Microsoft Defender for Identity - protect your identity platform
Use Cases and Deployment Scope
Microsoft Defender for Identity is being used to complete the view of the threats in the XDR suite. We see often a broad scope of incidents and alerts, Microsoft Defender for Identity helps us to see the lateral movements and escalations to get a clear view of what is happening in the infrastructure after a possible breach
Pros
- detect threats and suspicious activities
- pro-active measurements on possible breaches
- identity security posture
Cons
- setup can be complicated, with AD complexity
- Sometimes the load on DCs is pretty high, leading to performance issues
- Better tuning options for preventing false-positive/bening alerts
Return on Investment
- Cost impact was pretty high
- Learning curve, needed time (money) for training
- Greatly improved detections and gives more insights
Alternatives Considered
Vectra Protect
Other Software Used
Microsoft Defender External Attack Surface Management, Microsoft Defender for Cloud, Microsoft Defender Threat Intelligence
