Microsoft Defender for Identity Experiences in Microsoft 365 Defender

[Banu Jafarli]

Microsoft Defender for Identity is a cloud-based security solution that leverages on-premises Active Directory (AD) signals to protect on-premises identities, detect and investigate lateral movement of on-premises attacks, and identify compromised identities and malicious insiders.  

We have exciting news to share!

Microsoft Defender for Identity’s features are in the process of being made available as part of Microsoft 365 Defender, accessible through security.microsoft.com. 

Following similar work done by the Defender for Endpoint and Defender for Office 365 teams, Defender for Identity will start making features available as part of Microsoft 365 Defender. This means all your Microsoft 365 Defender products will be in one location, simplifying administration and making life easier for administrators, SecOps analysts, and threat hunters.

This blog series will be the source of truth to keep you on track on which Defender for Identity features are available as part of Microsoft 365 Defender and which features will be soon released. You can always come to the latest entry in this blog series by heading to https://aka.ms/MDIPortalConverge. We’ll also reference any of the previous entries in the series any time we post a new update.

We recommend that customers start using these features in the Microsoft 365 security center (security.microsoft.com) as and when they are available in public preview. In addition to Defender for Identity features, you will have the ability to use unique Microsoft 365 Defender features such as advanced hunting, incident correlation, and custom detection rules.

These all benefit from having Defender for Identity data contributing to them, providing customers with the unique lens of on-premises identity to their threat hunting capabilities.

We’ll populate the table below with the latest features that land in Microsoft 365 Defender, along with any documentation that’s been released to support it. We normally announce these releases on our Tech Community blog, and so we’ll also link to those blog posts too.

Feature	Documentation	Blogs
Native Alert Page	Microsoft Defender for Identity security alerts in Microsoft 365 Defender | Microsoft Docs	Microsoft Defender for Identity native alert page in Microsoft 365 Defender - Microsoft Tech Communi...
Advanced Hunting	https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-identitylogonevent...	Using Microsoft Defender for Identity Data to Make Powerful Advanced Hunting Queries - Microsoft Tec...
Administration and configuration settings	https://docs.microsoft.com/en-us/microsoft-365/security/defender-identity/sensor-health?view=o365-wo...	Microsoft Defender for Identity Experiences in Microsoft 365 Defender - Microsoft Tech Community
Exclusion Settings	Microsoft Defender for Identity detection exclusions in Microsoft 365 Defender | Microsoft Docs	Microsoft Defender for Identity - new exclusion settings now in Public Preview - Microsoft Tech Comm...

To learn more about Defender for Identity, you’ll find all documentation here and training resources we have here. Remember to bookmark this link for the latest news too.