Forum Discussion

Microsoft

Oct 04, 2023

MDI Sensor install question

Hi, One of our customers has experienced brute force attack on their 2 DCs and wants to get more details on these malicious activities (which they believe should be internal). They want to install ...

Sensor

elieelkarkafi

MVP

Oct 04, 2023

FranckW Microsoft Defender for Identity is a per user subscription license. Means each user needs a license to profit from the MDI benefits

https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-defender-for-identity

Defender for Identity is available as part of Enterprise Mobility + Security 5 suite (EMS E5), and as a standalone license. mean if your users have this license, they can profit for MDI features.

https://learn.microsoft.com/en-us/defender-for-identity/technical-faq#where-can-i-get-a-license-for-microsoft-defender-for-identity

FranckW

Microsoft

Oct 04, 2023

Thanks Elie for the quick update.
The customer has E5 (but not for all users). Their hope is to collect more information on the activities of their 2 DCs by installing the sensor since they suppose the attacks came from internal identities. In order to achieve this, how many licenses do they need?

elieelkarkafi
MVP
Oct 04, 2023
if they have Enterprise mobility + Security 5 for the other users they can profit from MDI. each user needs to have a license that include MDI feature , its per user license and not related to the number of sensors