MDI Sensor install question

Question

Hi,
One of our customers has experienced brute force attack on their 2 DCs and wants to get more details on these malicious activities (which they believe should be internal). They want to install sensor on each of the 2 DCs.&nbsp;
Customer has EMS E5, in term of license, just one E5 license will be sufficient to install sensors and to monitor those 2 DCs?

elieelkarkafi · Answer

FranckW&nbsp;Microsoft Defender for Identity is a per user subscription license. Means each user needs a license to profit from the MDI benefits&nbsp;
&nbsp;
https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance#microsoft-defender-for-identity
&nbsp;
Defender for Identity is available as part of Enterprise Mobility + Security 5 suite (EMS E5), and as a standalone license. mean if your users have this license,&nbsp;they can profit for MDI features.&nbsp;
&nbsp;
https://learn.microsoft.com/en-us/defender-for-identity/technical-faq#where-can-i-get-a-license-for-microsoft-defender-for-identity
&nbsp;

franckw · Answer

Thanks Elie for the quick update.The customer has E5 (but not for all users). Their hope is to collect more information on the activities of their 2 DCs by installing the sensor since they suppose the attacks came from internal identities. In order to achieve this, how many licenses do they need?

elieelkarkafi · Answer

if they have Enterprise mobility + Security 5 for the other users they can profit from MDI. each user needs to have a license that include MDI feature , its per user license and not related to the number of sensors

Forum Discussion

MDI Sensor install question

3 Replies

Resources