Is Microsoft Defender for Identity included in Microsoft 365 E5?

Yes. Microsoft's deployment prerequisites list Microsoft 365 E5 (E5, A5, G5), Enterprise Mobility + Security E5, Microsoft 365 E5, A5, G5 or F5 Security, and Microsoft 365 F5 Security + Compliance as qualifying licenses, and the sensor v2.x prerequisites page also lists a standalone Defender for Identity license. If you already hold one of those suites, the marginal cost is deployment and tuning effort rather than a new line item.

How much does CrowdStrike Falcon Identity Protection cost?

CrowdStrike does not publish a standalone price. As checked on 5 November 2026, its pricing page lists Identity Protection among the modules shown with the Falcon Go, Pro and Enterprise bundles without a separate price, and lists Next-Gen Identity Security as an add-on for Falcon Complete. Treat it as quote-based and confirm in writing whether it is included or an add-on in your bundle.

Did the SGNL acquisition change Falcon Identity Protection?

It expanded CrowdStrike's identity roadmap. CrowdStrike announced its agreement to acquire SGNL on 8 January 2026 and the deal closed on 20 February 2026, per CrowdStrike's fiscal 2026 10-K, which records about 628 million dollars of cash consideration net of cash acquired plus about 9 million dollars of replacement awards. SGNL brings continuous access evaluation and just-in-time authorization. Ask CrowdStrike which SGNL capabilities are generally available in Falcon today versus on the roadmap.

Can I run CrowdStrike Falcon and Defender for Identity together?

Yes, and many estates do during an evaluation. The Defender for Identity sensor v3.x requires the server to be onboarded to Defender for Endpoint, but Microsoft states the Defender Antivirus component can be in active or passive mode, so a domain controller protected by Falcon can still run the v3.x sensor with Defender Antivirus passive. Microsoft also documents a v3.x onboarding path without a Defender for Endpoint deployment for eligible servers.

CrowdStrike Falcon Identity Protection vs Microsoft Defender

CrowdStrike Falcon Identity Protection vs Microsoft Defender for Identity

CapabilityCrowdStrike Falcon Identity ProtectionMicrosoft Defender for Identity

Overall

4.3

4.1

Authentication: 3.5; 3.0
SSO & Federation: 3.0; 3.0
Authorization: 4.0; 3.5
Lifecycle & Provisioning: 2.5; 2.5
MFA & Passwordless: 3.5; 3.0
Governance & Audit: 4.0; 4.0
Developer Experience: 3.0; 3.0
Deployment Flexibility: 3.5; 3.5
Pricing Transparency: 2.5; 3.0
Support & Ecosystem: 4.5; 4.5

Scored 0–5 against a published rubric. Bold marks the higher score. Independent analysis, no vendor sponsorship.

At a glance

Pick the one that matches the security platform your SOC already lives in. CrowdStrike Falcon Identity Protection is a module of the Falcon platform that correlates identity threat detection with endpoint and cloud telemetry and can force step-up MFA in real time. Microsoft Defender for Identity (formerly Azure ATP) is native to Defender XDR, watches Active Directory and its supporting identity servers, and is already paid for if you hold Microsoft 365 E5. Neither does automated AD forest recovery, which both profiles flag; that is a Semperis conversation.

Where each wins

Decision factor	Falcon Identity Protection	Defender for Identity
You already run Falcon EDR	Wins: one agent, one console	Second console to staff
You already hold Microsoft 365 E5	Extra spend	Wins: license already owned
Identity providers in scope	AD, Entra ID and Okta per CrowdStrike	Microsoft directory focus
Real-time enforcement	Wins: risk-based MFA or password reset	Detection-led; disable-account and reset-password actions
SOC tooling	Falcon console	Wins if you run Defender XDR and Sentinel
Continuous authorization roadmap	SGNL acquisition (below)	No comparable acquisition

Pricing reality (checked 2026-11-05)

Microsoft's sensor prerequisites list the qualifying licenses: EMS E5/A5, Microsoft 365 E5/A5/G5, Microsoft 365 E5/A5/G5/F5 Security, Microsoft 365 F5 Security + Compliance, or a standalone Defender for Identity license. For an E5 shop it is effectively free; for everyone else, price the suite you would need, not the component.

CrowdStrike publishes no standalone identity price. Its pricing page lists Identity Protection among the modules shown with Falcon Go ($59.99 per device per year), Pro ($99.99) and Enterprise ($184.99), without saying whether it is included or extra, and lists Next-Gen Identity Security as an add-on to Falcon Complete. Treat it as quote-based, as our profile does, and get the inclusion in writing. Model both with the TCO calculator.

Ownership changes

CrowdStrike agreed to buy SGNL on 8 January 2026 and closed it on 20 February 2026. Its fiscal 2026 10-K records $627.9 million in cash net of cash acquired plus $8.9 million of replacement awards; CEO George Kurtz had cited about $740 million at announcement. SGNL adds CAEP-based continuous evaluation and just-in-time access. Ask which parts ship in Falcon today. Defender for Identity has had no ownership change.

Deployment and architecture

Both are SaaS backends fed by sensors on your identity servers. Defender for Identity's sensor v3.x runs on domain controllers and on AD FS, AD CS and Entra Connect servers (non-DC activation is in preview), needs Windows Server 2019 or later with the September 2026 cumulative update, rides on Defender for Endpoint onboarding, and caps itself at 30% CPU and 1.5 GB of memory. It runs as LocalSystem, so the directory service account that v2.x needed goes away. Older DCs stay on v2.x. CrowdStrike sells "one platform, one agent", extending the Falcon sensor you already run.

Both profiles credit solid coverage of the classic AD attacks, such as Kerberoasting, credential theft over NTLM and Kerberos, and lateral movement. Microsoft also puts sensors on AD CS, which matters for certificate template abuse.

Migration notes

You do not have to cut over. The v3.x sensor accepts Defender Antivirus in passive mode, so Falcon-protected DCs can run both during a bake-off. Run them side by side for a few weeks, replay the same attack simulations against each, and compare alert fidelity and time to enforcement. Migrating to v3.x within Microsoft means switching action accounts to LocalSystem first and removing leftover gMSA configuration once all v2.x sensors are gone.

Who should pick which

Choose Falcon Identity Protection if Falcon is your EDR, you have Okta alongside AD, and you want enforcement, not only alerts. Choose Defender for Identity if you hold E5, your SOC works in Defender XDR and Sentinel, and AD is the core risk. If you are neither, compare the specialists: Silverfort vs Semperis, the ITDR buyer guide and the best ITDR tools.

Frequently asked questions

Is Microsoft Defender for Identity included in Microsoft 365 E5?: Yes. Microsoft's deployment prerequisites list Microsoft 365 E5 (E5, A5, G5), Enterprise Mobility + Security E5, Microsoft 365 E5, A5, G5 or F5 Security, and Microsoft 365 F5 Security + Compliance as qualifying licenses, and the sensor v2.x prerequisites page also lists a standalone Defender for Identity license. If you already hold one of those suites, the marginal cost is deployment and tuning effort rather than a new line item.
How much does CrowdStrike Falcon Identity Protection cost?: CrowdStrike does not publish a standalone price. As checked on 5 November 2026, its pricing page lists Identity Protection among the modules shown with the Falcon Go, Pro and Enterprise bundles without a separate price, and lists Next-Gen Identity Security as an add-on for Falcon Complete. Treat it as quote-based and confirm in writing whether it is included or an add-on in your bundle.
Did the SGNL acquisition change Falcon Identity Protection?: It expanded CrowdStrike's identity roadmap. CrowdStrike announced its agreement to acquire SGNL on 8 January 2026 and the deal closed on 20 February 2026, per CrowdStrike's fiscal 2026 10-K, which records about 628 million dollars of cash consideration net of cash acquired plus about 9 million dollars of replacement awards. SGNL brings continuous access evaluation and just-in-time authorization. Ask CrowdStrike which SGNL capabilities are generally available in Falcon today versus on the roadmap.
Can I run CrowdStrike Falcon and Defender for Identity together?: Yes, and many estates do during an evaluation. The Defender for Identity sensor v3.x requires the server to be onboarded to Defender for Endpoint, but Microsoft states the Defender Antivirus component can be in active or passive mode, so a domain controller protected by Falcon can still run the v3.x sensor with Defender Antivirus passive. Microsoft also documents a v3.x onboarding path without a Defender for Endpoint deployment for eligible servers.

Last updated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.