Microsoft Defender for Identity vs NetMon comparison

Microsoft and Exabeam are both solutions in the Identity Threat Detection and Response (ITDR) category. Microsoft is ranked #3 with an average rating of 8.7, while Exabeam is ranked #13 with an average rating of 7.5. Microsoft holds a 9.7% mindshare in ITDR, compared to Exabeam’s 1.9% mindshare. Additionally, 100% of Microsoft users are willing to recommend the solution, compared to 100% of Exabeam users who would recommend it.

Microsoft Defender for Iden...

Read 28 Microsoft Defender for Identity reviews

7,343 Views
3,525 Comparison Views

100% willing to recommend

NetMon

Read 12 NetMon reviews

2,473 Views
346 Comparison Views

100% willing to recommend

Microsoft Defender for Iden...

NetMon

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Microsoft Defender for Identity and NetMon based on real PeerSpot user reviews.

Find out in this report how the two Identity Threat Detection and Response (ITDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Microsoft Defender for Identity vs. NetMon Report (Updated: April 2026).

Buyer's Guide

Microsoft Defender for Identity vs. NetMon

April 2026

Download the complete report

Helped 896,510 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Microsoft Defender for Iden...

Ranking in Identity Threat Detection and Response (ITDR)

3rd

Average Rating

8.8

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Advanced Threat Protection (ATP) (8th), Microsoft Security Suite (5th)

NetMon

Ranking in Identity Threat Detection and Response (ITDR)

13th

Average Rating

7.6

Reviews Sentiment

6.1

Number of Reviews

Ranking in other categories

Network Monitoring Software (53rd)

Mindshare comparison

As of May 2026, in the Identity Threat Detection and Response (ITDR) category, the mindshare of Microsoft Defender for Identity is 9.7%, down from 18.0% compared to the previous year. The mindshare of NetMon is 1.9%. It is calculated based on PeerSpot user engagement data.

Identity Threat Detection and Response (ITDR) Mindshare Distribution
Product	Mindshare (%)
Microsoft Defender for Identity	9.7%
NetMon	1.9%
Other	88.4%

Identity Threat Detection and Response (ITDR)

Featured Reviews

Peter Arabomen

Security Engineer at Fidelity Bank Plc

Has supported hybrid identity management while integrating well with cloud directory services

The only challenge I have with Microsoft Defender for Identity is the latency. I may not put that entirely on Microsoft, because latency could be network related. At times when trying to authenticate, the prompt is delayed. We tried implementing passwordless authentication, especially for on-premises workloads, but we haven't been able to achieve that. Passwordless authentication is part of the identity functionalities, particularly when it comes to enforcing passwordless for on-premises workloads. In terms of improvements, you can't create OUs on Azure AD. Regarding giving users privileges on what they can do across different OUs, I haven't seen that feature on Microsoft Defender for Identity. Microsoft Defender for Identity needs to be able to plug into third-party applications that are not Microsoft. For instance, with a human resource application used to manage users and leave requests, when staff leaves the organization, they are first exited from that application before AD. Integration between Azure AD and third-party applications would allow automatic syncing when removing staff. The initial setup of Microsoft Defender for Identity is not hard. However, setup is one thing, and getting value from the application end-to-end is another. It can be set up and running from the first day but not functioning optimally. Initially, when we did the setup, it wasn't optimal. Over time, with continuous improvement, which we're still doing, we've gotten to a comfortable level, but there's still room for improvement.

Read full review

SumitRangari

Pan India IT Infrastructure Management / End-user Services at Tata Group

Has supported real-time event detection and reporting accuracy while database integration has required extra effort

Sometimes it may be difficult to incorporate new additional databases in NetMon, and we faced some challenges at that time. However, currently, it is not giving many challenges.It is difficult to integrate NetMon with other databases. We can customize NetMon's monitoring views, but it is done by the team who handles it, as it is outsourced.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I would rate Microsoft Defender for Identity at nine out of ten."

"The most valuable features of Microsoft Defender for Identity include real-time information for threat detection, its inclusion of behavioral analytics, and vulnerability management."

"Defender for Identity has not affected the end-user experience."

"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."

"The solution offers excellent visibility into threats."

"We use AD Connect to sync on-premises AD to Azure AD, and so far, it has been effective."

"The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks."

"It is easy to set up. Based on the number of devices you would like to set up, you can use scripts, Group Policy, etc. It takes five minutes to set up."

More Microsoft Defender for Identity pros

"The analytics feature is the most valuable feature."

"We were sold on the product based on the fairly narrow use cases that the sales reps gave us, and what we're seeing during our usage is that we can get there, and we're very excited about the potential."

"The protocols with which you see the traffic for a particular website that a client has in their environment, for example, are valuable. We can monitor whether the traffic is up to the mark or whether they need to add more bandwidth. Also, we can see if we're able to get real-time environment data as well. The customization dashboard is really good. LogRhythm NetMon has its own in-built dashboards which are helpful in guiding customization."

"The analytics feature is the most valuable feature."

"NetMon's best feature is traffic analysis."

"It has a very strong artificial intelligence engine."

"In general, this is a good product."

"It is a stable solution...It is a scalable solution."

More NetMon pros

Cons

"They should improve the automation for impossible travel detection. When connected to Wi-Fi and then to VPN, the system sometimes interprets the IP address change as impossible travel."

"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."

"There is no option to remedy an issue directly from the console. If we see an alert, we can't fix it from the console. Instead, we must depend on other Microsoft products, such as MDE. That is a significant drawback. It simply works as a scanner, which can sometimes put enough load on the sensors. Immediate actions should be possible from the dashboard because. It can prevent issues from spreading further."

"Microsoft Defender for Identity does not save me time, but I think it is the way that I secure the data."

"The areas of Microsoft Defender for Identity that can be improved include its cost, which is quite expensive when integrated into Sentinel. Additionally, there is room for improvement in its integration with non-Microsoft applications and systems."

"The tracking instance needs to be configured appropriately."

"We observe a lot of false positives. Sometimes, when we go for a coffee break, we lock our screens. Locking the screen has a separate Windows event ID and sometimes I see it is detected as a failed login."

"I can't say that I've seen a return on investment since we have Microsoft Defender for Identity because we also have another security solution in place."

More Microsoft Defender for Identity cons

"The training for this product is not very good and needs to be improved."

"Could use a topology diagram which would help get an exact visual."

"Some of the automated tasks we can perform on QRadar cannot be performed on LogRhythm because the solution has limitations."

"Their technical support isn't so great."

"There is an issue with tunneling in relation to how the connectivity is established between the end devices and where NetMon is installed. On the console, I often observe that there's a difference of a few seconds or maybe a minute, and this lag time should not be there."

"The main concern is that LogRhythm has not improved NetMon but instead introduced a separate product, which many customers, including us, would prefer to be integrated into a single platform for easier management."

"Sometimes it may be difficult to incorporate new additional databases in NetMon, and we faced some challenges at that time."

"The platform's integration features often need to be improved."

More NetMon cons

Pricing and Cost Advice

"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."

"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."

"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."

"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."

"LogRhythm's licensing part is something that depends on the license you want since they offer it on a perpetual and subscription basis."

"I don't have visibility into the pricing of LogRhythm NetMon as it's handled through our commercial partnerships."

"The product is expensive for smaller companies."

"Pricing is okay. There were some competitors that were extremely expensive and there were some which were really inexpensive but LogRhythm stayed in the middle of them."

"NetMon's licensing costs about $85k per year, with some extra costs for support."

"The price of this solution is too high, so it should be made more practical and more valuable for the customer."

See which vendors are best for you

Use our free recommendation engine to learn which Identity Threat Detection and Response (ITDR) solutions are best for your needs.

See recommendations

896,510 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

13%

Computer Software Company

11%

Manufacturing Company

Comms Service Provider

Transportation Company

14%

Financial Services Firm

12%

Comms Service Provider

11%

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	5
Large Enterprise	15

By reviewers
Company Size	Count
Small Business	2
Midsize Enterprise	2
Large Enterprise	7

Questions from the Community

What needs improvement with Microsoft Defender for Identity?

I really would have to sit down to think about how Microsoft Defender for Identity can be improved. I didn't take stock in what needs to be improved because I appreciated having the tools right the...

See all answers

What is your primary use case for Microsoft Defender for Identity?

My main use cases for Microsoft Defender for Identity include Conditional Access, checking risky users, remediating risky users, and user sign-ins. I can easily remediate or determine what the user...

See all answers

What advice do you have for others considering Microsoft Defender for Identity?

I don't really use Microsoft Defender for Identity a lot because my new role doesn't allow me to take time to do so. I don't really use the threat intelligence feature of Microsoft Defender for Ide...

See all answers

What is your experience regarding pricing and costs for LogRhythm NetMon?

I don't have visibility into the pricing of LogRhythm NetMon as it's handled through our commercial partnerships.

See all answers

What needs improvement with LogRhythm NetMon?

See all answers

What is your primary use case for LogRhythm NetMon?

We have outsourced our SIEM solutions at the moment, and we are using it.We have been using LogRhythm in our organization as a SaaS offering. We have outsourced it as part of the actual scope where...

See all answers

Comparisons

CrowdStrike Falcon vs Microsoft Defender for Identity

Compared 8% of the time

Microsoft Entra ID Protection vs Microsoft Defender for Identity

Compared 5% of the time

Huntress Managed ITDR vs Microsoft Defender for Identity

Compared 4% of the time

SentinelOne Singularity Identity vs Microsoft Defender for Identity

Compared 4% of the time

Microsoft Defender for Office 365 vs Microsoft Defender for Identity

Compared 4% of the time

More Microsoft Defender for Identity Competitors

SolarWinds NPM vs NetMon

Compared 6% of the time

Ixia CloudLens vs NetMon

Compared 6% of the time

ObserverLIVE vs NetMon

Compared 5% of the time

CrowdStrike Falcon vs NetMon

Compared 4% of the time

SCOM vs NetMon

Compared 4% of the time

More NetMon Competitors

Product Reports

Buyer's Guide

Microsoft Defender for Identity

May 2026

Download Microsoft Defender for Identity product report

Buyer's Guide

NetMon

May 2026

Download NetMon product report

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity

LogRhythm Network Monitor

Overview

Microsoft Defender for Identity offers real-time threat detection and protection for hybrid Active Directory environments. It integrates with Microsoft 365 components for seamless security and monitors advanced behaviors, enhancing identity protection across cloud and on-premises environments.

Microsoft Defender for Identity provides detailed threat insights and user behavior analytics to detect unauthorized access and notify anomalies. It allows setting custom detection rules, enhancing threat response automation. While it needs improvements in cloud security, SIEM integration, and access controls, users leverage its ability to mitigate identity threats like suspicious logins and ransomware. Enhanced integration with Microsoft security products ensures a coordinated threat response for identity control and privilege management.

What are the key features of Microsoft Defender for Identity?

Active Directory Federation: Seamlessly integrates with Microsoft 365 for comprehensive security.
Real-time Security Monitoring: Provides immediate insights into advanced user behaviors and potential threats.
Threat Insights: Delivers detailed analysis of threats with the ability to customize detection rules.
User Behavior Analytics: Analyzes user activities to detect anomalies and potential risks.
Identity Protection: Offers comprehensive protection in both cloud and on-premises environments.

What benefits should users expect from reviews of Microsoft Defender for Identity?

Unauthorized Access Prevention: Identifies potential unauthorized activities with advanced detection mechanisms.
Anomaly Notification: Alerts users to unexpected activities within their environments.
Threat Response Automation: Facilitates rapid response to threats with automated solutions.
Enhanced Cloud Security: Strengthens identity management across hybrid and cloud frameworks.

In specific industries, organizations implement Microsoft Defender for Identity to secure on-premises and hybrid Active Directory environments through user and entity behavior analytics, malicious activity detection, and integration with Microsoft security tools. This approach enhances security posture assessment and helps mitigate identity threats like identity harvesting and unauthorized access.

Microsoft

NetMon offers significant capabilities in log aggregation, traffic analysis, and real-time network insights. Its ease of use accommodates both entry-level and advanced functionalities, enhancing network visibility and threat detection.

NetMon provides seamless analytics with its real-time dashboards and advanced AI integration. The platform is designed for comprehensive monitoring and detailed analysis, making it indispensable for identifying network traffic, origins, destinations, and facilitating threat detection through lateral traffic visibility. Despite its powerful analytics and customization features, improvements in product integration, customer support, and pricing could increase its competitive edge. Connectivity, topology visualization, and server performance are areas noted for enhancement. Integration with protocols like Gflow and Netflow might alleviate agent-based restriction challenges. NetMon sends correlated data to LogRhythm SIEM for enhanced threat analysis and is used for tasks like traffic analysis and DPA.

What are NetMon's key features?

Log Aggregation: Seamless collection of diverse network logs for analysis.
Traffic Analysis: Detailed inspection of network traffic for identifying irregular patterns.
AI Integration: Advanced analytics powered by robust AI capabilities.
Customizable Dashboards: Real-time insights tailored to user requirements.
Correlation Engine: In-depth correlation of network activity for comprehensive reports.
Deep Packet Analytics: Thorough examination of data packets for granular insights.

What benefits and ROI can users expect?

Enhanced Threat Detection: Significant improvements in identifying lateral threats.
Comprehensive Insights: Complete visibility into network and user activities.
Efficient Monitoring: Real-time analytics streamline network monitoring processes.
Compliance Support: Strong integration supports adherence to compliance standards.

NetMon is widely adopted in industries requiring detailed traffic monitoring and security, such as finance and healthcare. Its capabilities in traffic type identification and correlated analysis make it essential for environments where detecting irregular patterns is critical. It's utilized for network security through comprehensive analysis and integration with SIEM systems.

Exabeam

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.

Sera-Brynn

Buyer's Guide

Microsoft Defender for Identity vs. NetMon

April 2026

Free Report: Microsoft Defender for Identity vs. NetMon

Find out what your peers are saying about Microsoft Defender for Identity vs. NetMon and other solutions. Updated: April 2026.

DOWNLOAD NOW

896,510 professionals have used our research since 2012.

See our Microsoft Defender for Identity vs. NetMon report.

See our list of best Identity Threat Detection and Response (ITDR) vendors.

We monitor all Identity Threat Detection and Response (ITDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.