Microsoft Defender for Identity

Overview

Microsoft Defender for Identity (formerly Azure ATP) is Microsoft's ITDR offering for on-premises Active Directory and Entra ID. It uses sensors on domain controllers to detect reconnaissance, credential theft, lateral movement, and domain dominance, feeding those signals into the Defender XDR ecosystem. See the ITDR category and the best ITDR tools.

What it is good at

Integration and the price of entry are the strengths. For organizations already on Microsoft 365 E5, the detection is included, and correlation across endpoints, email, and identity inside Defender XDR is hard to match without buying separate tools. Coverage of classic AD attack techniques is solid, analyst workflows tie into Sentinel cleanly, and the Microsoft support and ecosystem are extensive.

Where it falls short

It is Microsoft-directory focused, so non-Microsoft identity providers fall outside its lens, and it leans toward detection over response and recovery, with no automated forest rebuild. Specialist vendors often catch attacks earlier and offer deeper remediation. Sensor deployment and tuning across many domain controllers takes planning, and the best value comes from already holding an E5-class license, even though a standalone license exists.

Pricing

Included in Microsoft 365 E5, Microsoft 365 E5 Security, EMS E5 and the F5 Security bundles, and also sold as a standalone Defender for Identity license, per Microsoft's sensor licensing requirements (checked 2026-11-05). Licenses are bought through the Microsoft 365 portal or a Cloud Solution Provider. Most buyers get it inside a bundle, which makes it effectively free if you already hold the license and a meaningful add-on cost if you do not. Model the full E5 commitment, not just this component, with the TCO calculator.

Best for, and who should look elsewhere

Choose Defender for Identity if you are an E5 customer running Active Directory and want identity detection inside Defender XDR. For the security-vendor-led alternative, compare CrowdStrike Falcon Identity vs Microsoft Defender for Identity; for AD recovery, see Semperis; for agentless protocol coverage, see Silverfort.

Bottom line

A practical default for E5 customers with Active Directory who want identity detection inside Defender XDR, and less suited to multi-IdP estates or teams needing recovery.