Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Identity vs Saviynt comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Nov 5, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender for Iden...
Ranking in Identity Threat Detection and Response (ITDR)
3rd
Average Rating
8.8
Reviews Sentiment
6.9
Number of Reviews
26
Ranking in other categories
Advanced Threat Protection (ATP) (5th), Microsoft Security Suite (3rd)
Saviynt
Ranking in Identity Threat Detection and Response (ITDR)
10th
Average Rating
7.4
Reviews Sentiment
6.3
Number of Reviews
26
Ranking in other categories
User Provisioning Software (3rd), Identity Management (IM) (7th), Privileged Access Management (PAM) (12th), Identity and Access Management (3rd)
 

Mindshare comparison

As of October 2025, in the Identity Threat Detection and Response (ITDR) category, the mindshare of Microsoft Defender for Identity is 14.6%, down from 22.2% compared to the previous year. The mindshare of Saviynt is 2.4%, up from 1.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Identity Threat Detection and Response (ITDR) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender for Identity14.6%
Saviynt2.4%
Other83.0%
Identity Threat Detection and Response (ITDR)
 

Featured Reviews

Peter Arabomen - PeerSpot reviewer
Has supported hybrid identity management while integrating well with cloud directory services
The only challenge I have with Microsoft Defender for Identity is the latency. I may not put that entirely on Microsoft, because latency could be network related. At times when trying to authenticate, the prompt is delayed. We tried implementing passwordless authentication, especially for on-premises workloads, but we haven't been able to achieve that. Passwordless authentication is part of the identity functionalities, particularly when it comes to enforcing passwordless for on-premises workloads. In terms of improvements, you can't create OUs on Azure AD. Regarding giving users privileges on what they can do across different OUs, I haven't seen that feature on Microsoft Defender for Identity. Microsoft Defender for Identity needs to be able to plug into third-party applications that are not Microsoft. For instance, with a human resource application used to manage users and leave requests, when staff leaves the organization, they are first exited from that application before AD. Integration between Azure AD and third-party applications would allow automatic syncing when removing staff. The initial setup of Microsoft Defender for Identity is not hard. However, setup is one thing, and getting value from the application end-to-end is another. It can be set up and running from the first day but not functioning optimally. Initially, when we did the setup, it wasn't optimal. Over time, with continuous improvement, which we're still doing, we've gotten to a comfortable level, but there's still room for improvement.
Suresh Kumar Subramaniyan - PeerSpot reviewer
Has delivered strong identity automation while support response could be faster
With either SailPoint or Saviynt, I utilize this product, as do some of my clients, with AWS as a main cloud provider. We are not using AWS; we were using only Saviynt. We never used AWS because we don't have any customers for AWS. Saviynt likely uses an AWS server for their database, though I'm not certain how they utilize AWS services. The cloud-native capabilities of Saviynt contribute to enhanced cloud security as they are operating a cloud-based solution. Saviynt's capabilities for automating user provisioning and access are excellent, and their IGA functionality is perfect. The specific details about their IGA capability show excellence in terms of automated onboarding, off-boarding process, and JML processes, making it a strong solution in this market. I rate Saviynt 8 out of 10.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution offers excellent visibility into threats."
"The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect."
"Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence."
"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."
"The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks."
"Defender for Identity has not affected the end-user experience."
"Auto-remediation is a valuable feature applied to Microsoft Defender for Identity, reducing the burden of investigating false positives."
"It automates routine testing and helps automate the finding of high-value alerts."
"The feature that we use the most is the global, third-party user management."
"The product is flexible to use."
"One of the tool's advantages is its user-friendly interface, making it easier to manipulate from a GUI perspective. The graphical user interface for users and administrators is straightforward. While it may require more configuration initially, once set up, it becomes more accessible and easier to use."
"We have found the implementation process to be very easy."
"Saviynt risk-based access requests and intelligent access controls have made a significant impact on our company."
"Saviynt provides built-in access recommendations, while SailPoint IdentityNow offers access recommendations through a separate AI integration that requires additional licensing. Saviynt functions as a unified platform for various business operations, consolidating user and access data from multiple sources into a single platform. This allows for leveraging the same user base and data across different business functions, including access governance, privileged access management, data access governance, and third-party access governance. In contrast, SailPoint is a decoupled tool, requiring separate integration for managing access and permissions, especially for unstructured data. Saviynt's approach is more integrated and streamlined, providing a unified platform for access recommendations and various business operations."
"Saviynt is easy to configure and manage."
"It is very easy to use. It addresses most of the trends in identity governance and risk management."
 

Cons

"And when you are working in a priority IP address, Identity is not able to know that those IPs are from the company. It sees that the IPs are from Taiwan or from Hong Kong or from India, even though they are internal IPs, resulting in a lot of false positives."
"The solution should provide more detailed data regarding anomaly detections."
"The technical support needs significant improvement. Documentation for more minor issues in the form of guides or walkthroughs could help to resolve this issue. The number of tickets raised would decrease, removing some pressure from the support team and making it easier to clear the remaining tickets."
"One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents."
"Defender for Identity gives us visibility, but we often get false positives from Azure that take us down the garden path. We go through 30 incidents each day and most of those are false positives or benign positive alerts. Occasionally, we get true positive alerts."
"There is no option to remedy an issue directly from the console. If we see an alert, we can't fix it from the console. Instead, we must depend on other Microsoft products, such as MDE. That is a significant drawback. It simply works as a scanner, which can sometimes put enough load on the sensors. Immediate actions should be possible from the dashboard because. It can prevent issues from spreading further."
"Microsoft should look at what competing vendors like CrowdStrike and Broadcom are doing and incorporate those features into Sentinel and Defender. At the same time, I think the intelligence inside the product is improving fast. They should incorporate more zero-trust and hybrid trust approaches. They need to build up threat intelligence based on threats and methods used in attacks on other companies."
"When the data leaves the cloud, there are security issues."
"According to feedback I've received, some users prefer SailPoint over Saviynt in real complex environments. SailPoint has its provisioning platform. Complex integrations may pose challenges in scenarios like a large bank with thousands of users, making SailPoint a preferred choice for some."
"The product can improve the customer support offered to users since it is an area with shortcomings."
"The biggest drawback is that for every change you want to make, you have to go back to them and ask for it."
"An area for improvement in Saviynt is that there's a limitation on the number of logs you can get from the past twenty-four hours. For example, if the data is huge, the tool can only give you a maximum of one hundred logs. You can't get any further than that. In the next version of Saviynt, however, you can get more logs and you'll see them inside the log rotation. For example, when you're trying to search inside the log, you can select a date range, and then you can search for a particular log. We haven't used that new log rotation feature yet, but it's included in the next release of Saviynt. Another area for improvement in the tool is that it doesn't have a server monitoring feature, so if your server has a high load, it should give you a warning. You're supposed to get an alert similar to what's being done in WebLogic. In WebLogic, we had a separate facility, but in Saviynt, that feature's missing."
"The main difficulty was the integration process itself. But we were able to kind of work through it and fix it. We tried integrating with our HR system and other IBM solutions, like Microsoft Identity Management."
"The product lacks a broad user base which makes it difficult sometimes to find answers to questions about the product."
"The configuration process at the beginning can be difficult, depending on the complexity of the company."
"The customer support and implementation services need to be improved."
 

Pricing and Cost Advice

"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"Saviynt's pricing is acceptable and licensing costs are yearly."
"The solution has a pay-as-you-go licensing model, and you can subscribe monthly or yearly."
"The price of the license for this product is quite expensive."
"If you are investing in securing your data and avoiding any non-compliance issues, then yes, it is certainly recommended. To put it plainly, if you're willing to pay fines and aren't concerned about the misuse of data, then there might not be a problem. However, if you intend to safeguard the data of your employees, vendors, and customers, it becomes crucial. In this context, managing data security requires preventive and detective measures, such as enforcing segregation of duties and regularly reviewing permissions. Throughout an individual's life cycle within an organization or customer life cycle, various access permissions are granted. Without taking action on these permissions, there is a risk of exposure later on. If individuals retain access after leaving the organization, it poses a serious security threat. Implementing solutions like Saviynt can address these challenges, ensuring continuous access review, generating reports, alerts, and identifying potential risks."
"Saviynt's pricing is reasonable."
"Saviynt has a competitive price."
"We are not into the licensing part. The clients take care of the licensing part."
"The pricing is comparable to Azure Entra ID. Kind of the same"
report
Use our free recommendation engine to learn which Identity Threat Detection and Response (ITDR) solutions are best for your needs.
868,759 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
12%
Manufacturing Company
7%
Government
7%
Financial Services Firm
16%
Computer Software Company
14%
Manufacturing Company
8%
Healthcare Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise3
Large Enterprise14
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise5
Large Enterprise15
 

Questions from the Community

What do you like most about Microsoft Defender for Identity?
Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.
What needs improvement with Microsoft Defender for Identity?
The only challenge I have with Microsoft Defender for Identity is the latency. I may not put that entirely on Microsoft, because latency could be network related. At times when trying to authentica...
What is your primary use case for Microsoft Defender for Identity?
I've used Microsoft Defender for Identity primarily for provisioning users on Azure AD and Microsoft authentication. For hybrid scenarios, I integrate on-premises AD to Azure AD. We use AD Connect ...
What do you like most about Saviynt?
It is very easy to use. It addresses most of the trends in identity governance and risk management.
What is your experience regarding pricing and costs for Saviynt?
Saviynt is very affordable compared to its competitors. It is cloud-based, making it significantly cheaper than on-premises solutions. This cost-effectiveness aligns well with the Saudi market, whe...
What needs improvement with Saviynt?
One area for improvement is Saviynt's training platform. They could enhance their training arrangements for partners and build a stronger partnership environment. When discussing Azure or AWS-relat...
 

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
No data available
 

Overview

 

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Shell, McKesson, Kimberly-Clark, Ingram Micro, Intermountain Health Care, Forterra, CoreLogic
Find out what your peers are saying about Microsoft Defender for Identity vs. Saviynt and other solutions. Updated: September 2025.
868,759 professionals have used our research since 2012.