors for AD FS, AD CS, and Microsoft Entra Connect", ms.date 11/02/2024; "Directory Service Accounts for Microsoft Defender for Identity", ms.date 01/16/2024; "Understand and investigate Lateral Movement Paths", ms.date 05/15/2023
- Microsoft Learn source files on GitHub (MicrosoftDocs/entra-docs), opened 2026-10-05: "Microsoft Entra licensing", ms.date 06/18/2026, with its "entra-offerings" include, ms.date 01/31/2025, and "licensing-identity-protection" include, ms.date 05/22/2025
- Microsoft Commercial price list, October 2026 (every list price above)
- IT Partner blog: enterprise-mobility-security-e3-vs-e5-and-what-microsoft-365-e3-already-includes; ad-fs-to-entra-id-migration-staged-rollout; retiring-on-premises-active-directory-going-cloud-only-with-entra-id-and-intune; defender-for-business-vs-defender-for-endpoint-plan-1-vs-plan-2-which-one-for-your-size
- IT Partner service pages: Microsoft Defender for Identity Implementation (/services/microsoft-defender-for-identity-implementation); Active Directory Security Assessment and Hardening (/services/active-directory-security-assessment); Defender XDR Incident Readiness and Automated Response (/services/microsoft-defender-xdr-incident-readiness); IT Partner subscription pages: Microsoft Defender for Identity (/subscriptions/microsoft-defender-for-identity), Enterprise Mobility + Security E5 (/subscriptions/enterprise-mobility-security-e5), Microsoft 365 E5 (/subscriptions/microsoft-365-e5), Microsoft Defender Suite (/subscriptions/microsoft-defender-suite), Microsoft 365 F1 (/subscriptions/microsoft-365-f1), Advanced Security Add-ons for Business Premium (/subscriptions/advanced-security-add-ons-business-premium)
| Question | Defender for Identity | Entra ID Protection | Defender for Endpoint |
|---|---|---|---|
| What it watches | On-premises Active Directory: domain controllers, AD FS, AD CS, Entra Connect | Cloud sign-ins and cloud accounts in Entra ID | Workstations and servers: processes, files, network |
| Typical detections | Reconnaissance, credential theft, Pass the Hash and Pass the Ticket, DCShadow, Golden Ticket | Leaked credentials, anonymous IP, impossible travel, risky sign-ins | Malware, attacker tooling, suspicious scripts, exploitation |
| What you install | A sensor on each identity server | Nothing | An agent on each device |
| License that carries it | Standalone ($5.50), EMS E5 ($18.00), Microsoft 365 E5 ($60.00), Microsoft Defender Suite ($12.00) | Entra ID P2 ($10.00), EMS E5, Microsoft 365 E5, Microsoft Defender Suite | Defender for Endpoint P1 or P2, Defender for Business, Microsoft 365 E5, Microsoft Defender Suite |
| Who needs it | Anyone whose users still authenticate to a domain | Every tenant with Entra ID accounts | Every tenant with managed devices |
| Where alerts land | Microsoft Defender portal | Entra admin center and Microsoft Defender portal | Microsoft Defender portal |
Key takeaways
- Defender for Identity puts a sensor on your domain controllers, AD FS, AD CS and Entra Connect servers and detects reconnaissance, credential theft, lateral movement and domain dominance in the Microsoft Defender portal.
- It is not Entra ID Protection, which scores cloud sign-ins and needs Entra ID P2; a hybrid tenant needs both, and a cloud-only tenant needs only the second.
- The licensing paths are the standalone license, EMS E5, Microsoft 365 E5, the Microsoft Defender Suite (formerly E5 Security) and the frontline Defender Suite add-on; at October 2026 list, the standalone license is $5.50 per user per month on an annual term.
- Before the sensor goes on you need the Security Administrator role, a gMSA Directory Service Account, Windows Server 2016 or later on the domain controllers, outbound port 443 and the audit policies Microsoft lists.
- A 50 to 500 person organization needs it the moment an on-premises Active Directory still authenticates users; the size changes only the sensor count.
Microsoft Defender for Identity Implementation is $2,900 per project over 14 days, fixed price: tenant assessment, sensor capacity planning, workspace activation, sensors on the domain controllers and in-scope AD FS and AD CS servers, and the monitoring configuration in the Defender portal. If you need it faster, the 7-day Defender for Identity installation is $3,950 per project. For the license itself, open Microsoft Defender for Identity, Enterprise Mobility + Security E5 or Microsoft 365 E5 and use the quote button with the number of users you want covered. Book 30 minutes with Mike with your domain controller count and we will size the sensors.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.