Microsoft Defender for Identity

Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages your on-premises Active Directory (AD) signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. Formerly known as Azure Advanced Threat Protection (ATP), MDI is part of the Microsoft 365 Defender suite and integrates tightly with Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Sentinel.

Traditional perimeter-based security is ineffective against modern attacks that use legitimate credentials. Attackers often compromise a single user account, then move laterally across the network to gain access to high-value targets. MDI addresses this by monitoring authentication events, entity behavior, and network traffic to detect suspicious activities that indicate an attack in progress. It provides a continuous cycle of detection, investigation, and response.

MDI operates through a combination of sensors, machine learning, and behavioral analytics.

1. Sensors and Data Collection

MDI uses sensors installed on domain controllers (DCs) to capture network traffic, Windows Event logs, and AD data. The sensor can be installed directly on the DC or as a standalone sensor that receives port mirroring traffic. It collects:

2. Data Processing and Analysis

Collected data is sent to the MDI cloud service via encrypted HTTPS (port 443). The cloud service performs: - Behavioral baseline learning: Over a period (typically 2-3 weeks), MDI learns normal behavior for each user, device, and resource. This includes login times, locations, accessed resources, and typical protocols used. - Machine learning models: MDI uses supervised and unsupervised ML to detect anomalies. For example, a model might detect a user logging in from a new geographic location that is inconsistent with their travel history. - Threat intelligence: MDI correlates detected activities with Microsoft's global threat intelligence to identify known attack patterns (e.g., Pass-the-Hash, Golden Ticket, DCSync).

3. Detection Types

MDI generates alerts for various suspicious activities: - Malicious attacks: e.g., DCSync, Pass-the-Ticket, Overpass-the-Hash, Golden Ticket, Silver Ticket, Skeleton Key. - Abnormal behavior: e.g., unusual logon failures, impossible travel (a user logging in from two distant locations within an impossible timeframe), unusual service creation. - Security misconfigurations: e.g., weak Kerberos encryption, LDAP cleartext binding.

4. Investigation and Response

Alerts are surfaced in the Microsoft 365 Defender portal (security.microsoft.com). Security analysts can:

Installing the sensor via PowerShell:

# Download the sensor from Microsoft 365 Defender portal
# Run the installer silently
msiexec /i "MDISensorSetup.exe" /q ACCESS_KEY="<your-access-key>"

Verify sensor status:

In the portal, navigate to Settings > Identities > Sensors. Check that the sensor shows as Healthy. Also verify that the sensor can communicate by checking the following registry key:

HKLM\SOFTWARE\Microsoft\Azure Advanced Threat Protection\Sensor\Status

Value 1 indicates healthy.

Check event logs:

# Check for sensor errors in Event Viewer
Get-WinEvent -LogName "Microsoft-Windows-AzureADIdentityProtection/Operational" | Where-Object { $_.Level -eq 2 }

A financial services company with 10,000 employees and 50 domain controllers deploys MDI to detect credential theft. An attacker phishes a junior accountant, steals their credentials, and uses them to log into a file server. MDI detects this as unusual because the accountant never accesses the file server. The attacker then attempts to dump credentials via LSASS on a domain controller. MDI's lateral movement detection triggers a high-severity alert. The security team investigates and finds the compromised account, resets the password, and blocks the attacker's IP. The incident is contained within 30 minutes. Without MDI, the attacker might have escalated to Domain Admin and caused a breach.

A healthcare organization uses MDI to protect its on-premises AD. An attacker with compromised Domain Admin credentials attempts a DCSync attack to replicate all password hashes. MDI detects the unusual replication request (non-standard replication behavior) and triggers a 'Directory Service Replication' alert. The security team immediately isolates the domain controller and resets the krbtgt account password twice (to invalidate any Golden Tickets). MDI's alert provided early warning, preventing a full compromise.