

Find out in this report how the two Identity Threat Detection and Response (ITDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
I really value how Huntress does most of the heavy lifting and monitoring for the identities.
You will not be able to beat Huntress Managed ITDR on pricing, and that is considering the capabilities Huntress Managed ITDR provides at their price level.
In terms of a return on investment for our security posture, it's absolutely paying for itself to ensure that we are better secure compared to what we were without it.
There is a return on investment in terms of time-saving, control, and ease of manageability of the environment.
They are quick to respond and help us explain why Huntress marked an identity in a certain way.
They primarily handle ITDR communications through chat, they made an exception and provided a call for a critical situation to walk me through the remediation process.
They've been very responsive when we have had to use them.
We classified it as a critical problem, and they accepted our classification and helped us quickly.
They often refer to internal blogs, which doesn't offer much new information and can limit our capabilities in troubleshooting.
Tickets often bounce from person to person, requiring the sharing of information multiple times.
I've never had limitations on scaling or performance issues.
Huntress Managed ITDR is protecting about 120 users. In terms of the people that log into it, it's two or three IT admins, but we've got 120 licenses, so it's protecting 120 Microsoft accounts.
Whether there are ten users or three hundred, it attaches to the Microsoft tenant, making it effortless to scale.
Since it is a cloud computing product, it can accommodate a range of company sizes, from a few users to large businesses.
There are no issues with scalability up to your license limitations.
We haven't experienced problems with Microsoft Entra ID Protection.
I would rate the stability of Huntress Managed ITDR as a ten, as I have not really experienced any downtime, bugs, or glitches.
In terms of stability, the solution is very stable, and the cloud platform itself is reliable.
Once it is deployed, it updates automatically and takes care of itself.
There's a confusing aspect with the escalation options; applying conditions to a specific identity is not immediately visible and requires using a three-dot menu.
It's a very simple and easy-to-use interface in terms of recommendations and feedback.
I still see many issues indicating that devices are not compliant due to policy conflicts, and it has been almost a month trying to figure out how to make all devices compliant.
If there was some level of backup mechanism available with quick restore functionality, that would be beneficial.
Microsoft has not offered control over how they calculate high or low-risk scenarios.
There is no write-back feature from the cloud to local, which would allow me to use my own credentials from the cloud tenant securely.
Compared to other companies, Huntress keeps costs reasonable, offering 24/7 vigilance without price gouging.
I think it was two or three dollars a user a month.
The licensing cost, again, is a good price point that allows me to add it on to clients and it becomes a no-brainer for them to add it because the price of the service makes sense.
Entra ID Protection is not badly priced, but some clients, especially in medium to smaller scale companies in third-world countries, find it quite expensive.
Microsoft Entra ID requires additional licensing components.
The pricing for Microsoft Entra ID protection is not expensive.
It provides protection against M365 identity compromises, like admin account breaches.
The best features of the solution are the fact that there are real people behind it who watch the alerts and then escalate as required, and the fact that there is an immediate support team or SOC team behind it if we have any questions.
The best feature is the lack of false positives; when we receive an alert from Huntress Managed ITDR, the majority of the time they are true positives that are actionable, unlike some other tools which generate a lot of noise.
Having a single sign-on feature with Entra ID ensures seamless access to various applications, even those with significant security constraints.
These features ease the job of security analysts, providing a better vision of user activities and potential risks.
We use automated remediation for logon purposes and error purposes. It remediates issues and provides just-in-time access when applicable.
| Product | Market Share (%) |
|---|---|
| Microsoft Entra ID Protection | 7.3% |
| Huntress Managed ITDR | 4.9% |
| Other | 87.8% |

| Company Size | Count |
|---|---|
| Small Business | 13 |
| Midsize Enterprise | 1 |
| Company Size | Count |
|---|---|
| Small Business | 15 |
| Midsize Enterprise | 1 |
| Large Enterprise | 4 |
Huntress Managed ITDR specializes in protecting Microsoft 365 environments by analyzing abnormal logons, run events, and unsanctioned VPNs. It offers efficient deployment, direct SOC support, and seamless integration with Microsoft Defender, enhancing security strategies against identity compromises.
Huntress Managed ITDR provides a robust platform for centralized management of Microsoft environments. It emphasizes fast deployment and automatic remediation to protect against threats such as admin account breaches. With direct SOC support, it offers actionable insights and reports that bolster security measures. Though improvements are needed in areas like reporting and interface responsiveness, it remains a cost-effective choice for those integrating with Microsoft Defender for Endpoint, helping organizations guard against abnormal logins and vulnerabilities.
What are the key features of Huntress Managed ITDR?Huntress Managed ITDR is employed across multiple industries to integrate clients with Microsoft 365 and secure their endpoints and cloud tenants. They use the platform for monitoring activity and preventing unauthorized access. Managed Service Providers utilize it for its robust threat detection and sign-in awareness, connecting devices to handle incidents efficiently.
Microsoft Entra ID Protection enhances security through features like conditional access and multifactor authentication, optimizing identity management for enterprises. This robust solution ensures efficient control over access policies, supporting seamless integration and operational efficiency.
Microsoft Entra ID Protection provides advanced identity management, authentication, and authorization capabilities, supporting multifactor authentication and single sign-on to control digital identities effectively. It utilizes adaptive machine learning for security enhancements and automated risk-based actions, with seamless Microsoft Defender integration. Connectivity with third-party applications and real-time monitoring offers improved operational efficiency for managing large user bases. While it is a powerful tool, there is room to grow in areas such as identity labeling, password management, faster synchronization, better Mac compatibility, and improved scalability. Desired features include enhanced course availability for security training, streamlined implementation processes, and clarified interfaces.
What are the key features of Microsoft Entra ID Protection?Organizations leverage Microsoft Entra ID Protection to manage identities and access across sectors such as finance, healthcare, and technology. They integrate hybrid environments, enforcing multifactor authentication and conditional access policies, which enables them to secure digital identities and align with compliance operations. Many synchronize on-premises Active Directory with cloud services, effectively managing users, groups, and licenses.
We monitor all Identity Threat Detection and Response (ITDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.