Try our new research platform with insights from 80,000+ expert users

BloodHound Enterprise vs Microsoft Defender for Identity comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

BloodHound Enterprise
Ranking in Identity Threat Detection and Response (ITDR)
6th
Average Rating
8.0
Reviews Sentiment
6.2
Number of Reviews
1
Ranking in other categories
No ranking in other categories
Microsoft Defender for Iden...
Ranking in Identity Threat Detection and Response (ITDR)
3rd
Average Rating
8.8
Reviews Sentiment
6.9
Number of Reviews
26
Ranking in other categories
Advanced Threat Protection (ATP) (5th), Microsoft Security Suite (3rd)
 

Mindshare comparison

As of October 2025, in the Identity Threat Detection and Response (ITDR) category, the mindshare of BloodHound Enterprise is 6.1%, up from 5.0% compared to the previous year. The mindshare of Microsoft Defender for Identity is 14.6%, down from 22.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Identity Threat Detection and Response (ITDR) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender for Identity14.6%
BloodHound Enterprise6.1%
Other79.3%
Identity Threat Detection and Response (ITDR)
 

Featured Reviews

Hasan Abufreiha - PeerSpot reviewer
Has significantly influenced our security strategy as it helps us plan attacks and take initial steps in compromising networks
I haven't explored cost-saving aspects or utilized integration capabilities within BloodHound. Additionally, I haven't used AI features in Broadcom for threat detection yet, leaving that to our IT team to handle. If you're already familiar with the field, learning to use BloodHound Enterprise shouldn't be too tricky as the UI is user-friendly and the features are straightforward. I'd rate my overall experience around an eight, mainly due to occasional performance issues and deeper operational concerns. However, in terms of features, UI, and ease of use, it's top-notch.
Peter Arabomen - PeerSpot reviewer
Has supported hybrid identity management while integrating well with cloud directory services
The only challenge I have with Microsoft Defender for Identity is the latency. I may not put that entirely on Microsoft, because latency could be network related. At times when trying to authenticate, the prompt is delayed. We tried implementing passwordless authentication, especially for on-premises workloads, but we haven't been able to achieve that. Passwordless authentication is part of the identity functionalities, particularly when it comes to enforcing passwordless for on-premises workloads. In terms of improvements, you can't create OUs on Azure AD. Regarding giving users privileges on what they can do across different OUs, I haven't seen that feature on Microsoft Defender for Identity. Microsoft Defender for Identity needs to be able to plug into third-party applications that are not Microsoft. For instance, with a human resource application used to manage users and leave requests, when staff leaves the organization, they are first exited from that application before AD. Integration between Azure AD and third-party applications would allow automatic syncing when removing staff. The initial setup of Microsoft Defender for Identity is not hard. However, setup is one thing, and getting value from the application end-to-end is another. It can be set up and running from the first day but not functioning optimally. Initially, when we did the setup, it wasn't optimal. Over time, with continuous improvement, which we're still doing, we've gotten to a comfortable level, but there's still room for improvement.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The custom Cypress queries in BloodHound Enterprise is the most valuable feature."
"The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks."
"I recommend Microsoft Defender for Identity because it is easy to implement."
"Auto-remediation is a valuable feature applied to Microsoft Defender for Identity, reducing the burden of investigating false positives."
"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."
"Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence."
"The solution offers excellent visibility into threats."
"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."
"This solution has advanced a lot over the last few years."
 

Cons

"A few months ago, there was a problem with the digesters having trouble importing data from the normal digesters, a significant issue that needed attention."
"We observe a lot of false positives. Sometimes, when we go for a coffee break, we lock our screens. Locking the screen has a separate Windows event ID and sometimes I see it is detected as a failed login."
"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."
"There is no option to remedy an issue directly from the console. If we see an alert, we can't fix it from the console. Instead, we must depend on other Microsoft products, such as MDE. That is a significant drawback. It simply works as a scanner, which can sometimes put enough load on the sensors. Immediate actions should be possible from the dashboard because. It can prevent issues from spreading further."
"An area for improvement is the administrative interface. It's basic compared to other administrative centers. They could make it more user-friendly and easier to navigate."
"The areas of Microsoft Defender for Identity that can be improved include its cost, which is quite expensive when integrated into Sentinel. Additionally, there is room for improvement in its integration with non-Microsoft applications and systems."
"When the data leaves the cloud, there are security issues."
"Feedback on sync issues with the Microsoft portal highlighted its slow nature, with syncs sometimes taking eight hours."
"One improvement I would recommend is the integration of an admin application within Teams, allowing easy access to attack information on a mobile platform to promptly alert affected users and their friends."
 

Pricing and Cost Advice

Information not available
"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."
"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
report
Use our free recommendation engine to learn which Identity Threat Detection and Response (ITDR) solutions are best for your needs.
868,787 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
10%
Manufacturing Company
9%
Government
6%
Computer Software Company
15%
Financial Services Firm
12%
Manufacturing Company
8%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise3
Large Enterprise14
 

Questions from the Community

What needs improvement with BloodHound Enterprise?
I don't have any specific improvements in mind, as I haven't encountered any significant issues with BloodHound Enterprise. However, a few months ago, there was a problem with the digesters having ...
What is your primary use case for BloodHound Enterprise?
I mainly use BloodHound Enterprise for internal architecture planning, audits, and daily general testing engagements.
What advice do you have for others considering BloodHound Enterprise?
I haven't explored cost-saving aspects or utilized integration capabilities within BloodHound. Additionally, I haven't used AI features in Broadcom for threat detection yet, leaving that to our IT ...
What do you like most about Microsoft Defender for Identity?
Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.
What needs improvement with Microsoft Defender for Identity?
The only challenge I have with Microsoft Defender for Identity is the latency. I may not put that entirely on Microsoft, because latency could be network related. At times when trying to authentica...
What is your primary use case for Microsoft Defender for Identity?
I've used Microsoft Defender for Identity primarily for provisioning users on Azure AD and Microsoft authentication. For hybrid scenarios, I integrate on-premises AD to Azure AD. We use AD Connect ...
 

Also Known As

No data available
Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
 

Overview

 

Sample Customers

Information Not Available
Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Find out what your peers are saying about Microsoft, CrowdStrike, SentinelOne and others in Identity Threat Detection and Response (ITDR). Updated: August 2025.
868,787 professionals have used our research since 2012.