We performed a comparison between Microsoft Defender for Identity and SentinelOne Singularity Identity based on real PeerSpot user reviews.
Find out in this report how the two Advanced Threat Protection (ATP) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The feature I like the most about Defender for Identity is the entity tags. They give you the ability to identify sensitive accounts, devices, and groups. You also have honeytoken entities, which are devices that are identified as "bait" for fraudulent actors."
"Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence."
"The solution offers excellent visibility into threats."
"The most valuable aspect is its connection to Microsoft Sentinel and Defender for Endpoint, and giving exact timelines for incidents and when certain events occured during an incident."
"Defender for Identity has not affected the end-user experience."
"The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud."
"The feature I like most is that you can create your own customized detection rules. It has a lot of default alerts and rules, but you can customize them according to your business needs."
"This solution has advanced a lot over the last few years."
"The incident and threat logs are great."
"The biggest value for us is getting a much better picture of what our risks are."
"One of the top things we're interested in is cloud protection."
"Behind the scenes, SentinelOne has real people who evaluate problems and mark them as false positives. That's what I find most helpful."
"They have different levels of support. We have the highest level where they are constantly checking all the endpoints. If at any certain point, they identify that a computer has been triggered by a virus, a link, or something else, they would automatically tell us that within 15 seconds. If they notice something, they automatically send us an email saying that they noticed something in the computer, and they are going to block it."
"The threat detection capability is the most valuable feature."
"The XDR capabilities are very good."
"SentinelOne Singularity Identity is very lightweight as an agent or software."
"One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents."
"When the data leaves the cloud, there are security issues."
"The tracking instance needs to be configured appropriately."
"Microsoft should look at what competing vendors like CrowdStrike and Broadcom are doing and incorporate those features into Sentinel and Defender. At the same time, I think the intelligence inside the product is improving fast. They should incorporate more zero-trust and hybrid trust approaches. They need to build up threat intelligence based on threats and methods used in attacks on other companies."
"An area for improvement is the administrative interface. It's basic compared to other administrative centers. They could make it more user-friendly and easier to navigate."
"We observe a lot of false positives. Sometimes, when we go for a coffee break, we lock our screens. Locking the screen has a separate Windows event ID and sometimes I see it is detected as a failed login."
"There is no option to remedy an issue directly from the console. If we see an alert, we can't fix it from the console. Instead, we must depend on other Microsoft products, such as MDE. That is a significant drawback. It simply works as a scanner, which can sometimes put enough load on the sensors. Immediate actions should be possible from the dashboard because. It can prevent issues from spreading further."
"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."
"The primary reason for this discontent is that we frequently encounter performance issues with our servers."
"Sometimes I get kicked out of the console. I don't know why."
"SentinelOne Singularity Identity could be more user-friendly."
"I don't like SentinelOne's reporting tools. Their reports seem fine theoretically, but the issue is the sample size. For example, it will report that there were four incidents, and that equals 25 percent fewer incidents compared to the previous months. It would be a great improvement if I could expand the range to see reports for the last six months, but it's always one month. That would be an easy thing for them to resolve."
"The root cause of automation could be better."
"The policies could be more precise, and Singularity should use more templates like alternative solutions have. Endpoint management is poor. We cannot manage individual endpoints and must rely on policies, exclusions, or block lists to apply settings to a group instead of the individual agent. If I have to make settings for one computer, I need to create a group, apply the configuration, and move the agent there. It's challenging to manage endpoints that way."
"We haven't received the expected support whenever we've had questions."
"The UI can be more user-friendly."
More Microsoft Defender for Identity Pricing and Cost Advice →
More SentinelOne Singularity Identity Pricing and Cost Advice →
Microsoft Defender for Identity is ranked 6th in Advanced Threat Protection (ATP) with 13 reviews while SentinelOne Singularity Identity is ranked 12th in Advanced Threat Protection (ATP) with 14 reviews. Microsoft Defender for Identity is rated 9.0, while SentinelOne Singularity Identity is rated 8.6. The top reviewer of Microsoft Defender for Identity writes "Offers robust protection from insider threats, but the customer support is poor". On the other hand, the top reviewer of SentinelOne Singularity Identity writes "It offers deep and continuous visibility into our attack surface". Microsoft Defender for Identity is most compared with Microsoft Entra ID Protection, Microsoft Defender for Office 365, Microsoft Entra Verified ID, Splunk User Behavior Analytics and Varonis Datalert, whereas SentinelOne Singularity Identity is most compared with Qualys VMDR, Tenable Vulnerability Management, Microsoft Defender for Office 365, SailPoint IdentityIQ and Claroty Platform. See our Microsoft Defender for Identity vs. SentinelOne Singularity Identity report.
See our list of best Advanced Threat Protection (ATP) vendors and best Identity Threat Detection and Response (ITDR) vendors.
We monitor all Advanced Threat Protection (ATP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
