Microsoft Defender for Identity Reviews

Defender for Identity is mainly a monitoring tool for Active Directory activity. Active Directory logs are fixed into Defender for Identity and it has its own core rules. Based on those rules, it gives us an alert if any suspicious activity is going on in Active Directory.

Many organizations are using the Microsoft Windows operating system. Whenever users log in to their systems, all the login activity, the credentials et cetera, are managed by Active Directory. If suspicious login activity happens in that system, everything is logged and the logs are saved by the Defender for Identity. Based on the correlation rules and AI technology, it gives us alerts, such as brute-force and honey-token-related alerts, or login activity after office hours, or successful login after three consecutive login failures.

It helps our organization protect employee access and prevent anyone from outside of the organization from accessing our systems. It is very important for securing our organization's endpoints, our laptops and servers. No unauthorized person can access an endpoint or enter our assets. It is also very helpful for preventing DDoS alerts, brute-force alerts, and other Active Directory-related threats.

The feature I like most is that you can create your own customized detection rules. It has a lot of default alerts and rules, but you can customize them according to your business needs. For example, we have a prevention mechanism through a policy where, if anyone tries to access something and gives the wrong credentials three times, that account will automatically be deactivated for the next half hour.

Also, you can integrate Defender for Identity with any SIEM platform, like Splunk, QRadar, and all top SIEMs, and create your own dashboards and reports to identify any suspicious activity. It's also very user-friendly, UI-wise. Anyone can understand it. We integrated it with Splunk, which is a big analytics tool.

Visibility-wise, it's also quite useful. And if you want to enhance something based on your requirements, you can raise a ticket with the Microsoft team and they will review and implement it. That flexibility makes Microsoft very helpful to its clients.

In addition, there is only one dashboard where we get the alerts. They come in as low, medium, or high priority.

We observe a lot of false positives. Sometimes, when we go for a coffee break, we lock our screens. Locking the screen has a separate Windows event ID and sometimes I see it is detected as a failed login. The number of false positives needs to be improved. With the separate event ID for a locked screen, we have to segregate the event ID and correlate everything properly so that we can identify it as a false positive.

I have been working with Microsoft Defender for Identity for the last four years.

It has never failed and it's never down. It's very stable.

The scalability is very good. In our organization we have almost 10,000 associates and that means we have about 10,000 endpoints, including 3,000 servers.

We have contacted their support several times, not only for Defender for Identity, due to false positives, but also for some other solutions. There is some delay in response, it's not an immediate reply. They will take one or two days to reply, based on the priority.

Neutral

It's not very complicated to deploy, although we were not involved. It was deployed by Microsoft. We just provided the Active Directory server details and they integrated it. It took about one week to fully deploy it, and there were three people involved.

There is no maintenance required on our side. Everything is done by the vendor, including all the security patches. It is a cloud-based security solution, it's not on-premises, so we don't need to manage anything on our side. Everything, all the patches and all the application upgrades, happen automatically.

You need to understand why this product is important and why it is required in your organization. What are the benefits? You have to identify that first. If you don't understand the requirements or the benefits, you will not get the proper answers. You have to evaluate your security design and identify the importance of Active Directory logs and Active Directory protection.

You also have to ensure your Active Directory policies are well maintained and monitor your Active Directory logs as well.

If I could choose between a single security vendor or having multiple vendors, I would always prefer a multi-vendor approach. A single vendor only has a single source of threat intelligence, but if you want to protect your organization, and the budget permits, you should have multiple security sources.

No one can say they are 100 percent secure, even after you put a lot of security devices in place and have done everything. Security devices are based on predefined rules or behavioral-based analysis or IOC-based. They have the intelligence to detect possible threats, but there are limitations. There are known and unknown threats. But with Defender for Identity, over the last five years, I have not observed any vulnerabilities. Several breaches have happened in our organization, but there have been no major breaches. There have been no ransomware or security events in that time. Everything has been detected. Sometimes we get false positives, but we notify Microsoft that those are not malicious files and they can be whitelisted. Defender is very good at detecting any abnormal behavior or malicious files.

We are looking at this solution as a trusted tenant for our network.

This way, all of the data that goes through is trusted and the communication between our on-prem system and the Azure Cloud remains protected. Our only concern is when the data leaves the Azure Cloud and goes to another third-party tenant.

Azure is our trusted tenant — we trust it. We're just concerned about the data when it leaves Azure and goes to another third-party tenant. For example, if you have a SaaS solution, like Salesforce, sometimes they send data to customers. In order to do this, the data has to leave the trusted cloud tenant. 

We like the Active Directory Federation feature. We use it a lot with the Microsoft Azure Cloud.

When the data leaves the cloud, there are security issues. 

The cloud security services and the integration with on-prem applications like SIEM, needs to be improved.

We have been using this solution for roughly two years.

Microsoft Defender for Identity is very stable.

As it's a cloud application, there are no issues with scalability.

I've never had to deal with support regarding this solution; however, overall, Microsoft's support is quite good.

I was not involved in the initial setup, but I think Microsoft has a good team that can help you set it up. I believe the initial setup went very well.

Microsoft is a big company. They have put a lot of effort into their cloud solutions. They're the way of the future. They have done a lot to catch up with what Amazon did.

This solution has advanced a lot over the last few years. It integrates very well with Office 365. For this reason, I think it's the way of the future.

Overall, on a scale from one to ten, I would give this solution a rating of eight.

The solution provides alerts when malicious actors are active and that's something most companies are missing. Quite often, malicious actors do reconnaissance for weeks, months, and on their checkout. They get a sense of the whole environment before they execute a ransomware attack. This sensor will alert users if something like that happens and it gives you time to mitigate the issues or block the attacker.

It gives companies a lot of insights that they didn't have before. It has increased the security posture significantly.

The feature that I most like is that it integrates with the other Defender components. Defender Identity is part of Microsoft 365, and there is Defender for Office 365, Defender for endpoints, and cloud edge security. These tools integrate really well together. The integration with the other tools makes it a comprehensive tool that I would recommend to any company.

It measures your identity security. For example, let's say a lot of companies don't have a proper decommissioning process for global admins or domain admins. And so, when an administrator who has built many privileges leaves the company, the account gets disabled and it still has members of domain admin groups or sensitive groups. This will highlight them and alert users to say, in a sense, "hey, these users or to these user accounts of sensitive privileges, but haven't been used for a long period of time". The few times I've created this report and showed this to customers, they're shocked due to the fact that it's an easy entry for malicious actors that they weren't aware of. That's one of the cool features.

Defender for Identity has not affected the end-user experience.

The solution could be better at using group-managed access and they could replace it with broad-based access controls.

I've worked with the solution since June of last year. I've worked with it across three organizations so far.

I have never seen any issues. The solution appears to be stable. 

Scalability is not applicable in this case.

In terms of users, there will be cloud engineers or security analysts, security engineers, and those types of people.

Normally the tech support is pretty responsive and they understand the tool.

Our organization did not previously use a different solution.

I've used the solution within three organizations. Two I have implemented myself and the third was implemented by someone else entirely.

The initial setup is straightforward, however, because it needs to communicate between the domain controller and Microsoft cloud, which can cause issues if there are firewalls. Normally, domain controllers don't have access to the internet, or at least, that's what's recommended. Installing the tool itself is not hard, however, the firewalls make the process harder.

There are a bunch of URLs that you have to whitelist on the firewalls and you could set up a transparent proxy.

Installing one takes five minutes at a maximum and you need to times that by the number of domain controllers you have. I recall that, in our case, some domain controllers were not up to speed. Their memory CPU utilization was not big enough to handle the load of the network traffic scanning. Therefore, before you install it on the domain controller, the recommendation is to run a tool to see if your domain controllers are capable to handle the sensors. That's something to note for other users considering an installation.

I didn't create an implementation strategy. It's a pretty straightforward tool. You just install it on all the main controllers and then integrate it with all the other Defender components. It's not really a strategy. The only thing to note is if you deal with a security team, they always say that there's already an endpoint protection solution on the domain controller. However, this is different, and this works side-by-side with whatever already exists. Other than that, there's not really a strategy.

For deployment and maintenance, one person would be enough and they would not even have to be full-time as it's a cloud solution. Microsoft does all the maintenance of the backend of the infrastructure and the only thing you have to make sure of is that the sensors are healthy on the domain controllers. That's the only thing you have to do. It's not too much effort.

This tool I install for customers as I am a consultant. When I say, I've got experience, it's not purely for our company as we are an IT company and we consult with customers. I didn't use a third party. I'll typically do it with one of my colleagues.

We have not looked at the ROI of Defender.

In terms of the pricing, I don't know off the top of my head the cost, however, it's part of Microsoft 365. It is an EMS-5, an Enterprise Mobility and Security Suite.

It's my understanding that there are no extra costs beyond the standard licensing fee.

I do not recall looking at other options before implementing Defender. 

I'm an integrator and consultant.

With the current versions I'm working on, I clarified today that it was up to date. Whatever the latest version is, is the one I am working on. I don't keep track of the version numbers.

It's a cloud-based solution. No on-premise components are required.

I'd rate the solution at a nine out of ten.

I'd advise new users to check their firewalls and make sure they whitelist them, alongside the appropriate URLs. Make sure to enlist a tool to measure if the center can run on your domain controller as well.

Any company should have this tool or a similar tool to it. It's very important to understand if there is a malicious actor in the environment. You can't live without this tool like this in this day and age.

Our use case is for the securing of the on-premise active directory, but also to correlate the on-premise active directory security information with the Defender for Endpoint ADP integration. That's most of my use cases, the protection of online AD, but the additional information that it gives regarding the incidents as they occur and possible lateral escalation of privileges for the workstation are also use cases. 

We're using Azure AD in combination with on-premise AD. 

The basic security monitoring at its core feature is the most valuable aspect. But also the investigative parts, the historical logging of events over the network are extremely interesting because it gives an in-depth insight into the history of account activity that is really easy to read, easy to follow, and easy to export.

It's provided a simple identification of issues of account abuse. It showed some configuration mistakes. One of the features that it also has is privilege escalation. So it has a feature where you can look into lateral movement parts, and it has a great graphing feature that shows you what kind of lateral movement risks are associated with certain accounts.

Integrating with the Microsoft Cloud Application Security, you get a tab called Identity Security Posture, where it provides a list of best practices, improvements, things that it has found based on the actual data that it received. One of the things that was interesting, is that two to three months ago, Microsoft had a massive issue with their print spoolers and suddenly the advice came worldwide. The first thing you did was disable the print spooler on the main controllers. This has always been a best practice for Microsoft services, just never clearly communicated. But this feature, this best practice was already clearly visible within the Identity Security Posture from MDI. So we already mitigated this weakness because of the recommendations that the application gave.

It displays, for instance, a clear tax credential exposure. One of the things that you have a lot within enterprise applications is that a lot of third-party applications communicate via LDAP to active directory. Currently one of the weak points there is that the typical LDAP communication is communicating over LDAP and not over LDAP secure. So it's unencrypted, which means that you get plain text passwords over your networks. And this MDI is able to identify those applications as well and say that the endpoints communicating with MDI need to be secure. They should be secured.

It would be good if Defender for Identity would further align the Azure ID with the on-premise experience. Because those still seem to be two different worlds. 

The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved.

I have been using Microsoft Defender since its inception. I've been using it before it was called MDI, around three years ago. 

Stability is great, it's been improved quite a bit. In the beginning, we had some occasional restarts of sensors on the domain controllers, but stability itself right now is great. We adjusted some performance on the main controllers, made sure that we have enough CPU and memory, especially taking a good look at the exact memory requirements. That's definitely something not to underestimate. If you go under memory requirements, you might hit upon an issue where the sensor tends to restart occasionally.

Scalability is great. In an enterprise network with 22,500 workstations, 15 domain controllers, give a give or take, it's easily scaling out. Especially since you deploy it, it's really scaling out on a per sensor basis. So if you ever added a main controller, you just need to factor a sensor in and that's it.

I have it currently deployed in Europe and in the short term, I have plans to deploy it in several other of our areas, such as the United States and South America, and I am also advising our Japanese headquarters to follow the same.

Technical support depends. If you get directly in contact with the core support team from the product, it is very, very good. But since it is from Microsoft's perspective, sometimes it seems like an additional, niche product that not everybody's even aware of. So sometimes it's hard to get in contact with the right support group. But once you have the right support group, then things generally work out very well.

It can take a bit, but once you get there, you get really excellent support.

Positive

I previously used several other solutions. Some of them are still actually in place because there are some differences in functionality and feature sets. 

The initial setup was extremely simple. You go to the portal, you download the clients, retrieve the key, you install the clients on the main controllers input key and things start working. The deployment is a matter of minutes to two hours, depending, of course, on the impact on the amount of the main control it needs to configure.

We had to investigate the impact on the main controllers. Of course, we started carefully, but after an evaluation period of two to three weeks, on a handful of the main controllers, it was within a month. It was deployed on all the main controllers.

We only needed two people, and several man-hours, for the initial setup. It starts to study the behavior of the activity on the network. So for the first 30 days, it doesn't do much. Then you start to get some alerts. It just really depends on your configuration, how active your environment is, based on what sort of threats you might have going on on the radar that you weren't aware of.

Once it is actually running and you focus on the core alert functionality, that is just part of the normal security operations procedure. It hardly ever gives false positives. So the moment you get something, you really should act on that sound. That of course depends on the nature of the threat. But I don't think that says anything about the maintenance that you need to do for MDI. That's more about the actual events that are going on. So MDI is very low maintenance. It can alert you on some very high maintenance incidents though.

Initially, we had an investigative call with Microsoft. They offered to use a third party to assist with the installation. But when we went over the whole configuration that was required, we decided just to do it on our own. No regards to getting help.

Our RPO is seen in its prevention of incidents and even faster resolution of security incidents mostly.

There are no additional costs to standard licensing. You get an infinite amount of the directory sensors that you can deploy. It integrates directly into the security portal from Microsoft and in the cloud application security, you get cloud login. 

I'm also a social security specialist. One of the things that we do is run our own sensors and our own logging on active directory controllers. And we analyze that in an elastic stack. Basically, you spend a lot of time getting dedicated to the monitoring configuration active directory. We capture a little bit more than what MDI is capturing, but that is only really for fringe cases that we ever need, to really see that in the eyes a very user-friendly application for people to see what is happening on your network. And you don't have to be escalating specialists to see that somebody accessed a server at one time and then logged on to the following computer. I think that for a defensive view, it can give most administrators absolutely amazing insight into what's happening in the network that they probably never had before.

There is much more going on that you're generally aware of. I'm really quite a fan of this tool because it gives such great insights, such great historical logging.

I would rate it a nine out of ten. 

It's sometimes represented in an over-complicated way because it's really just such a simple tool to use that it's also giving non-IT security experts such great insight. And it's not just for the alerts, but also just for the needs of the logging and all the typical configuration mistakes that you do. I think it's just a really great tool.

Our use case is endpoint detection and response (EDR). 

You can integrate Microsoft Defender with other solutions. 

It gives you a holistic view of everything happening in your organization.

You can use it to do a lot of monitoring.

The most valuable features are ETL, lab, and monitoring.

I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead.

I have been using it for three years.

It is quite stable. There are incidents from time to time, which can affect any platform. This affects in different regions or locations within Canada or even Africa. Sometimes users complain and we get a service request that we check to determine if there is an incident. 

When there are issues, sometimes the issue is clear by itself, and other times, I contact Microsoft technical support. Most times, the technical support provides a workaround. My experience with their technical support has been excellent.

Positive

We also use Kaspersky and other solutions, but all these solutions integrate with Azure, Microsoft Defender, or Microsoft 365. They don't really work on their own.

It is easy to set up. Based on the number of devices you would like to set up, you can use scripts, Group Policy, etc.

It takes five minutes to set up.

You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency.

The package has a lot of features. We just want email and calendar only. This is the standard plan. However, if you want something which extends the product's features, you can get Microsoft business.

I would rate the solution as nine out of 10.