Microsoft Defender for Identity integrates with Microsoft tools to monitor user activity, providing advanced threat detection and analysis using AI. It enhances proactive threat response and security visibility, making it essential for securing on-premises and cloud environments like Active Directory.
| Product | Market Share (%) |
|---|---|
| Microsoft Defender for Identity | 15.9% |
| CrowdStrike Falcon | 16.0% |
| Microsoft Entra ID Protection | 13.0% |
| Other | 55.1% |
| Type | Title | Date | |
|---|---|---|---|
| Category | Identity Threat Detection and Response (ITDR) | Aug 28, 2025 | Download |
| Product | Reviews, tips, and advice from real users | Aug 28, 2025 | Download |
| Comparison | Microsoft Defender for Identity vs Microsoft Entra ID Protection | Aug 28, 2025 | Download |
| Comparison | Microsoft Defender for Identity vs CrowdStrike Falcon | Aug 28, 2025 | Download |
| Comparison | Microsoft Defender for Identity vs SentinelOne Singularity Identity | Aug 28, 2025 | Download |
| Title | Rating | Mindshare | Recommending | |
|---|---|---|---|---|
| CrowdStrike Falcon | 4.3 | 16.0% | 96% | 132 interviewsAdd to research |
| Microsoft Intune | 4.1 | N/A | 94% | 298 interviewsAdd to research |
| Company Size | Count |
|---|---|
| Small Business | 7 |
| Midsize Enterprise | 3 |
| Large Enterprise | 13 |
| Company Size | Count |
|---|---|
| Small Business | 337 |
| Midsize Enterprise | 191 |
| Large Enterprise | 733 |
Microsoft Defender for Identity offers comprehensive monitoring and AI-driven user behavior analysis. It detects threats through real-time alerts and identifies lateral movements and entity tagging, ensuring robust security management. With excellent visibility via its dashboard, it supports customized detection rules and seamlessly integrates with SIEM platforms. While SecureScore and SecureScan provide robust environment security, there is room for improvement in cloud security, on-premises application integration, and remediation capabilities. Azure integration is limited, and the administrative interface could be more user-friendly. Users experience frequent false positives, affecting threat detection efficiency.
What key features stand out in Microsoft Defender for Identity?In specific industries such as education and finance, Microsoft Defender for Identity is crucial for securing on-premises Active Directory and Azure Active Directory environments. It effectively detects suspicious activities and manages conditional access policies, offering user and entity behavior analytics, endpoint detection and response capabilities. This helps prevent unauthorized access and strengthens overall security, making it an invaluable asset for organizations aiming to safeguard their digital infrastructure.
Microsoft Defender for Identity was previously known as Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity.
Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
| Author info | Rating | Review Summary |
|---|---|---|
| Cloud Security & Governance at a financial services firm with 10,001+ employees | 4.0 | We use Microsoft Defender for Identity to protect our on-premises and hybrid Active Directory, focusing on advanced threat detection and security posture assessment. Despite its strengths, reducing alert fatigue remains necessary as we enhance integration with Azure AD. |
| CyberSecurity Engineer | Information Security Management at Self Employed | 5.0 | I find Microsoft Defender for Identity valuable for its conditional access and role-based permissions. It saves time but could improve in automation for impossible travel detection, particularly with VPNs, to reduce unnecessary disruptions and enhance security. |
| Instrumentation Engineer at Toyo Engineering Corp | 4.0 | We're testing Microsoft Defender for Identity, which auto-remediates incidents, saving investigation time and offering preemptive security. It identifies and mitigates threats from different IPs efficiently. We're in the initial phase, using it alongside Microsoft Azure. |
| CTO at a tech vendor with 10,001+ employees | 4.0 | I use Microsoft Defender for Identity as part of the Defender suite to manage identities. Its seamless integration with other tools is valuable, though it’s expensive with Sentinel and could improve integration with non-Microsoft systems. No ROI seen yet. |
| Deputy Manager at Servion Global Solutions | 5.0 | I’ve used Microsoft Defender for Identity for over four years, and it’s stable, scalable, and effective with valuable threat analytics and reporting. Setup was smooth with support from Microsoft's fast track team, and I have no complaints. |
| Information Technology Security Manager at a security firm with 51-200 employees | 4.5 | We use Microsoft Defender for Identity to manage organizational privileges and enhance security, appreciating its automatic remedies and threat visibility, especially with Sentinel. While its features are valuable, better documentation for technical users is needed for optimal application. |
| Owner at Alopex ONE UG | 5.0 | I use Microsoft Defender for Identity primarily for SQL identity endpoint management. Its most valuable feature is its hybrid AI for tracking security threats. I recommend integrating an admin app within Teams for mobile access to attack information. |
| Principle Architect at LiveRoute | 4.0 | I've used Microsoft Defender for Identity for three years and find it essential for deep analytics in hybrid environments, though setup is manual and time-consuming. Its integration, scalability, and reporting are impressive, and I recommend it frequently. |
