Defender for Identity collects and stores information from your configured servers. Information collected includes network traffic to and from domain controllers (such as Kerberos authentication, NTLM authentication, DNS queries), security logs (such as Windows security events), Active Directory information (structure, subnets, sites), and entity information (such as names, email addresses, and phone numbers). Defender for Identity now does not have visibility to queries of LDAPS connections. We recently added the ability to gather the LDAP queries done via Active Directory Web Services. We are also looking at a method to see the encrypted traffic from pure LDAPS. https://docs.microsoft.com/en-us/defender-for-identity/whats-new#defender-for-identity-release-2180