Microsoft Defender for Identity vs NetMon comparison

Why PeerSpot?

Microsoft and Exabeam are both solutions in the Identity Threat Detection and Response (ITDR) category. Microsoft is ranked #2 with an average rating of 8.7, while Exabeam is ranked #15 with an average rating of 8.0. Microsoft holds a 8.7% mindshare in ITDR, compared to Exabeam’s 2.1% mindshare. Additionally, 100% of Microsoft users are willing to recommend the solution, compared to 100% of Exabeam users who would recommend it.

Microsoft Defender for Iden...

Read 28 Microsoft Defender for Identity reviews

8,396 Views
4,114 Comparison Views

100% willing to recommend

NetMon

Read 12 NetMon reviews

3,492 Views
559 Comparison Views

100% willing to recommend

Microsoft Defender for Iden...

NetMon

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Microsoft Defender for Identity and NetMon based on real PeerSpot user reviews.

Find out in this report how the two Identity Threat Detection and Response (ITDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Microsoft Defender for Identity vs. NetMon Report (Updated: August 2026).

Buyer's Guide

Microsoft Defender for Identity vs. NetMon

August 2026

Download the complete report

Helped 911,493 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Microsoft Defender for Iden...

Ranking in Identity Threat Detection and Response (ITDR)

2nd

Average Rating

8.8

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Advanced Threat Protection (ATP) (8th), Microsoft Security Suite (5th)

NetMon

Ranking in Identity Threat Detection and Response (ITDR)

15th

Average Rating

7.6

Reviews Sentiment

6.1

Number of Reviews

Ranking in other categories

Network Monitoring Software (50th)

Mindshare comparison

As of August 2026, in the Identity Threat Detection and Response (ITDR) category, the mindshare of Microsoft Defender for Identity is 8.7%, down from 16.4% compared to the previous year. The mindshare of NetMon is 2.1%, up from 0.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Identity Threat Detection and Response (ITDR) Mindshare Distribution
Product	Mindshare (%)
Microsoft Defender for Identity	8.7%
NetMon	2.1%
Other	89.2%

Identity Threat Detection and Response (ITDR)

Featured Reviews

Peter Arabomen

Security Engineer at Fidelity Bank Plc

Has supported hybrid identity management while integrating well with cloud directory services

The only challenge I have with Microsoft Defender for Identity is the latency. I may not put that entirely on Microsoft, because latency could be network related. At times when trying to authenticate, the prompt is delayed. We tried implementing passwordless authentication, especially for on-premises workloads, but we haven't been able to achieve that. Passwordless authentication is part of the identity functionalities, particularly when it comes to enforcing passwordless for on-premises workloads. In terms of improvements, you can't create OUs on Azure AD. Regarding giving users privileges on what they can do across different OUs, I haven't seen that feature on Microsoft Defender for Identity. Microsoft Defender for Identity needs to be able to plug into third-party applications that are not Microsoft. For instance, with a human resource application used to manage users and leave requests, when staff leaves the organization, they are first exited from that application before AD. Integration between Azure AD and third-party applications would allow automatic syncing when removing staff. The initial setup of Microsoft Defender for Identity is not hard. However, setup is one thing, and getting value from the application end-to-end is another. It can be set up and running from the first day but not functioning optimally. Initially, when we did the setup, it wasn't optimal. Over time, with continuous improvement, which we're still doing, we've gotten to a comfortable level, but there's still room for improvement.

Read full review

SumitRangari

Pan India IT Infrastructure Management / End-user Services at Tata Group

Has supported real-time event detection and reporting accuracy while database integration has required extra effort

Sometimes it may be difficult to incorporate new additional databases in NetMon, and we faced some challenges at that time. However, currently, it is not giving many challenges.It is difficult to integrate NetMon with other databases. We can customize NetMon's monitoring views, but it is done by the team who handles it, as it is outsourced.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The solution offers excellent visibility into threats."

"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."

"I recommend Microsoft Defender for Identity because it is easy to implement."

"I would rate Microsoft Defender for Identity at nine out of ten."

"One of our users had the same password for every personal and company account. That was a problem because she started receiving phishing emails that could compromise all of her accounts. Defender told us that the user was not changing their password."

"We do not see any issues with the stability of Microsoft Defender for Identity. I can say it is 100% stable."

"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."

"In the security portfolio that we manage, Microsoft Defender for Identity is very important because it is the professional service that we sell the most."

More Microsoft Defender for Identity pros

"Visibility is a valuable feature, the ability to see even if the traffic is not going into the firewall"

"It is a stable solution...It is a scalable solution."

"We were sold on the product based on the fairly narrow use cases that the sales reps gave us, and what we're seeing during our usage is that we can get there, and we're very excited about the potential."

"The protocols with which you see the traffic for a particular website that a client has in their environment, for example, are valuable. We can monitor whether the traffic is up to the mark or whether they need to add more bandwidth. Also, we can see if we're able to get real-time environment data as well. The customization dashboard is really good. LogRhythm NetMon has its own in-built dashboards which are helpful in guiding customization."

"We are using NetMon's real-time traffic analysis regularly with a team of four members who effectively monitor all alerts and events, which has helped them identify whether there could be a severe incident."

"The initial setup is straightforward because we can deploy an open server."

"NetMon's best feature is traffic analysis."

"In general, this is a good product."

More NetMon pros

Cons

"The tracking instance needs to be configured appropriately."

"Microsoft Defender for Identity does not save me time, but I think it is the way that I secure the data."

"The configuration process is time-consuming, with installation taking two minutes but prerequisites requiring two hours."

"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."

"The technical support needs significant improvement. Documentation for more minor issues in the form of guides or walkthroughs could help to resolve this issue. The number of tickets raised would decrease, removing some pressure from the support team and making it easier to clear the remaining tickets."

"And when you are working in a priority IP address, Identity is not able to know that those IPs are from the company. It sees that the IPs are from Taiwan or from Hong Kong or from India, even though they are internal IPs, resulting in a lot of false positives."

"They should improve the automation for impossible travel detection. When connected to Wi-Fi and then to VPN, the system sometimes interprets the IP address change as impossible travel."

"One area that needs improvement is the number of alerts generated, leading to alert fatigue."

More Microsoft Defender for Identity cons

"Some of the automated tasks we can perform on QRadar cannot be performed on LogRhythm because the solution has limitations."

"I would like to see better integration with multiple products. Integration is not something that is readily available for most of the products."

"The platform's integration features often need to be improved."

"Previously, it was typically every Monday that I was coming in - it would die over the weekend - and I would spend a day cleaning up databases."

"The main concern is that LogRhythm has not improved NetMon but instead introduced a separate product, which many customers, including us, would prefer to be integrated into a single platform for easier management."

"LogRhythm NetMon's pricing model is an area of concern that should be made a little bit cheaper in comparison to the other players in the market currently."

"The training for this product is not very good and needs to be improved."

"Sometimes it's hard to find the network devices' self-audit logs."

More NetMon cons

Pricing and Cost Advice

"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."

"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."

"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."

"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."

"Pricing is okay. There were some competitors that were extremely expensive and there were some which were really inexpensive but LogRhythm stayed in the middle of them."

"The price of this solution is too high, so it should be made more practical and more valuable for the customer."

"The product is expensive for smaller companies."

"I don't have visibility into the pricing of LogRhythm NetMon as it's handled through our commercial partnerships."

"NetMon's licensing costs about $85k per year, with some extra costs for support."

"LogRhythm's licensing part is something that depends on the license you want since they offer it on a perpetual and subscription basis."

See which vendors are best for you

Use our free recommendation engine to learn which Identity Threat Detection and Response (ITDR) solutions are best for your needs.

See recommendations

911,493 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

12%

Manufacturing Company

10%

Computer Software Company

10%

Comms Service Provider

Construction Company

12%

Transportation Company

12%

Financial Services Firm

11%

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	9
Midsize Enterprise	5
Large Enterprise	15

By reviewers
Company Size	Count
Small Business	2
Midsize Enterprise	2
Large Enterprise	7

Questions from the Community

What needs improvement with Microsoft Defender for Identity?

I really would have to sit down to think about how Microsoft Defender for Identity can be improved. I didn't take stock in what needs to be improved because I appreciated having the tools right the...

See all answers

What is your primary use case for Microsoft Defender for Identity?

My main use cases for Microsoft Defender for Identity include Conditional Access, checking risky users, remediating risky users, and user sign-ins. I can easily remediate or determine what the user...

See all answers

What advice do you have for others considering Microsoft Defender for Identity?

I don't really use Microsoft Defender for Identity a lot because my new role doesn't allow me to take time to do so. I don't really use the threat intelligence feature of Microsoft Defender for Ide...

See all answers

What needs improvement with LogRhythm NetMon?

See all answers

What is your primary use case for LogRhythm NetMon?

We have outsourced our SIEM solutions at the moment, and we are using it.We have been using LogRhythm in our organization as a SaaS offering. We have outsourced it as part of the actual scope where...

See all answers

What advice do you have for others considering LogRhythm NetMon?

We use AWS as our cloud provider in a private cloud environment.It completely depends upon when incidents happen. To find the root cause analysis, we need to first gather the logs from the team. It...

See all answers

Comparisons

CrowdStrike Falcon vs Microsoft Defender for Identity

Compared 6% of the time

Microsoft Entra ID Protection vs Microsoft Defender for Identity

Compared 6% of the time

SentinelOne Singularity Identity vs Microsoft Defender for Identity

Compared 5% of the time

Microsoft Defender for Office 365 vs Microsoft Defender for Identity

Compared 4% of the time

BloodHound Enterprise vs Microsoft Defender for Identity

Compared 4% of the time

More Microsoft Defender for Identity Competitors

SolarWinds NPM vs NetMon

Compared 5% of the time

CrowdStrike Falcon vs NetMon

Compared 5% of the time

Vectra AI vs NetMon

Compared 5% of the time

Ixia CloudLens vs NetMon

Compared 5% of the time

ObserverLIVE vs NetMon

Compared 4% of the time

More NetMon Competitors

Product Reports

Buyer's Guide

Microsoft Defender for Identity

August 2026

Download Microsoft Defender for Identity product report

Buyer's Guide

NetMon

August 2026

Download NetMon product report

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity

LogRhythm Network Monitor

Overview

Microsoft Defender for Identity offers real-time threat detection and protection for hybrid Active Directory environments. It integrates with Microsoft 365 components for seamless security and monitors advanced behaviors, enhancing identity protection across cloud and on-premises environments.

Microsoft Defender for Identity provides detailed threat insights and user behavior analytics to detect unauthorized access and notify anomalies. It allows setting custom detection rules, enhancing threat response automation. While it needs improvements in cloud security, SIEM integration, and access controls, users leverage its ability to mitigate identity threats like suspicious logins and ransomware. Enhanced integration with Microsoft security products ensures a coordinated threat response for identity control and privilege management.

What are the key features of Microsoft Defender for Identity?

Active Directory Federation: Seamlessly integrates with Microsoft 365 for comprehensive security.
Real-time Security Monitoring: Provides immediate insights into advanced user behaviors and potential threats.
Threat Insights: Delivers detailed analysis of threats with the ability to customize detection rules.
User Behavior Analytics: Analyzes user activities to detect anomalies and potential risks.
Identity Protection: Offers comprehensive protection in both cloud and on-premises environments.

What benefits should users expect from reviews of Microsoft Defender for Identity?

Unauthorized Access Prevention: Identifies potential unauthorized activities with advanced detection mechanisms.
Anomaly Notification: Alerts users to unexpected activities within their environments.
Threat Response Automation: Facilitates rapid response to threats with automated solutions.
Enhanced Cloud Security: Strengthens identity management across hybrid and cloud frameworks.

In specific industries, organizations implement Microsoft Defender for Identity to secure on-premises and hybrid Active Directory environments through user and entity behavior analytics, malicious activity detection, and integration with Microsoft security tools. This approach enhances security posture assessment and helps mitigate identity threats like identity harvesting and unauthorized access.

Microsoft

NetMon offers significant capabilities in log aggregation, traffic analysis, and real-time network insights. Its ease of use accommodates both entry-level and advanced functionalities, enhancing network visibility and threat detection.

NetMon provides seamless analytics with its real-time dashboards and advanced AI integration. The platform is designed for comprehensive monitoring and detailed analysis, making it indispensable for identifying network traffic, origins, destinations, and facilitating threat detection through lateral traffic visibility. Despite its powerful analytics and customization features, improvements in product integration, customer support, and pricing could increase its competitive edge. Connectivity, topology visualization, and server performance are areas noted for enhancement. Integration with protocols like Gflow and Netflow might alleviate agent-based restriction challenges. NetMon sends correlated data to LogRhythm SIEM for enhanced threat analysis and is used for tasks like traffic analysis and DPA.

What are NetMon's key features?

Log Aggregation: Seamless collection of diverse network logs for analysis.
Traffic Analysis: Detailed inspection of network traffic for identifying irregular patterns.
AI Integration: Advanced analytics powered by robust AI capabilities.
Customizable Dashboards: Real-time insights tailored to user requirements.
Correlation Engine: In-depth correlation of network activity for comprehensive reports.
Deep Packet Analytics: Thorough examination of data packets for granular insights.

What benefits and ROI can users expect?

Enhanced Threat Detection: Significant improvements in identifying lateral threats.
Comprehensive Insights: Complete visibility into network and user activities.
Efficient Monitoring: Real-time analytics streamline network monitoring processes.
Compliance Support: Strong integration supports adherence to compliance standards.

NetMon is widely adopted in industries requiring detailed traffic monitoring and security, such as finance and healthcare. Its capabilities in traffic type identification and correlated analysis make it essential for environments where detecting irregular patterns is critical. It's utilized for network security through comprehensive analysis and integration with SIEM systems.

Exabeam

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.

Sera-Brynn

Buyer's Guide

Microsoft Defender for Identity vs. NetMon

August 2026

Free Report: Microsoft Defender for Identity vs. NetMon

Find out what your peers are saying about Microsoft Defender for Identity vs. NetMon and other solutions. Updated: August 2026.

DOWNLOAD NOW

911,493 professionals have used our research since 2012.

See our Microsoft Defender for Identity vs. NetMon report.

See our list of best Identity Threat Detection and Response (ITDR) vendors.

We monitor all Identity Threat Detection and Response (ITDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.