Description #

Microsoft Defender for Identity is a critical security solution designed to provide deep visibility into user and entity activities across your network. By analyzing authentication and authorization signals, Defender for Identity identifies potential threats and suspicious behaviors, enabling swift incident response.

Once deployed, Defender for Identity operates as an integral component of your security ecosystem, leveraging advanced machine learning algorithms to discern normal user behaviors from anomalies. It scrutinizes authentication protocols, scrutinizing for irregularities that may indicate potential security breaches or unauthorized access attempts.

Through this implementation, your organization gains an elevated level of visibility and control over its digital landscape. It empowers your security team with the tools and insights necessary to detect and respond to potential threats with precision and efficiency.

IT Partner responsibilities #

1. Perform a detailed assessment of the tenant and determine what resources you need for your Microsoft Defender for Identity sensors.
2. Configure Defender for Identity settings based on the assessment, ensuring optimal alignment with the organization's environment.
3. Implement monitoring protocols to detect and respond to potential threats identified by Defender for Identity.

Client Responsibilities #

1. Grant necessary access and permissions to the IT Partner for the deployment process.
2. Collaborate with the IT Partner during the configuration phase, providing insights into specific environment requirements.

Prerequisites #

1. Enterprise Mobility + Security E5 (EMS E5/A5), Microsoft 365 E5 (M365 E5/A5/G5) or Microsoft 365 E5/A5/G5 Security. Standalone Defender for Identity licenses are also available.

For more information about license requirements, see Licensing and privacy.

Plan #

1. Plan Defender for Identity Capacity.
2. Create a Defender for Identity instance.
3. Connect an instance to Windows Server Active Directory.
4. Install a Defender for Identity sensors.
5. Set up the portal and setting preferences.

Success criteria #

1. Enhanced visibility into user and entity activities, enabling proactive threat detection.
2. Swift incident response capabilities, reducing potential security risks.
3. Integration of Defender for Identity into the existing security ecosystem, ensuring seamless operation alongside other security tools.