Microsoft Defender for Identity Experiences in Microsoft 365 Defender

Published 06-07-2021 10:45 AM 1,841 Views

Microsoft Defender for Identity is a cloud-based security solution that leverages on-premises Active Directory (AD) signals to protect on-premises identities, detect and investigate lateral movement of on-premises attacks, and identify compromised identities and malicious insiders.  



We have exciting news to share!


Microsoft Defender for Identity’s features are in the process of being made available as part of Microsoft 365 Defender, accessible through 


Following similar work done by the Defender for Endpoint and Defender for Office 365 teams, Defender for Identity will start making features available as part of Microsoft 365 Defender. This means all your Microsoft 365 Defender products will be in one location, simplifying administration and making life easier for administrators, SecOps analysts, and threat hunters.


This blog series will be the source of truth to keep you on track on which Defender for Identity features are available as part of Microsoft 365 Defender and which features will be soon released. You can always come to the latest entry in this blog series by heading to We’ll also reference any of the previous entries in the series any time we post a new update.

We recommend that customers start using these features in the Microsoft 365 security center ( as and when they are available in public preview. In addition to Defender for Identity features, you will have the ability to use unique Microsoft 365 Defender features such as advanced hunting, incident correlation, and custom detection rules.


These all benefit from having Defender for Identity data contributing to them, providing customers with the unique lens of on-premises identity to their threat hunting capabilities.


We’ll populate the table below with the latest features that land in Microsoft 365 Defender, along with any documentation that’s been released to support it. We normally announce these releases on our Tech Community blog, and so we’ll also link to those blog posts too.





Native Alert Page 

Microsoft Defender for Identity security alerts in Microsoft 365 Defender | Microsoft Docs

Microsoft Defender for Identity native alert page in Microsoft 365 Defender - Microsoft Tech Communi...

Advanced Hunting

Using Microsoft Defender for Identity Data to Make Powerful Advanced Hunting Queries - Microsoft Tec...


To learn more about Defender for Identity, you’ll find all documentation here and training resources we have here. Remember to bookmark this link for the latest news too. 








New Contributor

Fantastic having more and more products available in a single portal. 

Frequent Visitor

Link doesn't go anywhere?


Thanks Robert - resolved!

Version history
Last update:
‎Jun 07 2021 10:45 AM
Updated by: